Contrastive Sequence Learning for DoH Tunnel Detection and Fine-Grained Traffic Classification

DNS over HTTPS (DoH) protects name-resolution traffic but can also conceal command-and-control and data-exfiltration channels. Detection is challenging because benign and malicious flows share similar statistics, packet relationships span long sequences, and labeled malicious examples are scarce. We present the Contrastive Learning–Transformer–Bidirectional Gated Recurrent Unit–Attention model (CL–TBiGRU–Attention). The model combines contrastive pretraining with global and bidirectional temporal modeling. We evaluate binary DoH/non-DoH detection, tunneling-tool classification on two datasets, and malware-family classification. Across these four tasks, accuracy ranges from 94.91% to 99.98%, and the F1-score ranges from 95.02% to 99.98%. The model outperforms the listed neural baselines in binary detection and all listed methods in the three fine-grained tasks. On malware-family classification, it reaches 97.00% accuracy and 97.01% F1-score, with most residual confusion occurring between Sisron and Zloader. These results show the value of contrastive sequence modeling for coarse- and fine-grained DoH traffic analysis on the evaluated benchmarks.