Past years have witnessed DNS-over-HTTPS (DoH) emerging as a prevailing approach to enhance the privacy of DNS data. However, on the other hand, DoH’s robust privacy naturally renders it susceptible to being exploited by attackers as a tunnel for initiating and deploying malicious activities. The encryption of DoH traffic hinders fine-grained analysis of the flow, significantly increasing the cost of data collection and annotation, ultimately leading to the issue of low-quality training data in real-world applications. To tackle this issue, this paper introduces CASE (Contrastive Autoencoder for data Synthesis and Elimination), which fully harnesses the potential of limited low-quality data to enhances the performance of a subsequent gradient boosting tree classifier. CASE employs a contrastive autoencoder to map original data into a low-dimensional space and automatically learn a distance function to quantify dissimilarity among samples. Then existing samples can be grouped into clusters based on distances. Hence, noisy-label samples manifest as isolated instances compared to their associated labels, prone to being identified and eliminated. And more samples can be synthesized based on the interpolation within corresponding clusters to address few-shot and class-imbalance issues, thereby ameliorating data quality for subsequent classifier training. Finally, extensive comparative experiments conducted on two public datasets demonstrate the prevailing performance of our proposed approach compared to state-of-arts methods.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Towards Reliable Detection of Malicious DNS-over-HTTPS (DoH) Tunneling Traffic Under Low-Quality Training Data

  • Gang Yang,
  • Bo Wu,
  • Jun He,
  • Lin Ni,
  • Tao Xia

摘要

Past years have witnessed DNS-over-HTTPS (DoH) emerging as a prevailing approach to enhance the privacy of DNS data. However, on the other hand, DoH’s robust privacy naturally renders it susceptible to being exploited by attackers as a tunnel for initiating and deploying malicious activities. The encryption of DoH traffic hinders fine-grained analysis of the flow, significantly increasing the cost of data collection and annotation, ultimately leading to the issue of low-quality training data in real-world applications. To tackle this issue, this paper introduces CASE (Contrastive Autoencoder for data Synthesis and Elimination), which fully harnesses the potential of limited low-quality data to enhances the performance of a subsequent gradient boosting tree classifier. CASE employs a contrastive autoencoder to map original data into a low-dimensional space and automatically learn a distance function to quantify dissimilarity among samples. Then existing samples can be grouped into clusters based on distances. Hence, noisy-label samples manifest as isolated instances compared to their associated labels, prone to being identified and eliminated. And more samples can be synthesized based on the interpolation within corresponding clusters to address few-shot and class-imbalance issues, thereby ameliorating data quality for subsequent classifier training. Finally, extensive comparative experiments conducted on two public datasets demonstrate the prevailing performance of our proposed approach compared to state-of-arts methods.