## 1 Introduction  
Domain Name System (DNS) is a hierarchical and decentralized naming system commonly used to map domain names to IP addresses. Since DNS is a public and plain-text protocol, it is vulnerable to various DNS attacks. In the past two decades, there have been various DNS attacks and countermeasures to protect DNS. Authentication was used for DNS spoofing attack [1, 2]; a DNS amplification attack was prevented by response rate limiting or DNS load balancing [3]; and analyzing the DNS packets protected DNS from DNS tunneling [4]. In addition, various DNS protection technologies have been introduced, such as OpenDNS by Cisco [5], DNSFilter [6], and Infolbox BloxOne Threat Defense [7]. Despite these security solutions, DNS still has privacy issues in reality since DNS is a plain-text protocol. This issue should not be ignored, especially in an enterprise network where more sensitive data protection is required. In an enterprise network, many activities, such as web, email, and file exchange over the Internet or a local network, are heavily relative to the DNS [8]. In practice, an enterprise network can generate millions of DNS queries and responses a day. The DNS traffic includes crucial data such as IP addresses, destination, source port number, and transaction ID, which can be exploited by attackers [9; 10; 11]. Furthermore, attackers can obtain sensitive information to create user profile and exploit it to launch attacks or even for the calculation of a user's geographical area [12]. To resolve this security issue, the Internet Engineering Task Force (IETF) developed DNS-over-HTTPS in 2018 [13]. In DoH, a DNS query is wrapped in the regular HTTPS traffic and forwarded to a DoH-capable DNS server called a DoH resolver via port 443. The query is resolved within a DoH request, and the response is also encrypted. DoH protects users' privacy while speeding up DNS query processing. Since DoH traffic is encrypted, even the internet service provider cannot examine the contents of the DNS packet. It can also protect DNS against phishing attack, eavesdropping, and DNS data modification by Man-in-the-Middle attack. DoH is now available as an extension service in various browsers, including Firefox and Chrome. The definition and implementation of DoH is explained clearly in RFC 8484 [13] and RFC 1035 [14]. Although DoH can prevent many security vulnerabilities, on the other hand, it may bring about a severe security problem. Because DoH APIs are public, attackers can easily use them to develop a more powerful DNS tunneling attack, known as DoH tunneling. DoH tunneling [15] is an upgrade of DNS via HTTPS, which is harder to detect. The traditional DNS [9] uses port 53 for communication in the DNS resolution process. Therefore, the existing security solutions such as OpenDNS by Cisco [5], DNSFilter [6], and Infoblox BloxOne Threat Defense [7] analyze the DNS packets on this port. In DoH, however, all the DNS queries and responses are exchanged on port 443 [13], which is the same port that other HTTPS applications use. Consequently, the existing DNS security techniques cannot capture the DoH packet separately. Moreover, since the DoH traffic is encrypted, the clues used to detect attacks such as packet header, packet number, packet length, packet direction, and arrival interval between packets are not available, which makes detection difficult [15]. Furthermore, DNS blocking solutions such as IP Blacklist cannot be executed because the information about IP address is encrypted in DoH. The previous research on DoH tunneling detection has employed Supervised Machine Learning approaches such as Random Forest, Decision Tree, Support Vector Machine, and Gradient Boosting to distinguish DoH tunneling traffic from conventional HTTP traffic based on their statistical features [15; 16; 17]. Although they achieved high accuracy with their dataset, there remain some limitations. Firstly, these techniques require labeled data to achieve high precision.