一种DoH实时流量识别系统  

A DoH Real-time Traffic Identification System

作　　者：孙璇 马行一 康海燕[1] Sun Xuan;Ma Xingyi;Kang Haiyan(School of Computer,Beijing Information Science and Technology University,Beijing 100192)

机构地区：[1]北京信息科技大学计算机学院,北京100192

出　　处：《信息安全研究》2025年第4期358-366,共9页Journal of Information Security Research

基　　金：国家社会科学基金项目(21BTQ079);北京未来区块链与隐私计算高精尖创新中心基金项目(GJJ-22-03)。

摘　　要：DoH(DNS-over-HTTPS)技术已经成为加密DNS的主要手段.与经过长时间捕获得到的DoH流量数据集不同,进行DoH实时流量识别需要多次短时间内捕获流量,导致流量呈碎片化,使得流级和会话级特征不适用.为了解决这一问题,提出了一种DoH实时流量识别系统.系统利用DNS解析服务器IP字典进行初步快速识别,并根据DoH实时流量在数据包长度、数据包间时延及流量激增的相关特性,建立了针对DoH实时流量的特征提取方法,搭配机器学习模型进行流量准确识别.使用多个网络公开数据集,并自主生成DoH实时流量数据集进行验证实验.实验结果显示,流量识别系统所使用的特征提取方法能准确识别DoH实时流量.DoH(Dns-over-https)technology has become the main means of encrypting DNS.Different from DoH traffic data sets that are captured over a long period of time,real-time DoH traffic identification requires multiple traffic capture in a short period of time,resulting in traffic fragmentation and makeing flow level and session level features not applicable.In order to solve this problem,a DoH real-time traffic identification system is proposed.The system utilizes the DNS resolution server IP dictionary for preliminary and rapid identification,and establishes a feature extraction method for DoH real-time traffic based on the relevant characteristics of packet length,inter packet latency,and traffic surge,combined with machine learning models for accurate traffic identification.Multiple network public datasets are used,and a real-time DoH traffic dataset are independently generated for verification experiments.The experimental results show that the feature extraction method used in the traffic identification system,can accurately identify real-time DoH traffic.

关 键 词：DNS DNS-over-HTTPS 加密流量 实时流量 机器学习 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]