Analysis and Detection of Malicious Activity on DoH Traffic

Abstract

This paper discusses the systematic approach to analyze and detect DoH and non-DoH traffic, and further methods to catch malicious DoH over covert network traffic conditions. DNS over HTTPS methodology overcomes the vulnerabilities brought about in regular DNS requests and reinforces the data transmission, but equally important is detection and prevention on their malicious counterparts using their statistical characteristics as mentioned in this text. Further, this paper forms a base on the data features and their relative importance in determining DoH transfers, enabling possibilities of training numerous Machine learning and Deep Learning Algorithms.