# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 4 Method Design
### Data Preprocessing
#### 4.2.1 Session Representation Extraction  
To make up for the fact that only using the statistical features is insufficient to detect DoH-encrypted DNS covert channels, we intercept a string of bytes from a session after traffic cleaning to use as input in the detection model. After analyzing the CIRA-CIC-DoHBrw-2020 dataset for HTTPS and DoH traffic, there is a certain difference in packet size between the two in the TCP connection stage, which is mainly reflected in the optional fields of the TCP headers. For example, in order to avoid serial number wrapping, most DoH traffic contains a TSval field for reliable transmission. In addition, because DoH traffic needs to query the domain name, the response time is longer, and time-related fields, such as TSval and Timestamps in the TCP header, reflect this communication delay, which can also be used as TCP transmission features to distinguish HTTPS and DoH traffic.  
The distinction between normal DoH and malicious DoH traffic, i.e., DoH-encrypted DNS covert channel, is mainly reflected in the TLS handshake stage, where the communicating parties negotiate the plaintext information, such as the TLS version, extension, cipher suite, certificate, and elliptic curve type used for encryption and decryption. To a certain extent, the plaintext information reflects the trustworthiness of the encrypted session. Due to the lack of security and formality guarantees for malicious DoH traffic, the above plaintext information is different from normal DoH traffic; for example, malicious traffic is more likely to use a lower version of the encryption algorithm. Normal encrypted traffic mostly uses Extended Validation SSL Certificates (EV SSL) and other highest trust level certificates [35]. In related studies, the certificate information and Client Hello message have also been verified to ensure a good degree of differentiation [36; 37]. For different forms of malicious DoH traffic, the TLS handshake information negotiated by the encrypted DNS covert channel, such as cipher suite and elliptic curve type, etc., is not consistent, so this information can be used as an effective feature to detect and identify encrypted malicious DNS covert channels.  
In summary, the packet size during the TCP connection stage, the timestamp field of the TCP packet, and the non-encrypted messages in the TLS handshake stage all reflect the characteristics of communication behavior of different types of traffic. Therefore, instead of focusing on data below the network layer, we concatenate the traffic data in the TCP layer with the traffic data in the TLS layer of each packet, extracting the first \(n\) bytes as the session representation. The number of bytes \(n\) is used as the hyperparameter of the detection model, and 512, 1024, 2048, 4096, and 8192 bytes are selected in the experiment in Section 5.3. According to the experimental results, we choose 1024 bytes as the session representation for the input \(n\) of the DoH-encrypted DNS covert channel detection model. The byte vector \(\mathbf{X}_{i}\) of the \(i\)th session after normalization can be expressed as:  
\[\mathbf{X}_{i}=\left[x_{1}^{i},x_{2}^{i},\ldots,x_{k}^{i},\ldots,x_{n}^{i}\right] \tag{10}\]  
where \(x_{k}^{i}\) is the \(k\)th byte of the \(i\)th session.