{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T16:38:01Z","timestamp":1791995881405,"version":"4.4.0"},"reference-count":117,"publisher":"Association for Computing Machinery (ACM)","issue":"8","license":[{"start":{"date-parts":[[2022,12,23]],"date-time":"2022-12-23T00:00:00Z","timestamp":1671753600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,8,31]]},"abstract":"<jats:p>The domain name system (DNS) that maps alphabetic names to numeric Internet Protocol (IP) addresses plays a foundational role in Internet communications. By default, DNS queries and responses are exchanged in unencrypted plaintext, and hence, can be read and\/or hijacked by third parties. To protect user privacy, the networking community has proposed standard encryption technologies such as DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ) for DNS communications, enabling clients to perform secure and private domain name lookups. We survey the DNS encryption literature published from 2016 to 2021, focusing on its current landscape and how it is misused by malware, and highlighting the existing techniques developed to make inferences from encrypted DNS traffic. First, we provide an overview of various standards developed in the space of DNS encryption and their adoption status, performance, benefits, and security issues. Second, we highlight ways that various malware families can exploit DNS encryption to their advantage for botnet communications and\/or data exfiltration. Third, we discuss existing inference methods for profiling normal patterns and\/or detecting malicious encrypted DNS traffic. Several directions are presented to motivate future research in enhancing the performance and security of DNS encryption.<\/jats:p>","DOI":"10.1145\/3547331","type":"journal-article","created":{"date-parts":[[2022,7,13]],"date-time":"2022-07-13T06:10:36Z","timestamp":1657692636000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":79,"title":["A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8677-248X","authenticated-orcid":false,"given":"Minzhao","family":"Lyu","sequence":"first","affiliation":[{"name":"University of New South Wales, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9333-7635","authenticated-orcid":false,"given":"Hassan Habibi","family":"Gharakheili","sequence":"additional","affiliation":[{"name":"University of New South Wales, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7985-6765","authenticated-orcid":false,"given":"Vijay","family":"Sivaraman","sequence":"additional","affiliation":[{"name":"University of New South Wales, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,23]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"2018. DNSExfiltrator. https:\/\/github.com\/Arno0x\/DNSExfiltrator. Accessed: 2021-11-01."},{"key":"e_1_3_2_3_2","unstructured":"2018. HTTPS-Only Features in Major Browsers. https:\/\/www.digicert.com\/blog\/https-only-features-in-browsers. Accessed: 2021-10-12."},{"key":"e_1_3_2_4_2","unstructured":"2019. DNSTT. https:\/\/github.com\/Mygod\/dnstt. Accessed: 2021-10-12."},{"key":"e_1_3_2_5_2","unstructured":"2019. Research into Data Exfiltration using DOH. https:\/\/sysopfb.github.io\/exfiltration \/c2\/2019\/09\/22\/DOH-exfiltration.html. Accessed: 2021-10-12."},{"key":"e_1_3_2_6_2","unstructured":"2021. DNSCrypt & DoH Servers. https:\/\/dnscrypt.info\/public-servers\/. Accessed: 2021-10-19."},{"key":"e_1_3_2_7_2","unstructured":"2021. How DNS-over-HTTPS (DoH) Has Changed the Threat Landscape for Companies. https:\/\/quointelligence.eu\/2021\/02\/dns-over-https-doh\/. Accessed: 2021-10-12."},{"key":"e_1_3_2_8_2","unstructured":"2021. Public Resolvers. https:\/\/dnsprivacy.org\/public_resolvers\/. Accessed: 2021-10-22."},{"key":"e_1_3_2_9_2","unstructured":"2021. Publicly Available Servers. https:\/\/github.com\/curl\/curl\/wiki\/DNS-over-HTTPS. Accessed: 2021-10-22."},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2019.2940735"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-015-2128-0"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.10.001"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108445"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4033"},{"key":"e_1_3_2_15_2","unstructured":"Vasily Bagirov. 2020. AdGuard DNS-over-QUIC. https:\/\/adguard.com\/en\/blog\/dns-over-quic.html. Accessed: 2021-10-22."},{"key":"e_1_3_2_16_2","volume-title":"Proc. WISM","author":"Bai Xiaolong","year":"2011","unstructured":"Xiaolong Bai, Liang Hu, Zixing Song, Feiyan Chen Chen, and Kuo Zhao. 2011. Defense against DNS man-in-the-middle spoofing. In Proc. WISM. Taiyuan, China."},{"key":"e_1_3_2_17_2","volume-title":"Proc. ACM CCS","author":"Ballani Hitesh","year":"2008","unstructured":"Hitesh Ballani and Paul Francis. 2008. Mitigating DNS DoS attacks. In Proc. ACM CCS. Alexandria, VA."},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.12691\/jcsa-8-2-2"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3113294"},{"key":"e_1_3_2_20_2","volume-title":"Proc. NDSS","author":"Bilge Leyla","year":"2011","unstructured":"Leyla Bilge, Engin Kirda, Christopher Kruegel, and Marco Balduzzi. 2011. EXPOSURE: Finding malicious domains using passive DNS analysis. In Proc. NDSS. San Diego, CA."},{"key":"e_1_3_2_21_2","unstructured":"Paul Bischoff. 2021. Internet Censorship 2021: A Global Map of Internet Restrictions. https:\/\/www.comparitech.com\/blog\/vpn-privacy\/internet-censorship-map\/. Accessed: 2021-10-22."},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3427563"},{"key":"e_1_3_2_23_2","volume-title":"Proc. ACM IMC","author":"B\u00f6ttger Timm","year":"2019","unstructured":"Timm B\u00f6ttger, Felix Cuadrado, Gianni Antichi, Eder Le\u00e3o Fernandes, Gareth Tyson, Ignacio Castro, and Steve Uhlig. 2019. An empirical study of the cost of DNS-over-HTTPS. In Proc. ACM IMC. Amsterdam, Netherlands."},{"key":"e_1_3_2_24_2","volume-title":"Proc. IEEE ISI","author":"Bucuti Theogene Hakiza","year":"2015","unstructured":"Theogene Hakiza Bucuti and Ram Dantu. 2015. An opportunistic encryption extension for the DNS protocol. In Proc. IEEE ISI. Baltimore, MD."},{"key":"e_1_3_2_25_2","volume-title":"Proc. ICICT","author":"Bumanglag Kimo","year":"2020","unstructured":"Kimo Bumanglag and Houssain Kettani. 2020. On the impact of DNS over HTTPS paradigm on cyber systems. In Proc. ICICT. San Jose, CA, USA."},{"key":"e_1_3_2_26_2","volume-title":"Proc. USENIX FOCI","author":"Bushart Jonas","year":"2020","unstructured":"Jonas Bushart and Christian Rossow. 2020. Padding ain\u2019t enough: Assessing the privacy guarantees of encrypted DNS. In Proc. USENIX FOCI. Santa Clara, CA."},{"key":"e_1_3_2_27_2","unstructured":"Canadian Institute for Cybersecurity (CIC) project funded by Canadian Internet Registration Authority. 2020. CIRA-CIC-DoHBrw-2020. https:\/\/www.unb.ca\/cic\/datasets\/dohbrw-2020.html. Accessed: 2021-10-19."},{"key":"e_1_3_2_28_2","volume-title":"Proc. ACM SAC","author":"Carlucci Gaetano","year":"2015","unstructured":"Gaetano Carlucci, Luca De Cicco, and Saverio Mascolo. 2015. HTTP over UDP: An experimental investigation of QUIC. In Proc. ACM SAC. Salamanca, Spain."},{"key":"e_1_3_2_29_2","article-title":"Iranian Hacker Group Becomes First Known APT to Weaponize DNS-over-HTTPS (DoH)","author":"ZDNet Catalin Cimpanu at","year":"2020","unstructured":"Catalin Cimpanu at ZDNet. 2020. Iranian Hacker Group Becomes First Known APT to Weaponize DNS-over-HTTPS (DoH). https:\/\/zd.net\/3EBD8OS. Accessed: 2021-11-01.","journal-title":"https:\/\/zd.net\/3EBD8OS"},{"key":"e_1_3_2_30_2","volume-title":"Proc. ACM IMC","author":"Chhabra Rishabh","year":"2021","unstructured":"Rishabh Chhabra, Paul Murley, Deepak Kumar, Michael Bailey, and Gang Wang. 2021. Measuring DNS-over-HTTPS performance around the world. In Proc. ACM IMC. Virtual Event."},{"key":"e_1_3_2_31_2","unstructured":"Catalin Cimpanu. 2019. DNS-over-HTTPS Causes More Problems than It Solves Experts Say. https:\/\/www.zdnet.com\/article\/dns-over-https-causes-more-problems-than-it-solves-experts-say\/. Accessed: 2021-10-11."},{"key":"e_1_3_2_32_2","unstructured":"Cisco. 2021. Alarm Category: Data Exfiltration. https:\/\/cisco.bravais.com\/s\/169ZRg2tWIOXb0uBjfWX. Accessed: 2021-10-12."},{"key":"e_1_3_2_33_2","doi-asserted-by":"crossref","unstructured":"Levente Csikor Himanshu Singh Min Suk Kang and Dinil Mon Divakaran. 2021. Privacy of DNS-over-HTTPS: Requiem for a dream? (Sep.2021).","DOI":"10.1109\/EuroSP51992.2021.00026"},{"key":"e_1_3_2_34_2","unstructured":"Selena Deckelmann. 2020. Firefox Continues Push to Bring DNS over HTTPS by Default for US Users. https:\/\/blog.mozilla.org\/en\/products\/firefox\/firefox-continues-push-to-bring-dns-over-https-by-default-for-us-users\/. Accessed: 2021-10-21."},{"key":"e_1_3_2_35_2","volume-title":"DNSCurve: Link-Level Security for the Domain Name System draft-dempsky-dnscurve-01","author":"Dempsky M.","year":"2010","unstructured":"M. Dempsky. 2010. DNSCurve: Link-Level Security for the Domain Name System draft-dempsky-dnscurve-01. RFC Draft. https:\/\/datatracker.ietf.org\/doc\/html\/draft-dempsky-dnscurve-01."},{"key":"e_1_3_2_36_2","volume-title":"The Transport Layer Security (TLS) Protocol","author":"Dierks T.","year":"2008","unstructured":"T. Dierks and E. Rescorla. 2008. The Transport Layer Security (TLS) Protocol. RFC 5246. https:\/\/datatracker.ietf.org\/doc\/html\/rfc5246."},{"key":"e_1_3_2_37_2","volume-title":"Proc. IEEE EC2ND","author":"Dietrich Christian J.","year":"2011","unstructured":"Christian J. Dietrich, Christian Rossow, Felix C. Freiling, Herbert Bos, Maarten van Steen, and Norbert Pohlmann. 2011. On botnets that use DNS for command and control. In Proc. IEEE EC2ND. Gothenburg, Sweden."},{"key":"e_1_3_2_38_2","volume-title":"Proc. PAM","author":"Doan Trinh Viet","year":"2021","unstructured":"Trinh Viet Doan, Irina Tsareva, and Vaibhav Bajpai. 2021. Measuring DNS over TLS from the edge: Adoption, reliability, and response times. In Proc. PAM. Virtual."},{"key":"e_1_3_2_39_2","unstructured":"Dennis Fisher. 2020. Google Makes DNS Over HTTPS Default In Chrome. https:\/\/duo.sc\/30z9CLm. Accessed: 2021-10-21."},{"key":"e_1_3_2_40_2","unstructured":"Sebasti\u00e1n Garc\u00eda Karel Hynek Dmtrii Vekshin Tom\u00e1\u0161 \u010cejka and Armin Wasicek. 2021. Large Scale Measurement on the Adoption of Encrypted DNS. arxiv:cs.CR\/2107.04436."},{"key":"e_1_3_2_41_2","volume-title":"Proc. CAN","author":"Gharakheili Hassan Habibi","year":"2017","unstructured":"Hassan Habibi Gharakheili and Vijay Sivaraman. 2017. Cloud assisted home networks. In Proc. CAN. Incheon, Republic of Korea."},{"key":"e_1_3_2_42_2","unstructured":"Alessandro Ghedini. 2019. Even Faster Connection Establishment with QUIC 0-RTT Resumption. https:\/\/bit.ly\/3qKgsby. Accessed: 2021-10-22."},{"key":"e_1_3_2_43_2","unstructured":"Google. 2021. Google Public DNS. https:\/\/dns.google\/. Accessed: 2021-12-21."},{"key":"e_1_3_2_44_2","volume-title":"Proc. IFIP\/IEEE IM","author":"Grill Martin","year":"2015","unstructured":"Martin Grill, Ivan Nikolaev, Veronica Valeros, and Martin Rehak. 2015. Detecting DGA malware using NetFlow. In Proc. IFIP\/IEEE IM. Ottawa, Canada."},{"key":"e_1_3_2_45_2","volume-title":"Proc. IEEE ICGS3","author":"Haddon David A. E.","year":"2019","unstructured":"David A. E. Haddon and Haider Alkhateeb. 2019. Investigating data exfiltration in DNS over HTTPS queries. In Proc. IEEE ICGS3. London, UK."},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2020.3005388"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8484"},{"key":"e_1_3_2_48_2","volume-title":"Proc. ANRW","author":"Hounsel Austin","year":"2019","unstructured":"Austin Hounsel, Kevin Borgolte, Paul Schmitt, Jordan Holland, and Nick Feamster. 2019. Analyzing the costs (and benefits) of DNS, DoT, and DoH for the modern web. In Proc. ANRW. Montreal, Quebec, Canada."},{"key":"e_1_3_2_49_2","volume-title":"Proc. ACM WWW","author":"Hounsel Austin","year":"2020","unstructured":"Austin Hounsel, Kevin Borgolte, Paul Schmitt, Jordan Holland, and Nick Feamster. 2020. Comparing the effects of DNS, DoT, and DoH on web performance. In Proc. ACM WWW. Taipei, Taiwan."},{"key":"e_1_3_2_50_2","volume-title":"Proc. PAM","author":"Hounsel Austin","year":"2021","unstructured":"Austin Hounsel, Paul Schmitt, Kevin Borgolte, and Nick Feamster. 2021. Can encrypted DNS be fast? In Proc. PAM. Virtual Event."},{"key":"e_1_3_2_51_2","volume-title":"Proc. ANRW","author":"Hounsel Austin","year":"2021","unstructured":"Austin Hounsel, Paul Schmitt, Kevin Borgolte, and Nick Feamster. 2021. Encryption without centralization: Distributing DNS queries across recursive resolvers. In Proc. ANRW. Virtual Event."},{"key":"e_1_3_2_52_2","volume-title":"Proc. ACM CoNEXT","author":"Houser Rebekah","year":"2019","unstructured":"Rebekah Houser, Zhou Li, Chase Cotton, and Haining Wang. 2019. An investigation on information leakage of DNS over TLS. In Proc. ACM CoNEXT. Orlando, FL."},{"key":"e_1_3_2_53_2","volume-title":"Proc. IEEE\/IFIP DSN","author":"Hu Xin","year":"2016","unstructured":"Xin Hu, Jiyong Jang, Marc Ph. Stoecklin, Ting Wang, Douglas L. Schales, Dhilung Kirat, and Josyula R. Rao. 2016. BAYWATCH: Robust beaconing detection to identify infected hosts in large-scale enterprise networks. In Proc. IEEE\/IFIP DSN. Portland, OR."},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.17487\/RFC7858"},{"key":"e_1_3_2_55_2","volume-title":"Proc. USENIX FOCI","author":"Huang Qing","year":"2020","unstructured":"Qing Huang, Deliang Chang, and Zhou Li. 2020. A comprehensive study of DNS-over-HTTPS downgrade attack. In Proc. USENIX FOCI."},{"key":"e_1_3_2_56_2","volume-title":"Specification of DNS over Dedicated QUIC Connections","author":"Huitema C.","year":"2021","unstructured":"C. Huitema, S. Dickinson, and A. Mankin. 2021. Specification of DNS over Dedicated QUIC Connections. RFC. https:\/\/datatracker.ietf.org\/doc\/html\/draft-ietf-dprive-dnsoquic-04."},{"key":"e_1_3_2_57_2","volume-title":"Proc. IEEE IEMCON","author":"Hynek Karel","year":"2020","unstructured":"Karel Hynek and Tomas Cejka. 2020. Privacy illusion: Beware of unpadded DoH. In Proc. IEEE IEMCON. Vancouver, Canada."},{"key":"e_1_3_2_58_2","volume-title":"Proc. PESW","author":"Hynek Karel","year":"2020","unstructured":"Karel Hynek, Tomas Cejka, and Dmitrii Vekshin. 2020. DoH detection: Discovering hidden DNS. In Proc. PESW. Czech Republic."},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.17487\/RFC9000"},{"key":"e_1_3_2_60_2","volume-title":"Proc. NDSS MADWeb","author":"Jahromi Ali Sadeghi","year":"2021","unstructured":"Ali Sadeghi Jahromi and AbdelRahman Abdou. 2021. Comparative analysis of DoT and HTTPS certificate ecosystems. In Proc. NDSS MADWeb."},{"key":"e_1_3_2_61_2","volume-title":"Proc. 30th USENIX Security","author":"Jeitner Philipp","year":"2021","unstructured":"Philipp Jeitner and Haya Shulman. 2021. Injection attacks reloaded: Tunnelling malicious payloads over DNS. In Proc. 30th USENIX Security. Virtual Event."},{"key":"e_1_3_2_62_2","volume-title":"Proc. IEEE-IFIP DSN-S","author":"Jeitner Philipp","year":"2020","unstructured":"Philipp Jeitner, Haya Shulman, and Michael Waidner. 2020. Secure consensus generation with distributed DoH. In Proc. IEEE-IFIP DSN-S. Valencia, Spain."},{"key":"e_1_3_2_63_2","volume-title":"Proc. IEEE\/IFIP DSN","author":"Jeitner Philipp","year":"2020","unstructured":"Philipp Jeitner, Haya Shulman, and Michael Waidner. 2020. The impact of DNS insecurity on time. In Proc. IEEE\/IFIP DSN. Valencia, Spain."},{"key":"e_1_3_2_64_2","volume-title":"Proc. ACM WWW","author":"Jin Lin","year":"2021","unstructured":"Lin Jin, Shuai Hao, Haining Wang, and Chase Cotton. 2021. Understanding the impact of encrypted DNS on Internet censorship. In Proc. ACM WWW. Ljubljana, Slovenia."},{"key":"e_1_3_2_65_2","article-title":"Best Practices for Network Border Protection","author":"Kartch R.","year":"2017","unstructured":"R. Kartch. 2017. Best Practices for Network Border Protection. Carnegie Mellon University\u2019s Software Engineering Institute Blog. http:\/\/insights.sei.cmu.edu\/blog\/best-practices-for-network-border-protection\/.","journal-title":"Carnegie Mellon University\u2019s Software Engineering Institute Blog"},{"key":"e_1_3_2_66_2","volume-title":"Oblivious DNS over HTTPS","author":"Kinnear E.","year":"2021","unstructured":"E. Kinnear, P. McManus, T. Pauly, T. Verma, and C. A. Wood. 2021. Oblivious DNS over HTTPS. RFC. https:\/\/datatracker.ietf.org\/doc\/html\/draft-pauly-dprive-oblivious-doh-07."},{"key":"e_1_3_2_67_2","unstructured":"Ludmila Kudryavtseva. 2018. DNSCrypt Has Quit But You Needn\u2019t Worry (UPDATED). https:\/\/adguard.com\/pt_pt\/blog\/bye_dnscrypt.html. Accessed: 2021-10-12."},{"key":"e_1_3_2_68_2","volume-title":"Proc. ACM FOCI","author":"Kwan Carmen","year":"2021","unstructured":"Carmen Kwan, Paul Janiszewski, Shela Qiu, Cathy Wang, and Cecylia Bocovich. 2021. Exploring simple detection techniques for DNS-over-HTTPS tunnels. In Proc. ACM FOCI. Virtual Event."},{"key":"e_1_3_2_69_2","volume-title":"IEEE Workshop on Secure Network Protocols","author":"Lee J.","year":"2010","unstructured":"J. Lee, J. Kwon, H. Shin, and H. Lee. 2010. Tracking multiple C&C botnets by analyzing DNS traffic. In IEEE Workshop on Secure Network Protocols. Kyoto Japan."},{"key":"e_1_3_2_70_2","volume-title":"Proc. ACM IMC","author":"Lu Chaoyi","year":"2019","unstructured":"Chaoyi Lu, Baojun Liu, Zhou Li, Shuang Hao, Haixin Duan, Mingming Zhang, Chunying Leng, Ying Liu, Zaifeng Zhang, and Jianping Wu. 2019. An end-to-end, large-scale measurement of DNS-over-encryption: How far have we come? In Proc. ACM IMC. Amsterdam, Netherlands."},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3050091"},{"key":"e_1_3_2_72_2","volume-title":"Proc. PAM","author":"Lyu Minzhao","year":"2019","unstructured":"Minzhao Lyu, Hassan Habibi Gharakheili, Craig Russell, and Vijay Sivaraman. 2019. Mapping an enterprise network by analyzing DNS traffic. In Proc. PAM. Puerto Varas, Chile."},{"key":"e_1_3_2_73_2","unstructured":"Alexander J. Martin. 2019. Google\u2019s Chrome Browser Plans \u2018Risk Undermining Fight Against Online Child Abuse\u2019 Govt Warned. https:\/\/bit.ly\/3beOLij. Accessed: 2021-10-11."},{"key":"e_1_3_2_74_2","volume-title":"Padding Policies for Extension Mechanisms for DNS","author":"Mayrhofer A.","year":"2018","unstructured":"A. Mayrhofer. 2018. Padding Policies for Extension Mechanisms for DNS. RFC 8467. https:\/\/datatracker.ietf.org\/doc\/html\/rfc8467."},{"key":"e_1_3_2_75_2","volume-title":"Proc. EAI AFRICOMM","author":"Mbewe Enock S.","year":"2020","unstructured":"Enock S. Mbewe and Josiah Chavula. 2020. On QoE impact of DoH and DoT in Africa: Why a user\u2019s DNS choice matters. In Proc. EAI AFRICOMM. Ebene City, Mauritius."},{"key":"e_1_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1035"},{"key":"e_1_3_2_77_2","volume-title":"Proc. IEEE DASC\/PiCom\/CBDCom\/CyberSciTech","author":"MontazeriShatoori Mohammadreza","year":"2020","unstructured":"Mohammadreza MontazeriShatoori, Logan Davidson, Gurdip Kaur, and Arash Habibi Lashkari. 2020. Detection of DoH tunnels using time-series classification of encrypted traffic. In Proc. IEEE DASC\/PiCom\/CBDCom\/CyberSciTech. Online Event."},{"key":"e_1_3_2_78_2","doi-asserted-by":"crossref","unstructured":"Michael M\u00fchlhauser Henning Prid\u00f6hl and Dominik Herrmann. 2021. Code and Datasets for the ARES 2021-Paper: How Private is Android\u2019s Private DNS Setting? Identifying Apps by Encrypted DNS Traffic. https:\/\/github.com\/UBA-PSI\/segram. Accessed: 2021-11-03.","DOI":"10.1145\/3465481.3465764"},{"key":"e_1_3_2_79_2","volume-title":"Proc. ARES","author":"M\u00fchlhauser Michael","year":"2021","unstructured":"Michael M\u00fchlhauser, Henning Prid\u00f6hl, and Dominik Herrmann. 2021. How private is Android\u2019s private DNS setting? Identifying apps by encrypted DNS traffic. In Proc. ARES. Vienna, Austria."},{"key":"e_1_3_2_80_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.09.006"},{"key":"e_1_3_2_81_2","volume-title":"Proc. ACSAC","author":"Nakatsuka Yoshimichi","year":"2019","unstructured":"Yoshimichi Nakatsuka, Andrew Paverd, and Gene Tsudik. 2019. PDoT: Private DNS-over-TLS with TEE support. In Proc. ACSAC. San Juan, Puerto Rico."},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.1145\/3431171"},{"key":"e_1_3_2_83_2","volume-title":"Proc. IEEE ICCSIT","author":"Nayak Gopi Nath","year":"2010","unstructured":"Gopi Nath Nayak and Shefalika Ghosh Samaddar. 2010. Different flavours of man-in-the-middle attack, consequences and feasible solutions. In Proc. IEEE ICCSIT. Chengdu, China."},{"key":"e_1_3_2_84_2","unstructured":"Network Security Research Lab at 360. 2019. An Analysis of Godlua Backdoor. https:\/\/bit.ly\/2YSqyf4. Accessed: 2021-10-29."},{"key":"e_1_3_2_85_2","unstructured":"Tomasz Andrzej Nideck. 2019. DoH: Mozilla Cloudflare and Google vs. the World. https:\/\/bit.ly\/3cjsBMl. Accessed: 2021-10-24."},{"key":"e_1_3_2_86_2","volume-title":"Proc. NDSS DNS Privacy Workshop","author":"Nisenoff Alexandra","year":"2021","unstructured":"Alexandra Nisenoff, Nick Feamster, Madeleine A. Hoofnagle, and Sydney Zink. 2021. User expectations and understanding of encrypted DNS settings. In Proc. NDSS DNS Privacy Workshop. Virtual Event."},{"key":"e_1_3_2_87_2","unstructured":"Palo Alto Networks. 2021. Command and Control Explained. https:\/\/www.paloaltonetworks.com\/cyberpedia\/command-and-control-explained. Accessed: 2021-10-22."},{"key":"e_1_3_2_88_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101614"},{"key":"e_1_3_2_89_2","article-title":"Data Monopolists Like Google Are Threatening the Economy","author":"Radinsky Kira","year":"2015","unstructured":"Kira Radinsky. 2015. Data Monopolists Like Google Are Threatening the Economy. Harvard Business Review. https:\/\/bit.ly\/3yT6dEb.","journal-title":"Harvard Business Review"},{"key":"e_1_3_2_90_2","volume-title":"Proc. ARES","author":"Rivera Sean","year":"2020","unstructured":"Sean Rivera, Vijay K. Gurbani, Sofiane Lagraa, Antonio Ken Iannillo, and Radu State. 2020. Leveraging EBPF to preserve user privacy for DNS, DoT, and DoH queries. In Proc. ARES. Virtual Event, Ireland."},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.1145\/3442181"},{"key":"e_1_3_2_92_2","volume-title":"Proc. ANRW","author":"Schmitt Paul","year":"2019","unstructured":"Paul Schmitt, Anne Edmundson, Allison Mankin, and Nick Feamster. 2019. Oblivious DNS: Practical privacy for DNS queries: Published in PoPETS 2019. In Proc. ANRW. Montreal, Quebec, Canada."},{"key":"e_1_3_2_93_2","unstructured":"Michael Sehring. 2020. Securing DNS Traffic: An Introduction to DoT & DoH. https:\/\/bit.ly\/33T5AyX. Accessed: 2021-10-22."},{"key":"e_1_3_2_94_2","volume-title":"Proc. ACSAC","author":"Shin Dongwan","year":"2011","unstructured":"Dongwan Shin and Rodrigo Lopes. 2011. An empirical study of visual security cues to prevent the SSLstripping attack. In Proc. ACSAC. Orlando, FL."},{"key":"e_1_3_2_95_2","volume-title":"Proc. ACM WPES","author":"Shulman Haya","year":"2014","unstructured":"Haya Shulman. 2014. Pretty bad privacy: Pitfalls of DNS encryption. In Proc. ACM WPES. Scottsdale, AZ."},{"key":"e_1_3_2_96_2","volume-title":"Proc. HotPETs","author":"Siby Sandra","year":"2018","unstructured":"Sandra Siby, Marc Juarez, Narseo Vallina-Rodriguez, and Carmela Troncoso. 2018. DNS privacy not so private: The traffic analysis perspective. In Proc. HotPETs. Barcelona, Spain."},{"key":"e_1_3_2_97_2","volume-title":"Proc. NDSS","author":"Siby Sandra Deepthy","year":"2020","unstructured":"Sandra Deepthy Siby, Marc Ju\u00e1rez, Claudia D\u00edaz, Narseo Vallina-Rodriguez, and Carmela Troncoso. 2020. Encrypted DNS \\(\\rightarrow\\) privacy? A traffic analysis perspective. In Proc. NDSS. San Diego CA."},{"key":"e_1_3_2_98_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2018.12.005"},{"key":"e_1_3_2_99_2","volume-title":"Proc. 3ICT","author":"Singh Sunil Kumar","year":"2020","unstructured":"Sunil Kumar Singh and Pradeep Kumar Roy. 2020. Detecting malicious DNS over HTTPS traffic using machine learning. In Proc. 3ICT. Virtual Event."},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1145\/2656877.2656896"},{"key":"e_1_3_2_101_2","unstructured":"The Proofpoint Threat Insight Team. 2019. PsiXBot Now Using Google DNS Over HTTPS and Possible New Sexploitation Module. https:\/\/bit.ly\/3Eri5Pb. Accessed: 2021-10-29."},{"key":"e_1_3_2_102_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2849614"},{"key":"e_1_3_2_103_2","volume-title":"Proc. ACM ICONETSI","author":"Udiyono Agung","year":"2020","unstructured":"Agung Udiyono, Charles Lim, and Lukas. 2020. Botnet detection using DNS and HTTP traffic analysis. In Proc. ACM ICONETSI. Tangerang, Indonesia."},{"key":"e_1_3_2_104_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2017.10.016"},{"key":"e_1_3_2_105_2","volume-title":"Data Science and Security","author":"Aijaz N. Usman","year":"2020","unstructured":"N. Usman Aijaz, Mohammed Misbahuddin, and Syed Raziuddin. 2020. Survey on DNS-specific security issues and solution approaches. In Data Science and Security."},{"key":"e_1_3_2_106_2","unstructured":"Marshall Vale and Alexander Dupuy. 2019. Google Public DNS Over HTTPS (DoH) Supports RFC 8484 Standard. https:\/\/bit.ly\/2YSqyvA. Accessed: 2021-10-21."},{"key":"e_1_3_2_107_2","volume-title":"Proc. COMSNETS","author":"Varshney Gaurav","year":"2021","unstructured":"Gaurav Varshney, Padmavathi Iyer, Pradeep Atrey, and Manoj Misra. 2021. Evading DoH via live memory forensics for phishing detection and content filtering. In Proc. COMSNETS. Virtual Event."},{"key":"e_1_3_2_108_2","doi-asserted-by":"publisher","DOI":"10.5281\/zenodo.3906526"},{"key":"e_1_3_2_109_2","volume-title":"Proc. ARES","author":"Vekshin Dmitrii","year":"2020","unstructured":"Dmitrii Vekshin, Karel Hynek, and Tomas Cejka. 2020. DoH insight: Detecting DNS over HTTPS by machine learning. In Proc. ARES. Virtual Event, Ireland."},{"key":"e_1_3_2_110_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108322"},{"key":"e_1_3_2_111_2","doi-asserted-by":"publisher","DOI":"10.1080\/17441056.2018.1533364"},{"key":"e_1_3_2_112_2","unstructured":"Peter Wu. 2019. DNS Encryption Explained. https:\/\/blog.cloudflare.com\/dns-encryption-explained\/. Accessed: 2021-10-11."},{"key":"e_1_3_2_113_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.10"},{"key":"e_1_3_2_114_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.06.012"},{"key":"e_1_3_2_115_2","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-59749-547-9.00003-X"},{"key":"e_1_3_2_116_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107642"},{"key":"e_1_3_2_117_2","doi-asserted-by":"publisher","DOI":"10.1145\/3191329"},{"key":"e_1_3_2_118_2","volume-title":"Proc. IEEE S&P","author":"Zhu Liang","year":"2015","unstructured":"Liang Zhu, Zi Hu, John Heidemann, Duane Wessels, Allison Mankin, and Nikita Somaiya. 2015. Connection-oriented DNS to improve privacy and security. In Proc. IEEE S&P. San Jose, CA."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3547331","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3547331","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T15:02:56Z","timestamp":1750172576000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3547331"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,23]]},"references-count":117,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2023,8,31]]}},"alternative-id":["10.1145\/3547331"],"URL":"https:\/\/doi.org\/10.1145\/3547331","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,23]]},"assertion":[{"value":"2021-12-23","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-07-04","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}