## 1 Introduction
However, due to the massive number of websites on the Internet, labeling all of the traffic data is an impossible task. Therefore, Supervised Machine Learning algorithms are not a good choice [18]. Secondly, the performance of Machine Learning techniques relies heavily on human-engineered feature extraction, which makes the classification of encrypted DoH traffic difficult. On the other hand, in Deep Learning, feature extraction is automatically selected through the training process. This characteristic makes Deep Learning a highly suitable method for DoH traffic classification, especially when we have no prior knowledge about the weight of the feature in DoH statistical features [19]. To overcome the limitations of the existing proposals, we propose a DoH tunneling attack detection system based on Transformer, a Deep Learning model that adopts the mechanism of self-attention [20]. It includes an HTTPS traffic collection and a DoH attack detection module with a two-layer classifier to detect malicious DoH tunneling traffic. Both layers in the malicious DoH detection module use the Transformer [20] architecture as a classifier. The first layer distinguishes DoH traffic from normal HTTPS traffic and the second layer classifies malicious DoH traffic from DoH traffic. The Transformer is a well-known architecture in natural language-processing jobs that offers numerous advantages over previous time-series data classification approaches. The Transformer can handle sequence data in parallel, allowing it to process more data in the same time period. The self-attention module in Transformer helps it to autofocus on essential features in sequence. These crucial characteristics make Transformer suitable for detecting DoH malicious traffic in HTTPS traffic. The proposed system is a lightweight, intelligent, and efficient DoH tunneling detection solution for an enterprise network to detect malicious DoH traffic among HTTPS traffic successfully. Our proposed system provides a distributed collection system for the Security Operation Center (SOC) to capture HTTPS traffic at any machine in the network and analyze them to detect malicious DoH traffic in real time. The detection module with the Transformer model has many advantages compared with existing proposals. It requires a much smaller number of labeled data. Although it is trained with only 25% of the labeled data, it has better accuracy, up to 99%, than previous techniques with the same number of labeled data. Our contributions in this study are as follows:  
* We propose a two-layered detection approach based on Transformer architecture as an effective DoH tunneling detection model. The first layer separates DoH and HTTPS traffic. The second layer separates legitimate DoH traffic from malicious DoH traffic. * We implement a fully functional DoH tunneling detection solution that can be integrated into an enterprise network's security operation system. The system is an end-to-end detection system that gathers HTTPS traffic traces, stores and analyzes them to detect malicious DoH traffic, and alerts the network manager. * Finally, we conduct comprehensive experiments to evaluate the proposed scheme. The results show that our proposed method achieves significant improvement compared with other research. The rest of the paper is organized as follows. Section 2 reviews some related work. In Section 3, background knowledge is described. Section 4 presents the model development and system architecture. Finally, the performance evaluation is shown in Section 5, and the paper is summarized with the conclusion in Section 6.