# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 2 Related Work  
In this paper, we mainly present the existing research on DoH-encrypted DNS covert channel detection. Most previous studies have used statistical features and the CIRA-CIC-DoHBrw-2020 dataset in their experiments. Detection is basically performed in two layers: the first layer classifies non_DoH (HTTPS traffic) with DoH traffic, and the second layer classifies DoH traffic into normal DoH and malicious DoH traffic, i.e., DoH-encrypted DNS covert channel traffic, as shown in Table 1.  
[PERSON] et al. [8] performed a statistical analysis of DoH traffic and extracted a total of 34 classes of statistical features, including IPs and ports, and used machine learning algorithms such as LGBM and XGBoost to perform two-level classification. However, the source IPs and destination IPs, which are directly related to the data itself, were used as the basis for classification, and the resulting experimental results were obviously not objective. [PERSON] et al. [9] proposed arranging the captured packets in temporal order. A set of consecutive packets in the same direction within a certain time threshold is called a packet cluster. In this study, 28 classes of statistical features were extracted, and traditional machine learning algorithms, including Random Forest (RF), Naive Bayes (NB), Support Vector Machines (SVM), and Long Short-Term Memory (LSTM) Neural Networks, were used to distinguish non_DoH from DoH and normal DoH from malicious DoH traffic. [PERSON] et al. [11] proposed a two-layer classification of DoH based on a Transformer containing a four-layer encoder and a six-layer decoder using statistical features as input. They also used an ELK stack architecture, which included four modules: Elasticsearch, Logstash, Kibana, and Beats. Finally, a Security Operation Center (SOC) system enabled the monitoring and detection of malicious DoH traffic for enterprise-level networks. For binary classification, [PERSON] [10] combined statistical feature analysis with a Bidirectional Recurrent Neural Network (Bi-RNN) to achieve the detection of DoH-encrypted DNS covert channels. [PERSON] et al. [12] established a TLS fingerprint whitelist based on the information from the TLS handshake stage, where TLS fingerprints not on the whitelist will be considered as suspicious DoH traffic; in addition, normal DoH and encrypted DNS covert channels are classified according to the statistical features of the DoH flow. The difference between [PERSON] work and other studies is that the attack scenarios are simulated; data on the location (latency), number, sending interval (rate), and packet (domain name) length of different DoH servers are generated; and a large number of adversarial and evaluation experiments are conducted to verify the effectiveness of the method using three machine learning models. The above studies only investigate the detection of encrypted DNS covert channels, but there is less work related to identification of DoH-encrypted DNS covert channels in the literature. [PERSON] et al. [14] proposed an interpretable machine learning approach using ten-fold cross-validation to triple classify HTTPS, normal DoH, and DoH-encrypted DNS covert channel traffic by stacking RF-based classifiers and, finally, test the performance of the model in identifying encrypted DNS covert channels. The model could only achieve an accuracy of about 92%. [PERSON] et al. [13] chose three machine learning algorithms, XGBoost, LightGBM, and CatBoost, to implement a three-stage detection of HTTPS and DoH, normal DoH, and DoH-encrypted DNS covert channel traffic, respectively, followed by the classification and identification of the encrypted DNS covert channels.