# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
## 4 Experiments and Analysis of Results
### Analysis of Results  
This section offers a comprehensive analysis of the experimental results, emphasizing the key performance indicators of the model through various visualizations. The specific results, along with their corresponding graphical representations, are presented below. To conduct a thorough assessment of the model's stability and generalization capabilities, a five-fold cross-validation method is utilized. The fold plot serves as a visual representation of the variation in model accuracy throughout the five-fold cross-validation process. Notably, despite the use of distinct datasets in each fold, the model demonstrates a consistent level of accuracy, exhibiting only minor fluctuations. The findings of this analysis are illustrated in Figure 11.  
Figure 11: Line graph of the accuracy of different models. Figure 10: Results of model accuracy with thresholds. To achieve a deeper understanding of the distribution of model accuracies, this paper incorporates a box plot. The plot illustrates both the mean and median accuracies for each model, while also emphasizing the dispersion and potential range of variation in the accuracies through the use of quartiles and outliers. The box plot is presented in Figure 12.  
The box plot observations are presented below. The DBM-ENSec model attains the highest median detection accuracy while exhibiting the narrowest range of accuracy distributions, thereby demonstrating enhanced stability and performance. The median detection accuracy of the XGBoost model is marginally lower than that of the DBM-ENSec model. While the distribution range of the XGBoost model is narrower and its performance is more stable, it remains slightly inferior to the DBM-ENSec model. The LightGBM model demonstrates reduced detection accuracy across a diverse array of distributions and elevated volatility, suggesting a lack of stability. The RandomForest model demonstrates a marginally higher median detection accuracy compared to LightGBM, exhibiting a relatively narrower distribution and more consistent performance. The CatBoost model exhibits the narrowest range of accuracy distribution; however, it demonstrates a lower median detection accuracy compared to both DBM-ENSec and XGBoost. While the results of the CatBoost model are stable, it shows a slight underperformance in terms of overall accuracy. To provide a more comprehensive understanding of the model's performance beyond overall accuracy, a detailed confusion matrix is presented in Figure 13. This matrix illustrates the classification results across all traffic categories, including both normal and various types of DCC attacks such as iodine, dnshell, dnslivery, dns2 tcp, and others. Figure 12: Box plots of the accuracy of different models. The results demonstrate that the proposed DBM-ENSec model achieves a consistently high performance across classes, with minimal confusion between normal traffic and DCC instances. Specifically, the number of false positives (normal traffic misclassified as DCC) is close to zero, and false negatives (DCC traffic misclassified as normal) remain very limited across all attack types. Most misclassifications are observed between DCC subclasses with similar encoding behavior (e.g., minor confusion between tcp-over-dns and dns2 tcp), which have inherently similar traffic patterns. Finally, to provide a more granular evaluation, we plotted per-class ROC curves, as shown in Figure 14. The results demonstrate that each class, including OzymanDNS, achieves a high area under the curve (AUC), verifying that the model is not only accurate in aggregate but also discriminative across categories. To demonstrate the deployability and user-friendliness of the proposed model in real-world scenarios, this study encapsulates the trained DBM-ENSec model in an intuitive front-end user interface (UI). As shown in Figures 15 and 16, the UI supports uploading DNS traffic in.pcap and.pcapng formats, enabling automatic feature extraction and real  
Figure 14: ROC curve. Figure 13: Confusion matrix. time covert channel detection.