# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 4 Method Design
### Model Development and Architecture  
The MHA-Resnet architecture includes three parts: the extraction of session byte sequence features, the weighted fusion of session statistical features and byte sequence features, and session classification. The model is based on the Residual Neural Network.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Number** & **Feature** \\ \hline Duration & 1 & Session duration \\ \hline \multirow{4}{*}{Number of bytes} & 2 & Number of session bytes sent \\  & 3 & Rate of session bytes sent \\  & 4 & Number of session bytes received \\  & 5 & Rate of session bytes received \\ \hline \multirow{4}{*}{Packet length} & 6 & Mean Packet Length \\  & 7 & Median Packet Length \\  & 8 & Mode Packet Length \\  & 9 & Variance of Packet Length \\  & 10 & Standard Deviation of Packet Length \\  & 11 & Coefficient of Variation of Packet Length \\  & 12 & Skew from median Packet Length \\  & 13 & Skew from mode Packet Length \\ \hline \multirow{4}{*}{Packet time} & 14 & Mean Packet Time \\  & 15 & Median Packet Time \\  & 16 & Mode Packet Time \\  & 17 & Variance of Packet Time \\  & 18 & Standard Deviation of Packet Time \\  & 19 & Coefficient of Variation of Packet Time \\  & 20 & Skew from median Packet Time \\  & 21 & Skew from mode Packet Time \\ \hline \multirow{4}{*}{Request/response time difference} & 22 & Mean Request/response time difference \\  & 23 & Median Request/response time difference \\  & 24 & Mode Request/response time difference \\  & 25 & Variance of Request/response time difference \\  & 26 & Standard Deviation of Request/response time difference \\  & 27 & Coefficient of Variation of Request/response time difference \\  & 28 & Skew from median Request/response time difference \\  & 29 & Skew from mode Request/response time difference \\ \hline \hline \end{tabular}
\end{table}
Table 2: Session statistical features.  
The Multi-Head Attention mechanism is used to globally weight and fuse the features to improve the detection performance of the model. The structure of MHA-Resnet is shown in Figure 3. In order to learn the different communication behaviors of five types of traffic and the mode of TLS encrypted connection, session statistical features and byte data are taken as the input of the model. Byte sequence features, including TCP transmission features, TLS handshake features, and local patterns of DoH-encrypted DNS covert channels, are extracted by the multiple one-dimensional convolutional layers (Conv1D) of the Residual Neural Network, which are then concatenated with session statistical features. The attention weight distribution between all features is calculated by the Multi-Head Attention mechanism, which re-represents the features as the result of a weighted fusion. The output vector of the model is the probability that a session is judged as each of the five types of traffic (i.e., iodine, dnscat2, dns2 tcp, benign_DoH, non_DoH), and the label of the maximum probability in the output vector is taken as the classification result.  
The model contains the design of residual connection in both of the above neural networks and achieves the purpose of adaptively adjusting the number of network layers according to the task needs by generating constant mapping of the redundant network layers when it is unnecessary. This mitigates to some extent the negative impact of the deep neural network degradation problem on the model performance [39].