{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,12]],"date-time":"2026-05-12T01:47:17Z","timestamp":1778550437147,"version":"3.51.4"},"publisher-location":"Singapore","reference-count":20,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819698714","type":"print"},{"value":"9789819698721","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-981-96-9872-1_35","type":"book-chapter","created":{"date-parts":[[2025,7,23]],"date-time":"2025-07-23T14:34:29Z","timestamp":1753281269000},"page":"423-434","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Towards Reliable Detection of Malicious DNS-over-HTTPS (DoH) Tunneling Traffic Under Low-Quality Training Data"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7063-9182","authenticated-orcid":false,"given":"Gang","family":"Yang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bo","family":"Wu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jun","family":"He","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lin","family":"Ni","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tao","family":"Xia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,7,24]]},"reference":[{"key":"35_CR1","doi-asserted-by":"crossref","unstructured":"Hoffman, P., McManus, P.: RFC 8484: DNS queries over HTTPS (DoH). RFC Editor, United States (2018)","DOI":"10.17487\/RFC8484"},{"key":"35_CR2","unstructured":"Zhang, Y., Zhang, M., Liu, B., et al.: Cross the zone: toward a covert domain hijacking via shared DNS infrastructure. In: 33rd USENIX Security Symposium, pp. 5751\u20135768 (2024)"},{"key":"35_CR3","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.108919","volume":"209","author":"M Zhan","year":"2022","unstructured":"Zhan, M., Li, Y., Yu, G., et al.: Detecting DNS over HTTPS based data exfiltration. Comput. Netw. 209, 108919 (2022)","journal-title":"Comput. Netw."},{"key":"35_CR4","doi-asserted-by":"crossref","unstructured":"Duan, G., Li, Q., Zhang, Z., et al.: DNSGuard: in-network defense against DNS attacks. IEEE Trans. Dependable Secure Comput. 22(1), 597\u2013613 (2025)","DOI":"10.1109\/TDSC.2024.3409545"},{"key":"35_CR5","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109910","volume":"234","author":"M Moure-Garrido","year":"2023","unstructured":"Moure-Garrido, M., Campo, C., Garcia-Rubio, C.: Real-time detection of malicious DoH traffic using statistical analysis. Comput. Netw. 234, 109910 (2023)","journal-title":"Comput. Netw."},{"issue":"13","key":"35_CR6","doi-asserted-by":"publisher","first-page":"2604","DOI":"10.3390\/electronics13132604","volume":"13","author":"I Mungwarakarama","year":"2024","unstructured":"Mungwarakarama, I., Wang, Y., Hei, X., et al.: FSDC: flow samples and dimensions compression for efficient detection of DNS-over-HTTPS tunnels. Electronics 13(13), 2604 (2024)","journal-title":"Electronics"},{"key":"35_CR7","unstructured":"Chuang, C.Y., Robinson, J., Lin, Y.C., et al.: Debiased contrastive learning. In: Advances in Neural Information Processing Systems, vol. 33, pp. 8765\u20138775 (2020)"},{"key":"35_CR8","doi-asserted-by":"publisher","first-page":"61","DOI":"10.1016\/j.neucom.2020.06.101","volume":"413","author":"L Sun","year":"2020","unstructured":"Sun, L., Ye, P., Lyu, G., et al.: Weakly-supervised multi-label learning with noisy features and incomplete labels. Neurocomputing 413, 61\u201371 (2020)","journal-title":"Neurocomputing"},{"key":"35_CR9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103194","volume":"130","author":"R Kale","year":"2023","unstructured":"Kale, R., Thing, V.L.: Few-shot weakly-supervised cybersecurity anomaly detection. Comput. Secur. 130, 103194 (2023)","journal-title":"Comput. Secur."},{"key":"35_CR10","doi-asserted-by":"publisher","unstructured":"Yang, G., Wu, B., Mou, W., Fan, L., Shen, X., He, J.: DAS-gen: continual signature generation for evolving malicious traffic. In: Huang, DS., Chen, W., Guo, J. (eds.) ICIC 2024. LNCS, vol. 14870, pp. 352\u2013362. Springer, Singapore (2024). https:\/\/doi.org\/10.1007\/978-981-97-5606-3_30","DOI":"10.1007\/978-981-97-5606-3_30"},{"key":"35_CR11","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1613\/jair.953","volume":"16","author":"NV Chawla","year":"2002","unstructured":"Chawla, N.V., Bowyer, K.W., Hall, L.O., et al.: SMOTE: synthetic minority over-sampling technique. J. Artif. Intell. Res. 16, 321\u2013357 (2002)","journal-title":"J. Artif. Intell. Res."},{"key":"35_CR12","unstructured":"Xu, L., Skoularidou, M., Cuesta-Infante, A., et al.: Modeling tabular data using conditional GAN. In: Advances in Neural Information Processing Systems, vol. 32 (2019)"},{"issue":"1","key":"35_CR13","doi-asserted-by":"publisher","first-page":"507","DOI":"10.1007\/s12083-023-01597-4","volume":"17","author":"S Niktabe","year":"2024","unstructured":"Niktabe, S., Lashkari, A.H., Roudsari, A.H.: Unveiling DoH tunnel: toward generating a balanced DoH encrypted traffic dataset and profiling malicious behavior using inherently interpretable machine learning. Peer Peer Netw. Appl. 17(1), 507\u2013531 (2024)","journal-title":"Peer Peer Netw. Appl."},{"issue":"1","key":"35_CR14","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1111\/j.0824-7935.2004.t01-1-00228.x","volume":"20","author":"A Estabrooks","year":"2004","unstructured":"Estabrooks, A., Jo, T., Japkowicz, N.: A multiple resampling method for learning from imbalanced data sets. Comput. Intell. 20(1), 18\u201336 (2004)","journal-title":"Comput. Intell."},{"issue":"8","key":"35_CR15","doi-asserted-by":"publisher","first-page":"425","DOI":"10.3390\/info15080425","volume":"15","author":"A Coscia","year":"2024","unstructured":"Coscia, A., Iannacone, A., Maci, A., et al.: SINNER: a reward-sensitive algorithm for imbalanced malware classification using neural networks with experience replay. Information 15(8), 425 (2024)","journal-title":"Information"},{"key":"35_CR16","unstructured":"Nisenoff, A., Sharma, R., Feamster, N.: User awareness and behaviors concerning encrypted DNS settings in web browsers. In: 32nd USENIX Security Symposium (USENIX Security 23), pp. 3117\u20133133 (2023)"},{"key":"35_CR17","unstructured":"Ke, G., Meng, Q., Finley, T., et al.: LightGBM: a highly efficient gradient boosting decision tree. In: Advances in Neural Information Processing Systems, vol. 30 (2017)"},{"key":"35_CR18","unstructured":"Zhang, H., Cisse, M., Dauphin, Y.N., et al.: Mixup: beyond empirical risk minimization. arXiv preprint arXiv:1710.09412 (2017)"},{"key":"35_CR19","doi-asserted-by":"publisher","first-page":"94624","DOI":"10.1109\/ACCESS.2022.3204690","volume":"10","author":"MHM Yusof","year":"2022","unstructured":"Yusof, M.H.M., Almohammedi, A.A., Shepelev, V., et al.: Visualizing realistic benchmarked IDS dataset: CIRA-CIC-DoHBrw-2020. IEEE Access 10, 94624\u201394642 (2022)","journal-title":"IEEE Access"},{"issue":"2","key":"35_CR20","first-page":"2086","volume":"20","author":"R Mitsuhashi","year":"2022","unstructured":"Mitsuhashi, R., Jin, Y., Iida, K., et al.: Malicious DNS tunnel tool recognition using persistent DoH traffic analysis. IEEE Trans. Netw. Serv. Manag. 20(2), 2086\u20132095 (2022)","journal-title":"IEEE Trans. Netw. Serv. Manag.Manag."}],"container-title":["Lecture Notes in Computer Science","Advanced Intelligent Computing Technology and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-96-9872-1_35","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T06:23:33Z","timestamp":1770186213000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-96-9872-1_35"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9789819698714","9789819698721"],"references-count":20,"URL":"https:\/\/doi.org\/10.1007\/978-981-96-9872-1_35","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"24 July 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"ICIC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Intelligent Computing","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Ningbo","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 July 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 July 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icic2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.ic-icc.cn\/icg\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}