# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 2 Literature Review  
In this section, we review the literature on CIRA-CIC-DoHBrw-2020 and other widely used benchmark datasets in the IDS field, which are important resources for the analysis and detection of DoH traffic, including malicious and benign traffic. Various ML algorithms and optimization techniques have been deployed on this dataset to enhance feature selection and improve classification accuracy because of their importance in network security. These studies demonstrate the effectiveness of the dataset in discerning more sophisticated patterns embodied in the encrypted DNS traffic over time. Although significant advancements have been made, there are still certain constraints, such as ambiguity with respect to data preprocessing steps and inadequate interpretability in feature selection methodologies [14], and most of the models are geared toward binary classification tasks [15]; thus, the potential of these models to accommodate multiclass classification tasks is limited. A study [16] was conducted to detect the malicious activity of DNS levels in the DoH environment. To do this, the CIRA-CIC-DoHBrw-2020 dataset and different ML classifiers, such as logistic regression (LR), gradient boosting (GB), RF, NB, and KNN, were deployed. The experimental results revealed that the GB and RF outperform the other classifiers. Although [17] developed a CNN to identify threats and increase accuracy in DNS systems, they struggled with the lack of high-quality datasets specifically for testing DNS tunneling connections. The results showed that the model was able to correctly identify tunneling domains with 92% accuracy and maintained a low false positive rate of approximately 0.8%. Furthermore, researchers in [18] proposed a neural network-based intrusion detection system (NNIDS) that aims to respond quickly to attacks by analyzing low-level network details. The proposed approach yields a relatively low average accuracy of approximately 90%. Additionally, ref. [15] focused only on binary classification for classifying DNS traffic, and the authors applied supervised ML to distinguish between benign and malicious domains. However, this approach cannot detect malicious queries within non-DoH traffic. Relying solely on subdomain information is insufficient for identifying other types of attacks. Other researchers have analyzed the CIRA-CIC-DoHBrw-2020 dataset via multiple ML algorithms, including XGBoost, GB, and LightGBM, without details regarding the preprocessing phases, such as [14]. Previous studies have focused on the application of various MLs and deep learning algorithms in DoH detection without reducing or adopting the most effective features. This study concluded that the classification accuracy rates are not high or are not at the required level. In addition, sharing all the features in the dataset leads to increased computation time and model complexity. Feature selection is critical in ML-based IDSs for improving accuracy, efficiency, and interpretability. Identifying the most relevant data attributes reduces redundancy, speeds up processing, and minimizes overfitting, which is crucial for real-time detection. ML algorithms benefit significantly from feature selection, as they help them focus on the most informative features, improving model performance and reducing computational complexity [19]. Metaheuristic algorithms have been used for feature selection in DoH in recent studies. For traffic networks provided in the CIRA-CIC-DoHBrw-2020 dataset, four algorithms, namely, particle swarm optimization (PSO) [20], the genetic algorithm (GA) [21], the equilibrium optimizer (EO) [22] and the artificial bee colony (ABC) [23], are used to choose the relevant features to predict if the traffic networks are obtained from an attack or not. However, in general, the performance of such algorithms in high-dimensional datasets of IDS, including the CIRA-CIC-DoHBrw-2020 dataset with redundant or no useful attributes, requires complementary techniques such as dimensionality reduction to achieve performance improvement.