| 引用本文： |
-
于盟,孙娅苹,吕海峰,丁勇.基于TLS握手特征与可解释AI的DoH加密攻击检测方法[J].信息安全学报,已采用 [点击复制]
- yu meng,SUN Yaping,lv haifeng,ding yong.A Explainable AI-based Method for Detecting DoH Encrypted Attacks Using TLS Handshake Features[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 在当今网络环境日益加密化的背景下，DNS over HTTPS （DoH）协议在保障用户隐私的同时，也为潜在的网络攻击（如利用DNS隧道进行的数据渗漏）提供了隐蔽通道。现有检测方法多依赖流量统计特征或深度学习模型，前者在表征细粒度协议语义方面存在局限，后者则因“黑盒”特性导致决策过程不透明。针对上述问题，本研究提出一种兼具高精度、高可信度与高效率的DoH隧道流量检测方法。该方法首先从加密流量中解析TLS握手阶段的ClientHello与ServerHello报文，系统性地提取密码套件、扩展列表、协议版本等明文字段，并重构为统一的固定维度特征向量，从而在不解密的前提下实现细粒度特征表示。进而，采用以XGBoost为核心的集成学习算法构建分类模型，并引入SHAP可解释性框架量化各特征对分类结果的贡献，揭示模型决策依据。在CIRA-CIC-DoHBrw-2020数据集上的实验表明，所提出方法的检测精度（准确率、召回率等指标均为1.0）优于当前先进方法，且特征提取效率较依赖全流统计的基线方法提升达两个数量级（0.85ms vs 62.12ms, 提升超过70倍）。SHAP分析进一步揭示了客户端密码套件长度、特定协议版本支持等关键判别特征，为理解隧道流量的TLS握手行为模式提供了可解释的安全洞见。本研究为实现高效、可信的加密流量异常检测提供了新的思路。 |
| 关键词: 入侵检测 DNS over HTTPS (DoH) 加密流量 TLS握手协议 可解释人工智能 |
| DOI： |
| 投稿时间：2025-10-21修订日期：2026-02-13 |
| 基金项目: |
|
| A Explainable AI-based Method for Detecting DoH Encrypted Attacks Using TLS Handshake Features |
|
yu meng1, SUN Yaping2, lv haifeng3, ding yong1
|
| (1.School of Cyber Science and Engineering, Nanjing University of Science & Technology;2.Inspection & Assessment Institute, China Industrial Control Systems Cyber Emergency Response Team;3.School of Computer Science and Information Security, Guilin University of Electronic Technology) |
| Abstract: |
| In the context of today"s increasingly encrypted network environment, the DNS over HTTPS (DoH) protocol, while safeguarding user privacy, also provides covert channels for potential cyberattacks, such as data exfiltration using DNS tunnels. Existing detection methods predominantly rely on traffic statistical features or deep learning models. The former has limitations in characterizing fine-grained protocol semantics, while the latter suffers from opaque decision-making processes due to their "black-box" nature. To address these challenges, this study proposes a DoH tunnel traffic detection method that achieves high accuracy, high trustworthiness, and high efficiency. The method begins by parsing ClientHello and ServerHello messages from the TLS handshake phase within encrypted traffic, systematically extracting plaintext fields such as cipher suites, extension lists, and protocol versions, and reconstructing them into a unified, fixed-dimensional feature vector. This enables fine-grained feature representation without decryption. Subsequently, an ensemble learning model with XGBoost at its core is constructed for classification, and the SHAP explainable framework is introduced to quantify the contribution of each feature to the classification outcome, thereby revealing the rationale behind the model"s decisions. Experiments on the CIRA-CIC-DoHBrw-2020 dataset demonstrate that the proposed method achieves detection accuracy (with metrics such as accuracy and recall reaching 1.0) comparable to state-of-the-art approaches, while its feature extraction efficiency is improved by up to two orders of magnitude compared to baseline methods relying on full-flow statistical analysis (0.85ms vs. 62.12ms on average, representing an over 70x speedup). Furthermore, SHAP analysis reveals key discriminative features, such as client cipher suite length and support for specific protocol versions, providing interpretable security insights into the TLS handshake behavioral patterns of tunnel traffic. This study offers a novel approach for achieving efficient and trustworthy encrypted traffic anomaly detection. |
| Key words: Intrusion Detection DNS over HTTPS (DoH) Encrypted Traffic TLS Handshake Protocol Explainable Artificial Intelligence. |
