Design and Evaluation of an Explainable Network-Edge IDPS for Early Detection and Reversible Block of Malicious DNS-over-HTTPS Tunnels
Keywords:
DNS over HTTPS, intrusion detection and prevention system, encrypted traffic analysis, explainable artificial intelligence, Suricata, network-edge securityAbstract
DNS over HTTPS (DoH) protects name-resolution traffic from passive
inspection, but the same encryption can conceal tunneling behavior from controls that rely on visible DNS content. This proposal presents an explainable network-edge intrusion detection and prevention system (IDPS) for a commodity Linux router. The prototype will observe only timing, direction, and size features from the first N payload-bearing TCP segments of an encrypted connection; it will not decrypt TLS, inspect DNS questions, or identify individual HTTP/2 streams. A class-weighted logistic regression baseline and a bounded random forest will be developed using group-separated fitting, model selection, calibration, threshold tuning, safety confirmation, and final testing. The primary corpus will be the raw CIRA-CIC-DoHBrw-2020 packet captures, while DoH-Tunnel-Traffic-HKD will
serve as a locked positive-only challenge. The selected model will be compared with routing-only, pinned Suricata-only, and hybrid configurations at registered offered loads. Evaluation will cover precision-recall performance, calibration, false blocks, verdict coverage, pre-verdict exposure, latency, throughput, packet loss, CPU use, and memory use. Temporary exact-connection blocking will be enabled only if the adviser approves the eight-week route and the benign-risk confidence bound meets the pre-registered safety gate. The expected output is a reproducible evidence package showing whether early learned detection adds safe, measurable value to a conventional firewall and rule-based IPS on low-cost hardware.
References
Abu Al-Haija, Q., Alohaly, M., & Odeh, A. (2023). A lightweight double-stage
scheme to identify malicious DNS over HTTPS traffic using a hybrid learning
approach. Sensors, 23(7), 3489. https://doi.org/10.3390/s23073489
Aggarwal, A., & Kumar, M. (2024). An ensemble framework for detection of
DNS-over-HTTPS (DoH) traffic. Multimedia Tools and Applications, 83,
32945–32972. https://doi.org/10.1007/s11042-023-16956-9
Bishop, M. (2022). HTTP/3 (RFC 9114). Internet Engineering Task Force.
https://www.rfc-editor.org/rfc/rfc9114.html
Böttger, T., Cuadrado, F., Antichi, G., Fernandes, E. L., Tyson, G., Castro, I., &
Uhlig, S. (2019). An empirical study of the cost of DNS-over-HTTPS. In
Proceedings of the 2019 Internet Measurement Conference (pp. 15–21). Association for Computing Machinery. https://doi.org/10.1145/3355369.3355575
Breiman, L. (2001). Random forests. Machine Learning, 45, 5–32.
https://doi.org/10.1023/A:1010933404324
Canadian Institute for Cybersecurity. (2020). CIRA-CIC-DoHBrw-2020 dataset.
University of New Brunswick. https://www.unb.ca/cic/datasets/dohbrw-2020.html
Casanova, L. F. G., & Lin, P.-C. (2023). Malicious network traffic detection for
DNS over HTTPS using machine learning algorithms. APSIPA Transactions on
Signal and Information Processing, 12(2), 1–24. https://doi.org/10.1561/116.00000058
Chapman, P., Clinton, J., Kerber, R., Khabaza, T., Reinartz, T., Shearer, C., &
Wirth, R. (2000). CRISP-DM 1.0: Step-by-step data mining guide. SPSS.
Chicco, D., & Jurman, G. (2020). The advantages of the Matthews correlation
coefficient (MCC) over F1 score and accuracy in binary classification
evaluation. BMC Genomics, 21, 6. https://doi.org/10.1186/s12864-019-6413-7
Clopper, C. J., & Pearson, E. S. (1934). The use of confidence or fiducial limits
illustrated in the case of the binomial. Biometrika, 26(4), 404–413.
https://doi.org/10.1093/biomet/26.4.404
Du, J., Liu, S., Zhi, C., Zhao, J., Wu, H., & Cheng, G. (2026). TunnelEye: An
explainable framework for real-time detection of malicious DoH traffic in
high-speed backbone networks. IEEE Transactions on Network and Service
Management. https://doi.org/10.1109/TNSM.2026.3682686
Guo, C., Pleiss, G., Sun, Y., & Weinberger, K. Q. (2017). On calibration of modern
neural networks. In Proceedings of the 34th International Conference on Machine Learning
(pp. 1321–1330). PMLR. https://proceedings.mlr.press/v70/guo17a.html
Hoffman, P., & McManus, P. (2018). DNS queries over HTTPS (DoH) (RFC 8484).
Internet Engineering Task Force. https://www.rfc-editor.org/rfc/rfc8484.html
Jerabek, K., Hynek, K., & Rysavy, O. (2024). Comparative analysis of DNS over
HTTPS detectors. Computer Networks, 247, 110452.
https://doi.org/10.1016/j.comnet.2024.110452
Kapoor, S., & Narayanan, A. (2023). Leakage and the reproducibility crisis in
machine-learning-based science. Patterns, 4(9), 100804.
https://doi.org/10.1016/j.patter.2023.100804
Lundberg, S. M., & Lee, S.-I. (2017). A unified approach to interpreting model
predictions. In Advances in Neural Information Processing Systems 30 (pp. 4765–4774).
Mitsuhashi, R., Jin, Y., Iida, K., Shinagawa, T., & Takai, Y. (2022). Malicious DNS
tunnel tool recognition using persistent DoH traffic analysis. IEEE Transactions
on Network and Service Management. https://doi.org/10.1109/TNSM.2022.3215681
Mitsuhashi, R., Jin, Y., Iida, K., Shinagawa, T., & Takai, Y. (2023).
DoH-Tunnel-Traffic-HKD dataset. Hokkaido University Collection of Scholarly and
Academic Papers. https://hdl.handle.net/2115/88092
MontazeriShatoori, M., Davidson, L., Kaur, G., & Habibi Lashkari, A. (2020).
Detection of DoH tunnels using time-series classification of encrypted traffic.
In 2020 IEEE DASC/PiCom/CBDCom/CyberSciTech (pp. 63–70). https://doi.org/10.11
09/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026
National Institute of Standards and Technology. (2023). Artificial Intelligence Risk
Management Framework (AI RMF 1.0) (NIST AI 100-1).
https://doi.org/10.6028/NIST.AI.100-1
Office of the President of the Philippines. (2024, April 4). Executive Order No. 58:
Adopting the National Cybersecurity Plan 2023–2028 and directing its implementation. Official
Gazette of the Republic of the Philippines.
https://www.officialgazette.gov.ph/2024/04/04/executive-order-no-58-s-2024/
Open Information Security Foundation. (2026). Setting up IPS/inline for Linux: Suricata
8.0.1 documentation. https://docs.suricata.io/en/suricata-8.0.1/ips/setting-up-ipsi
nline-for-linux.html
Pich, R., Sreng, S., & Colin, J.-N. (2024). DoH tunneling traffic detection based on
single packet features analysis. In Proceedings of the 2023 12th International
Conference on Networks, Communication and Computing.
https://doi.org/10.1145/3638837.3638861
Republic of the Philippines. (2012). Republic Act No. 10173: Data Privacy Act of 2012.
Official Gazette.
https://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/
Saito, T., & Rehmsmeier, M. (2015). The precision-recall plot is more informative
than the ROC plot when evaluating binary classifiers on imbalanced
datasets. PLOS ONE, 10(3), e0118432.
https://doi.org/10.1371/journal.pone.0118432
Scarfone, K., & Mell, P. (2007). Guide to intrusion detection and prevention systems (IDPS)
(NIST SP 800-94). National Institute of Standards and Technology.
https://doi.org/10.6028/NIST.SP.800-94
Siby, S., Juarez, M., Diaz, C., Vallina-Rodriguez, N., & Troncoso, C. (2020).
Encrypted DNS → privacy? A traffic analysis perspective. In Proceedings of the
Network and Distributed System Security Symposium. https://www.ndss-symposium.org/
ndss-paper/encrypted-dns-privacy-a-traffic-analysis-perspective/
Singh, S. K., & Roy, P. K. (2022). Malicious traffic detection of DNS over HTTPS
using ensemble machine learning. International Journal of Computing and Digital
Systems, 11(1), 1061–1069. https://doi.org/10.12785/ijcds/110185
Thomson, M., & Benfield, C. (2022). HTTP/2 (RFC 9113). Internet Engineering Task
Force. https://www.rfc-editor.org/rfc/rfc9113.html
United Nations. (n.d.). Goal 9: Industry, innovation and infrastructure.
https://sdgs.un.org/goals/goal9
Varma, S., & Simon, R. (2006). Bias in error estimation when using
cross-validation for model selection. BMC Bioinformatics, 7, 91.
https://doi.org/10.1186/1471-2105-7-91
Vekshin, D., Hynek, K., & Cejka, T. (2020). DoH Insight: Detecting DNS over
HTTPS by machine learning. In Proceedings of the 15th International Conference on
Availability, Reliability and Security. https://doi.org/10.1145/3407023.3409192
Yusof, M. H. M., Almohammedi, A. A., Shepelev, V., & Ahmed, O. (2022).
Visualizing realistic benchmarked IDS dataset: CIRA-CIC-DoHBrw-2020.
IEEE Access, 10, 94624–94642. https://doi.org/10.1109/ACCESS.2022.3204690
Zebin, T., Rezvy, S., & Luo, Y. (2022). An explainable AI-based intrusion detection
system for DNS over HTTPS (DoH) attacks. IEEE Transactions on Information
Forensics and Security, 17, 2339–2349.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Kurt Louise Dacung, Jan Viktor Esparrago, Sem Borja, James Ethan De Jesus, Jasper Lincold Flores (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
