An explainable AI-based intrusion detection system for DNS over HTTPS (DoH) attacks

Zebin, Tahmina ORCID logoORCID: https://orcid.org/0000-0003-0437-0570, Rezvy, Shahadate ORCID logoORCID: https://orcid.org/0000-0002-2684-7117 and Luo, Yuan Roger ORCID logoORCID: https://orcid.org/0000-0002-9812-5543 (2022) An explainable AI-based intrusion detection system for DNS over HTTPS (DoH) attacks. IEEE Transactions on Information Forensics and Security, 17 . pp. 2339-2349. ISSN 1556-6013 [Article] (doi:10.1109/TIFS.2022.3183390)

[img]
Preview
PDF - Final accepted version (with author's formatting)
Download (7MB) | Preview

Abstract

Over the past few years, Domain Name Service (DNS) remained a prime target for hackers as it enables them to gain first entry into networks and gain access to data for exfiltration. Although the DNS over HTTPS (DoH) protocol has desirable properties for internet users such as privacy and security, it also causes a problem in that network administrators are prevented from detecting suspicious network traffic generated by malware and malicious tools. To support their efforts in maintaining a secure network, in this paper, we have implemented an explainable AI solution using a novel machine learning framework. We have used the publicly available CIRA-CIC-DoHBrw-2020 dataset for developing an accurate solution to detect and classify the DNS over HTTPS attacks. Our proposed balanced and stacked Random Forest achieved very high precision (99.91%), recall (99.92%) and F1 score (99.91%) for the classification task at hand. Using explainable AI methods, we have additionally highlighted the underlying feature contributions in an attempt to provide transparent and explainable results from the model.

Item Type: Article
Sustainable Development Goals:
Research Areas: A. > School of Science and Technology > Computer and Communications Engineering
Item ID: 35307
Notes on copyright: © 2022 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Useful Links:
Depositing User: Yuan Roger Luo
Date Deposited: 27 Jun 2022 16:30
Last Modified: 02 Sep 2022 08:58
URI: https://eprints.mdx.ac.uk/id/eprint/35307

Actions (login required)

View Item View Item

Statistics

Activity Overview
6 month trend
0Downloads
6 month trend
15Hits

Additional statistics are available via IRStats2.