Enhancing intrusion detection in encrypted DoH traffic through a robust ensemble learning framework

Abstract

The DNS over HTTPS (DoH) protocol enhances user privacy by encrypting DNS queries and responses within HTTPS. However, this encryption enables attackers to tunnel malicious traffic through covert DoH channels and make detection difficult for network security and enterprises. In this study, we propose a stacked ensemble approach that employs four sequential base learners’ — two Long Short-Term Memory (LSTM) and two Gated Recurrent Unit (GRU) neural networks as base classifier networks with varied hyperparameters and XGBoost (eXtreme Gradient Boosting) as the meta-learner. An XGBoost model trained on out-of-fold predictions generated by base learners supported through stratified 5-fold cross validation. We also applied Recursive Feature Elimination (RFE) with XGBoost for cross-validated feature selection and decreased high-dimensional feature spaces from 29 to 13 and 20 features on the CIRA-CIC-DoHBrw-2020 and DoH-Tunnel-Traffic-HKD datasets respectively. The proposed framework was evaluated on the CIRA-CIC-DoHBrw-2020 and DoH-Tunnel-Traffic-HKD datasets achieved 0.9996 recall, 0.9999 F1-score and 1.0000 AUC-PR on CIC-DoH dataset and 0.9998 recall, 0.9999 F1-score, and 1.0000 for both AUC-ROC and AUC-PR on HKD-DoH dataset. The proposed model outperforms all individual base classifiers, evaluated ML models, and existing state-of-the-art approaches. The proposed XGBoost meta-model needs only 1.26 seconds for training and 0.129 seconds for inference on HKD-DoH dataset, thus making the proposed framework both highly accurate and computationally efficient for real-world intrusion detection in encrypted DoH traffic.The preprocessed data and the source code supporting the findings of this study are available at: https://github.com/soreettihussein/Stacked-ensemble-meta-learning-IDS-for-DoH-network-traffic/tree/main .