# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 3 The Proposed Work
### Dataset Description  
The proposed method is tested on the CIRA-CIC-DoHBrw-2020 dataset (with 1,167,136 records and 29 statistical features) to check the performance detection of DoH traffic. The University of New Brunswick dataset was developed to address this lack, and it separately offers a dataset that is able to examine benign and malicious DoH traffic. DNS over HTTPS, a standard in the Internet Engineering Task Force (IETF) introduced in RFC8484, improves privacy through encrypting queries and defenses against eavesdropping attacks (Man-in-the-middle). However, this form of encryption also hampers the ability to categorize benign and malignant activity from one another, which warrants advanced classification methods [32]. The following two-layered approach is used for the dataset: In Layer 1, all traffic is analyzed and classified as DoH or non-DoH. Layer 2 segregates DoH traffic even more, distinguishing benign DoH from malicious DoH. A key feature of this hierarchical classification design is that it supports a multilevel traffic analysis process, as well as different types of network-related decisions, making this approach perfect for research purposes. For data collection, 10,000 Alexa websites were captured via both regular web browsers (Google Chrome and Mozilla Firefox) and DNS \begin{table}
\begin{tabular}{c c c} \hline \hline
**Component** & **Parameter** & **Value** \\ \hline \multirow{3}{*}{KNN} & Number of Neighbors (k) & 8 \\ \cline{2-3}  & Distance Metric & Euclidean \\ \hline \multirow{3}{*}{XgBoost} & Learning Rate & 0.5 \\ \cline{2-3}  & Maximum Depth & 7 \\ \cline{2-3}  & Number of Estimators & 100 \\ \hline \multirow{3}{*}{RF} & Number of Trees & 95 \\ \cline{2-3}  & Maximum Depth & 8 \\ \cline{2-3}  & Minimum Samples Split & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Optimized Parameters of ACO, Xgboost, KNN, RF and CNNs based on Gaussian Optimization. Figure 5: Comparison of classification accuracies obtained using default parameters and tuned parameters (optimized by Gaussian Optimization) for XGBoost, KNN, and Random Forest classifiers in both binary and multiclass classification tasks. tunneling software (dns2 tcp, DNSCat2, and Iodine) to model different network behaviors. The traffic was captured on four most popular DoH servers: Cloudflare, Quad9, Google DNS, and AdGuard. Regular HTTPS browsing sessions create nonDoH traffic, and benign DoH queries are generated via actual browser-based DoH requests. DNS tunneling tools are used to encapsulate TCP traffic into an unrecognizable type of DoH request, as shown in the following screenshot, and send it through the HTTPS-encrypted tunnel. DoHMeter, like the PoC tool, uses Python to obtain statistical features from saved DoH traffic. Since raw data from PCAP files encode much information that does not provide direct insights into DoH traffic behavior, this tool is used to focus on 29 interesting statistical features. All these features describe the general behavior of different DoH flows, such as packet size, flow duration, and interarrival times. The output is written into the CSV file, in which each flow is either marked as Benign or Malicious by its features, but it does not contain any information on the source IP, destination IP, or port. All 29 statistical features extracted from the observed traffic data are summarized in Table 2.  
The dataset is divided into three classes: non-DoH, DoH-benign, and DoH-malicious. Table 3 below provides an overview of the label counts across both layers: