# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 1 Introduction  
Intrusion Detection Systems (IDSs) have become indispensable tools in safeguarding network infrastructures as cyberattacks grow increasingly sophisticated. The global cybersecurity market, which includes IDS technologies, was valued at 119.75 billion USD in 2022 and is projected to expand at a compound annual growth rate (CAGR) of 8.0% from 2023 to 2030 [1]. This rapid growth reflects the urgent need for advanced security measures in critical sectors such as government, military, and public infrastructure, where vulnerabilities to cyber threats carry severe consequences [2]. The Domain Name System (DNS), a cornerstone of internet functionality, translates human-readable domain names into machine-interpretable IP addresses. Despite its foundational role, traditional DNS traffic operates in unencrypted plaintext, exposing it to interception, tampering, and surveillance by malicious actors. The lack of encryption in DNS queries creates significant privacy risks, as attackers can monitor or alter these communications. To counter these vulnerabilities, recent initiatives have prioritized DNSover HTTPS (DoH), a protocol that encrypts DNS traffic via HTTPS, thereby addressing the security shortcomings of conventional DNS [3]. DoH enhances privacy by encapsulating DNS requests within HTTPS sessions secured with Transport Layer Security (TLS). This encryption prevents third parties from intercepting or manipulating DNS resolutions, ensuring both confidentiality and data integrity [4]. Consequently, researchers have intensified efforts to refine encrypted communication protocols, aiming to strengthen the security architecture of DNS infrastructure [5]. Leading web browsers, including Google Chrome, Microsoft Edge, and Mozilla Firefox, now implement DoH by default to protect user privacy during domain resolution [6]. While this encryption mitigates DNS manipulation and eavesdropping, it complicates network monitoring, as security analysts cannot easily distinguish benign HTTPS traffic from malicious activities embedded within encrypted streams Figure 1.  
While DoH enhances confidentiality and integrity, it introduces challenges for network security by enabling malicious actors to conceal harmful activities. One such concern is DNS tunneling over HTTPS, where attackers exploit encrypted DNS channels to covertly exfiltrate data or establish communication with command-and-control (C2) servers [7]. Traditional intrusion detection and prevention systems (IDS/IPS) often rely on deep packet inspection (DPI) and signature-based techniques, which are effective for plaintext DNS but struggle with encrypted traffic. Since DoH hides DNS queries within HTTPS payloads, conventional monitoring tools cannot easily differentiate between legitimate encrypted web traffic and malicious DNS tunneling activities [8]. Attackers can use DoH to bypass security controls, evade detection, and establish persistent covert channels within the network. This significantly increases the difficulty for security teams in tracking unauthorized activities and detecting anomalies in encrypted traffic. Figure 1: DNS over HTTPS work mechanism. As a result, advanced detection mechanisms are required to identify DoH-based attacks effectively [9]. Machine learning (ML)-based techniques, such as decision trees, neural networks, and clustering algorithms, have emerged as promising approaches for detecting abnormal patterns in DoH traffic [10]. However, the high dimensionality and complexity of traffic data pose computational challenges. Dimensionality reduction techniques are essential for improving efficiency, reducing processing time, and optimizing the balance between security and privacy in DoH detection [11]. The detection of abnormal behavior in DoH traffic via machine learning ML-based techniques, such as decision trees, neural networks, and clustering algorithms, to identify traffic profiles is one of the increasing research subjects [12].