# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 6 Conclusions  
In this paper, we propose a DoH-encrypted DNS covert channel detection method based on feature fusion called FF-MR to solve the problem of weak single-feature differentiation in existing research. FF-MR extracts TCP transmission features, TLS handshake features, and the local transmission patterns of DoH-encrypted DNS covert channels from session byte sequences using a Residual Neural Network, calculates global correlations with statistical features using a Multi-Head Attention mechanism, and finally, performs weighted fusion. After multiple iterations of the neural network, important features will be given higher weights, which plays a key role in classification. The proposed method's results on the CIC-DoHBrw-2020 dataset show that its macro-averaging precision and recall reach 99.72% and 99.73%, respectively, and its macro-averaging F1-Score is able to reach 0.9978. Compared with existing methods discussed in this paper, FF-MR achieves at most a 4.56% improvement in macro-averaging F1-Score. Moreover, FF-MR demonstrates a better F1-Score than the methods discussed in this paper when identifying two encrypted DNS covert channels, iodine and dns2 cat, improving from the highest scores of 0.977 and 0.9869 for other methods to 0.9951 and 0.9954, respectively. The effectiveness of the MHA-Resnet model used in FF-MR is verified from three aspects by comparison with baseline models, and finally, we implemented parameter sensitivity experiments to determine the value of the byte sequence length \(n\). However, due to the complex structure of the model, the real-time performance is poor. Thus, we will take into account the accuracy and real-time performance in future research.  
Figure 14: Distribution of TCP and TLS layer bytes.  
Figure 15: Comparison of results under different bytes size \(n\): (**a**) comparison of macro-averaging under different bytes size \(n\); (**b**) Comparison of F1-Score under different bytes size \(n\) in identification of iodine and dnscat2.  
**Author Contributions:** Conceptualization, C.S., Y.W. and D.H.; methodology, C.S. and Y.W.; validation, C.S., Y.W. and D.H.; formal analysis, C.S., Y.W., X.X. and Y.L.; investigation, D.H.; resources, C.S. and Y.W.; data curation, C.S., Y.W. and X.X.; writing--original draft preparation, C.S.; writing--review and editing, C.S., Y.W., X.X. and Y.L.; visualization, C.S. and D.H.; supervision, C.S., D.H. and Y.L. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research received no external funding.  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** The CIRA-CIC-DoHBrw-2020 dataset that supports the findings of this study is openly available in DNS over HTTPS (CIRA-CIC-DoHBrw2020) at [[https://www.unb.ca/cic/datasets/index.html](https://www.unb.ca/cic/datasets/index.html)]([https://www.unb.ca/cic/datasets/index.html](https://www.unb.ca/cic/datasets/index.html)), (accessed on 10 June 2022).  
**Conflicts of Interest:** The authors declare no conflict of interest.