# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 4 Method Design
### Model Development and Architecture
#### 4.3.1 Session Byte Sequence Features Extraction  
We adopt a Residual Neural Network to extract the session byte sequence features, treating the bytes as words in Natural Language Processing (NLP) tasks and the session  
Figure 3: Structure of MHA-Resnet. byte sequences as sentences, obtaining the contextual associations of the bytes in the session through Conv1D and then extracting the combined byte information, including fields and messages. Moreover, shallow convolution is used to obtain the contextual association of bytes inside the TCP header and TLS handshake message, at which time the combined byte information is at the field level, corresponding to the packet size in the TCP connection stage, timestamp, and TLS certificate mentioned in Section 4.2, i.e., TCP transmission features and TLS handshake features. Deep convolution is used to obtain the contextual association of the TCP and TLS messages in the session when the combined byte information is at the message level, corresponding to the extraction of the correlation between adjacent TCP and TLS messages, i.e., the local pattern of the DoH-encrypted DNS covert channel during transmission. As shown in Figure 3, in order to process network traffic data with a one-dimensional sequence structure, the Residual Neural Network is based on one-dimensional convolution, and the main body consists of four residual layers (ResLayer). Each residual layer consists of two residual blocks (ResBlock), and two sets of one-dimensional convolutional layers (Conv1D) with batch normalization layers (BatchNormNorm) are used in the basic residual blocks. The difference between the different residual layers is that the first residual block in the last three residual layers adds to the downsampling operation, and the structure of the downsampling is shown in Figure 4.  
Firstly, we ascend dimensionality of the first \(n\) bytes \(\mathbf{X_{i}}\) of the \(i\)th session after a layer of one-dimensional convolution using the batch normalization operation. Specifically, the multi-channel feature matrix \(\mathbf{X^{\prime}_{i}}\) is obtained by multiple convolution kernels, where multiple convolution kernels represent multiple feature extractors, indicating the extraction of different convolutional features with adjacent bytes. Batch normalization is mainly used to solve the problem of gradient disappearance or explosion in deep neural networks. Secondly, four residual layers extract convolutional features of adjacent fields or messages. Afterwards, the preliminary convolution operation of \(\mathbf{X^{\prime}_{i}}\) is performed in the first residual layer to obtain the output with the same dimension as the input and the next three residual layers to extract the sequence features under different step lengths using the downsampling operation. The downsampling operation can be performed by decreasing the size of the convolution kernel and increasing the step length in order to extract sequence features with multiple fields while ensuring the same tensor dimensionality for residual concatenation. The calculation of the multi-channel session's byte sequence features \(\mathbf{X^{\prime\prime}_{i}}\) is as follows:  
\[\mathbf{X^{\prime}_{i}}=\text{BatchNormNorm}(\text{Conv1D}(\mathbf{X_{i}})) \tag{12}\] \[\mathbf{X^{\prime\prime}_{i}}=\text{Reslayer4}\big{(}\text{Reslayer 3}\big{(}\text{Reslayer2}\big{(}\text{Reslayer1}\big{(}\mathbf{X^{\prime}_{i}} \big{)}\big{)}\big{)}\big{)} \tag{13}\]  
Finally, the multi-channel session byte sequence features \(\mathbf{X^{\prime\prime}_{i}}\) are input into the neural network composed of the Multi-Head Attention mechanism for weighted feature fusion. The main significance of the multi-channel features is to fully characterize the different TCP transmission features, TLS handshake features, and local transmission patterns of the DoH-encrypted DNS covert channels extracted by the multi-convolutional kernel and multi-step and then correlate them with statistical features, thus filtering out unnecessary features.