# FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
## 1 Introduction  
As a critical infrastructure of the Internet, the DNS protocol plays an important role in the translation between domain names and IP addresses. However, DNS requests and responses are transmitted in the form of plaintext, which means that anyone can intercept and view the network access behavior of users between the host and local DNS server, which is detrimental to the protection of user privacy and network security [1]. Therefore, the technology to protect the security of DNS requests comes into being. At present, the three protocols listed in the Internet standardization document include Domain Name System Security Extensions (DNSSEC), DNS over TLS (DoT), and DNS over HTTPS (DoH). DNSSEC mainly uses digital signature technology to protect the integrity and authenticity of the DNS response, but the communication process is still transparent to attackers. DoT and DoH both use TLS encryption, the difference between them being that the former uses the dedicated port 853, while the latter uses the HTTPS standard port 443, i.e., DoH transfers DNS messages using HTTPS streams. Today, companies, such as Google, Cloudflare, and Alibaba, offer DoH nodes, and Google's Chrome browser nativelysupports DoH. In February 2020, Mozilla Firefox began enabling DoH by default for US users, and DNS requests from Firefox were encrypted by DoH and forwarded to Cloudflare or [2]. DoH has played an effective role in protecting customers' privacy and network security and has thus developed rapidly and is more widely used in practical applications. With the development of 5G technology, Internet of Things (IoT) systems are gaining momentum. While they result in greater convenience, their use presents many security challenges, e.g., data privacy, unstable network connections, and possible botnets [3]. The DNS system, as the underlying network, affects the reliability and security of the IoT [4]. DNS technology meets the availability and transparency requirements for deploying the IoT, a large number of heterogeneous devices can use DNS for network access, and DNS encryption technology better protects the DNS data privacy of users. However, the risks and opportunities are the same: the encryption of DoH and the interactivity of end-to-end devices in the IoT (without human involvement) may jointly lead to attacks that are less likely to be detected, not to mention the emergence of large-scale botnets and DDoS attacks on public IoT services [5]. Therefore, while DoH enhances security, it also provides new opportunities for attackers. In July 2019, Netlab, the cyber threat search division of Qihoo 360, released a report that malware named Goldula used DoH to obtain domains and use them as communication channels for Command and Control (C&C) [6]. In May 2020, Kaspersky also discovered that Iran's APT group OilRig had weaponized DoH and applied it to actual network data theft activities [7]. General, non-encrypted DNS covert channels are transmitted in plaintext via port 53 in the C&C stage of Advanced Persistent Threats (APT), while a DoH uses encrypted transmission via port 443, which is indistinguishable from general HTTPS traffic for network administrators. An attacker can thus hide and encrypt the DNS covert channel via DoH to conduct malicious cyber attacks. In this paper, we propose a DoH-encrypted DNS covert channel detection method called FF-MR that aims to improve detection performance and solve the problems of weak single-feature differentiation and poor performance in existing research. In summary, the contributions of our paper are three-fold:  
* We summarize and analyze the threat scenario of DoH-encrypted DNS covert channels in the C&C stage, clarify its communication principle, and provide support for the research of detection methods. * We propose a DoH-encrypted DNS covert channel detection method (FF-MR) based on feature fusion.