{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T08:04:22Z","timestamp":1780473862333,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":26,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,8,23]],"date-time":"2021-08-23T00:00:00Z","timestamp":1629676800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,8,27]]},"DOI":"10.1145\/3473604.3474563","type":"proceedings-article","created":{"date-parts":[[2021,8,18]],"date-time":"2021-08-18T20:52:03Z","timestamp":1629319923000},"page":"37-42","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["Exploring Simple Detection Techniques for DNS-over-HTTPS Tunnels"],"prefix":"10.1145","author":[{"given":"Carmen","family":"Kwan","sequence":"first","affiliation":[{"name":"University of Waterloo, Waterloo, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Paul","family":"Janiszewski","sequence":"additional","affiliation":[{"name":"University of Waterloo, Waterloo, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shela","family":"Qiu","sequence":"additional","affiliation":[{"name":"University of Waterloo, Waterloo, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cathy","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Waterloo, Waterloo, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cecylia","family":"Bocovich","sequence":"additional","affiliation":[{"name":"The Tor Project, Waterloo, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,8,23]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Sadia Afroz and David Fifield. 2015. 'Timeline of Tor Censorship'. http:\/\/www1.icsi.berkeley.edu\/~sadia\/tor_timeline.pdf. Accessed March 2021.  Sadia Afroz and David Fifield. 2015. 'Timeline of Tor Censorship'. http:\/\/www1.icsi.berkeley.edu\/~sadia\/tor_timeline.pdf. Accessed March 2021."},{"key":"e_1_3_2_1_2_1","volume-title":"6th USENIX Workshop on Free and Open Communications on the Internet, FOCI '16","author":"Danyal Akbar Ul-Ann","year":"2016","unstructured":"Qurat- Ul-Ann Danyal Akbar , Marcel Flores , and Aleksandar Kuzmanovic . 2016 . DNS-sly: Avoiding Censorship through Network Complexity . In 6th USENIX Workshop on Free and Open Communications on the Internet, FOCI '16 , Austin, TX, USA , August 8, 2016, Amir Houmansadr and Prateek Mittal (Eds.). USENIX Association. https:\/\/www.usenix.org\/conference\/foci16\/workshop-program\/presentation\/akbar Qurat-Ul-Ann Danyal Akbar, Marcel Flores, and Aleksandar Kuzmanovic. 2016. DNS-sly: Avoiding Censorship through Network Complexity. In 6th USENIX Workshop on Free and Open Communications on the Internet, FOCI '16, Austin, TX, USA, August 8, 2016, Amir Houmansadr and Prateek Mittal (Eds.). USENIX Association. https:\/\/www.usenix.org\/conference\/foci16\/workshop-program\/presentation\/akbar"},{"key":"e_1_3_2_1_3_1","volume-title":"My Experience With the Great Firewall of China. https:\/\/blog.zorinaq.com\/my-experience-with-the-great-firewall-of-china\/ Accessed","author":"Bevand Marc","year":"2021","unstructured":"Marc Bevand . 2016. My Experience With the Great Firewall of China. https:\/\/blog.zorinaq.com\/my-experience-with-the-great-firewall-of-china\/ Accessed May 2021 . Marc Bevand. 2016. My Experience With the Great Firewall of China. https:\/\/blog.zorinaq.com\/my-experience-with-the-great-firewall-of-china\/ Accessed May 2021."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355575"},{"key":"e_1_3_2_1_5_1","unstructured":"Ron Bowes. 2013. dnscat2. https:\/\/github.com\/iagox86\/dnscat2.  Ron Bowes. 2013. dnscat2. https:\/\/github.com\/iagox86\/dnscat2."},{"key":"e_1_3_2_1_6_1","volume-title":"https:\/\/code.kryo.se\/iodine\/. Accessed","author":"Ekman Erik","year":"2021","unstructured":"Erik Ekman and Bjorn Andersson . 2006. 'Iodine'. https:\/\/code.kryo.se\/iodine\/. Accessed March 2021 . Erik Ekman and Bjorn Andersson. 2006. 'Iodine'. https:\/\/code.kryo.se\/iodine\/. Accessed March 2021."},{"key":"e_1_3_2_1_7_1","volume-title":"AIMS 2013, Barcelona, Spain, June 25-28, 2013. Proceedings (Lecture Notes in Computer Science","volume":"135","author":"Ellens Wendy","year":"2013","unstructured":"Wendy Ellens , Piotr Zuraniewski , Anna Sperotto , Harm Schotanus , Michel Mandjes , and Erik Meeuwissen . 2013 . Flow-Based Detection of DNS Tunnels. In Emerging Management Mechanisms for the Future Internet - 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security , AIMS 2013, Barcelona, Spain, June 25-28, 2013. Proceedings (Lecture Notes in Computer Science , Vol. 7943), Guillaume Doyen, Martin Waldburger, Pavel Celeda, Anna Sperotto, and Burkhard Stiller (Eds.). Springer, 124-- 135 . https:\/\/doi.org\/10.1007\/978-3-642-38998-6_16 10.1007\/978-3-642-38998-6_16 Wendy Ellens, Piotr Zuraniewski, Anna Sperotto, Harm Schotanus, Michel Mandjes, and Erik Meeuwissen. 2013. Flow-Based Detection of DNS Tunnels. In Emerging Management Mechanisms for the Future Internet - 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2013, Barcelona, Spain, June 25-28, 2013. Proceedings (Lecture Notes in Computer Science, Vol. 7943), Guillaume Doyen, Martin Waldburger, Pavel Celeda, Anna Sperotto, and Burkhard Stiller (Eds.). Springer, 124--135. https:\/\/doi.org\/10.1007\/978-3-642-38998-6_16"},{"key":"e_1_3_2_1_8_1","first-page":"1","article-title":"Detecting DNS tunneling","volume":"9","author":"Farnham Greg","year":"2013","unstructured":"Greg Farnham and Antonios Atlasis . 2013 . Detecting DNS tunneling . SANS Institute InfoSec Reading Room 9 (2013), 1 -- 32 . Greg Farnham and Antonios Atlasis. 2013. Detecting DNS tunneling. SANS Institute InfoSec Reading Room 9 (2013), 1--32.","journal-title":"SANS Institute InfoSec Reading Room"},{"key":"e_1_3_2_1_10_1","unstructured":"David Fifield. 2020. dnstt. https:\/\/www.bamsoftware.com\/software\/dnstt\/index.html  David Fifield. 2020. dnstt. https:\/\/www.bamsoftware.com\/software\/dnstt\/index.html"},{"key":"e_1_3_2_1_11_1","volume-title":"10th USENIX Workshop on Free and Open Communications on the Internet, FOCI 2020","author":"Fifield David","year":"2020","unstructured":"David Fifield . 2020 . Turbo Tunnel, a good way to design censorship circumvention protocols . In 10th USENIX Workshop on Free and Open Communications on the Internet, FOCI 2020 , August 11, 2020, Roya Ensafi and Hans Klein (Eds.). USENIX Association. https:\/\/www.usenix.org\/conference\/foci20\/presentation\/fifield David Fifield. 2020. Turbo Tunnel, a good way to design censorship circumvention protocols. In 10th USENIX Workshop on Free and Open Communications on the Internet, FOCI 2020, August 11, 2020, Roya Ensafi and Hans Klein (Eds.). USENIX Association. https:\/\/www.usenix.org\/conference\/foci20\/presentation\/fifield"},{"key":"e_1_3_2_1_12_1","volume-title":"J. Alex Halderman, Nikita Borisov, and Eric Wustrow.","author":"Frolov Sergey","year":"2019","unstructured":"Sergey Frolov , Jack Wampler , Sze Chuen Tan , J. Alex Halderman, Nikita Borisov, and Eric Wustrow. 2019 . Conjure : Summoning Proxies from Unused Address Space. In Computer and Communications Security. ACM. https:\/\/jhalderm.com\/pub\/papers\/conjure-ccs19.pdf Sergey Frolov, Jack Wampler, Sze Chuen Tan, J. Alex Halderman, Nikita Borisov, and Eric Wustrow. 2019. Conjure: Summoning Proxies from Unused Address Space. In Computer and Communications Security. ACM. https:\/\/jhalderm.com\/pub\/papers\/conjure-ccs19.pdf"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23511"},{"key":"e_1_3_2_1_14_1","volume-title":"Snowflake Technical Overview. https:\/\/keroserene.net\/snowflake\/technical. [Online","author":"Han Serene","year":"2018","unstructured":"Serene Han . 2011. Snowflake Technical Overview. https:\/\/keroserene.net\/snowflake\/technical. [Online ; accessed 8- June - 2018 ]. Serene Han. 2011. Snowflake Technical Overview. https:\/\/keroserene.net\/snowflake\/technical. [Online; accessed 8-June-2018]."},{"key":"e_1_3_2_1_15_1","volume-title":"https:\/\/support.mozilla.org\/en-US\/kb\/dns-over-https-doh-faqs Accessed","author":"Help Firefox","year":"2021","unstructured":"Firefox Help . 2019. DNS-over- HTTPS (DoH) FA Qs . https:\/\/support.mozilla.org\/en-US\/kb\/dns-over-https-doh-faqs Accessed April 2021 . Firefox Help. 2019. DNS-over-HTTPS (DoH) FAQs. https:\/\/support.mozilla.org\/en-US\/kb\/dns-over-https-doh-faqs Accessed April 2021."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"crossref","unstructured":"Paul Hoffman and Patrick McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484. IETF Tools. https:\/\/tools.ietf.org\/html\/rfc8484  Paul Hoffman and Patrick McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484. IETF Tools. https:\/\/tools.ietf.org\/html\/rfc8484","DOI":"10.17487\/RFC8484"},{"key":"e_1_3_2_1_17_1","volume-title":"The Parrot Is Dead: Observing Unobservable Network Communications. In 2013 IEEE Symposium on Security and Privacy. 65--79","author":"Houmansadr A.","year":"2013","unstructured":"A. Houmansadr , C. Brubaker , and V. Shmatikov . 2013 . The Parrot Is Dead: Observing Unobservable Network Communications. In 2013 IEEE Symposium on Security and Privacy. 65--79 . https:\/\/doi.org\/10.1109\/SP. 2013 .14 10.1109\/SP.2013.14 A. Houmansadr, C. Brubaker, and V. Shmatikov. 2013. The Parrot Is Dead: Observing Unobservable Network Communications. In 2013 IEEE Symposium on Security and Privacy. 65--79. https:\/\/doi.org\/10.1109\/SP.2013.14"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"crossref","unstructured":"Z. Hu L. Zhu J. Heidemann A. Mankin D. Wessels and P. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858. IETF Tools. https:\/\/tools.ietf.org\/html\/rfc7858  Z. Hu L. Zhu J. Heidemann A. Mankin D. Wessels and P. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858. IETF Tools. https:\/\/tools.ietf.org\/html\/rfc7858","DOI":"10.17487\/RFC7858"},{"key":"#cr-split#-e_1_3_2_1_19_1.1","doi-asserted-by":"crossref","unstructured":"Mohammadreza MontazeriShatoori Logan Davidson Gurdip Kaur and Arash Habibi Lashkari. 2020. Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic. In 2020 IEEE Intl Conf on Dependable Autonomic and Secure Computing Intl Conf on Pervasive Intelligence and Computing Intl Conf on Cloud and Big Data Computing Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech). 63--70. https:\/\/doi.org\/10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026 10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026"},{"key":"#cr-split#-e_1_3_2_1_19_1.2","doi-asserted-by":"crossref","unstructured":"Mohammadreza MontazeriShatoori Logan Davidson Gurdip Kaur and Arash Habibi Lashkari. 2020. Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic. In 2020 IEEE Intl Conf on Dependable Autonomic and Secure Computing Intl Conf on Pervasive Intelligence and Computing Intl Conf on Cloud and Big Data Computing Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech). 63--70. https:\/\/doi.org\/10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026"},{"key":"e_1_3_2_1_20_1","unstructured":"Ramakrishna Padmanabhan Alberto Dainotti Nima Fatemi Arturo Filast\u00f2 Maria Xynou and Simone Basso. 2019. Iran's nation-wide Internet blackout: Measurement data and technical observations. https:\/\/ooni.org\/post\/2019-iran-internet-blackout\/  Ramakrishna Padmanabhan Alberto Dainotti Nima Fatemi Arturo Filast\u00f2 Maria Xynou and Simone Basso. 2019. Iran's nation-wide Internet blackout: Measurement data and technical observations. https:\/\/ooni.org\/post\/2019-iran-internet-blackout\/"},{"key":"e_1_3_2_1_21_1","volume-title":"SoK: Towards Grounding Censorship Circumvention in Empiricism. In IEEE Symposium on Security and Privacy, SP 2016","author":"Tschantz Michael Carl","year":"2016","unstructured":"Michael Carl Tschantz , Sadia Afroz , anonymous, and Vern Paxson . 2016 . SoK: Towards Grounding Censorship Circumvention in Empiricism. In IEEE Symposium on Security and Privacy, SP 2016 , San Jose, CA, USA , May 22-26, 2016. IEEE Computer Society, 914--933. https:\/\/doi.org\/10.1109\/SP.2016.59 10.1109\/SP.2016.59 Michael Carl Tschantz, Sadia Afroz, anonymous, and Vern Paxson. 2016. SoK: Towards Grounding Censorship Circumvention in Empiricism. In IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016. IEEE Computer Society, 914--933. https:\/\/doi.org\/10.1109\/SP.2016.59"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3409192"},{"key":"e_1_3_2_1_23_1","unstructured":"Cathy Wang Paul Janiszewski Shela Qiu and Carmen Kwan. 2021. dnstt-uTLS Fork. https:\/\/github.com\/pjanisze\/dnstt-uTLS.  Cathy Wang Paul Janiszewski Shela Qiu and Carmen Kwan. 2021. dnstt-uTLS Fork. https:\/\/github.com\/pjanisze\/dnstt-uTLS."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813715"},{"key":"e_1_3_2_1_25_1","volume-title":"TapDance: End-to-middle Anticensorship Without Flow Blocking. In 23rd USENIX Security Symposium","author":"Wustrow Eric","unstructured":"Eric Wustrow , Colleen M. Swanson , and J. Alex Halderman . 2014 . TapDance: End-to-middle Anticensorship Without Flow Blocking. In 23rd USENIX Security Symposium ( San Diego, CA). 159--174. http:\/\/dl.acm.org\/citation.cfm?id=2671225.2671236 Eric Wustrow, Colleen M. Swanson, and J. Alex Halderman. 2014. TapDance: End-to-middle Anticensorship Without Flow Blocking. In 23rd USENIX Security Symposium (San Diego, CA). 159--174. http:\/\/dl.acm.org\/citation.cfm?id=2671225.2671236"},{"key":"e_1_3_2_1_26_1","unstructured":"Irvan Zhan. 2015. DNSCatProxy. https:\/\/github.com\/izhan\/dnstun_pt.  Irvan Zhan. 2015. DNSCatProxy. https:\/\/github.com\/izhan\/dnstun_pt."}],"event":{"name":"SIGCOMM '21: ACM SIGCOMM 2021 Conference","location":"Virtual Event USA","acronym":"SIGCOMM '21","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication"]},"container-title":["Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3473604.3474563","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3473604.3474563","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:48:14Z","timestamp":1750193294000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3473604.3474563"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,8,23]]},"references-count":26,"alternative-id":["10.1145\/3473604.3474563","10.1145\/3473604"],"URL":"https:\/\/doi.org\/10.1145\/3473604.3474563","relation":{},"subject":[],"published":{"date-parts":[[2021,8,23]]},"assertion":[{"value":"2021-08-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}