{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,10]],"date-time":"2026-07-10T16:21:52Z","timestamp":1783700512896,"version":"3.55.0"},"reference-count":79,"publisher":"Tech Science Press","issue":"3","license":[{"start":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T00:00:00Z","timestamp":1726358400000},"content-version":"vor","delay-in-days":258,"URL":"https:\/\/doi.org\/10.32604\/TSP-CROSSMARKPOLICY"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["CMC"],"published-print":{"date-parts":[[2024]]},"DOI":"10.32604\/cmc.2024.050049","type":"journal-article","created":{"date-parts":[[2024,8,28]],"date-time":"2024-08-28T08:48:52Z","timestamp":1724834932000},"page":"4513-4542","update-policy":"https:\/\/doi.org\/10.32604\/tsp-crossmarkpolicy","source":"Crossref","is-referenced-by-count":10,"title":["The Impact of Domain Name Server (DNS) over Hypertext Transfer Protocol Secure (HTTPS) on Cyber Security: Limitations, Challenges, and Detection Techniques"],"prefix":"10.32604","volume":"80","author":[{"given":"Muhammad","family":"Dawood","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shanshan","family":"Tu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chuangbai","family":"Xiao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Muhammad","family":"Haris","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hisham","family":"Alasmary","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Muhammad","family":"Waqas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sadaqat Ur","family":"Rehman","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"17807","published-online":{"date-parts":[[2024]]},"reference":[{"key":"ref1","article-title":"RFC 9147: The datagram transport layer security (DTLS) protocol version 1.3","volume":"1","author":"Rescorla","year":"2022","journal-title":"Internet Eng. Task Force"},{"key":"ref2","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2021.108322","article-title":"A comprehensive survey on DNS tunnel detection","volume":"197","author":"Wang","year":"2021","journal-title":"Comput. Netw."},{"key":"ref3","doi-asserted-by":"crossref","first-page":"54668","DOI":"10.1109\/ACCESS.2022.3175497","article-title":"Summary of DNS over HTTPS abuse","volume":"10","author":"Hynek","year":"2022","journal-title":"IEEE Access"},{"key":"ref4","unstructured":"DNSCrypt, \u201cdnscrypt-proxy,\u201d GitHub. DNSCrypt GitHub Repository. Mar. 25, 2023."},{"key":"ref5","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3547331","article-title":"A survey on DNS encryption: Current development, malware misuse, and inference techniques","volume":"55","author":"Lyu","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref6","series-title":"Workshop Meas., Attacks, Defenses Web (MADWeb) 2021","article-title":"Comparative analysis of DoT and HTTPS certificate ecosystems","author":"Jahromi","year":"Feb. 25, 2021"},{"key":"ref7","unstructured":"F. J. Nijeboer, \u201cDetection of HTTPS encrypted DNS traffic,\u201d Bachelor\u2019s thesis, Dept. of Electrical Engineering, Mathematics and Computer Science, Univ. of Twente, Enschede, Netherlands, 2020."},{"key":"ref8","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1109\/MAHC.2019.2913116","article-title":"Origins of the domain name system","volume":"41","author":"Bonastre","year":"2019","journal-title":"IEEE Ann. Hist. Comput."},{"key":"ref9","series-title":"Proc. 15th Int. Conf. Emerg. Netw. Exp. Technol.","first-page":"138","article-title":"DNS privacy in practice and preparation","author":"Deccio","year":"Dec. 9\u201312, 2019"},{"key":"ref10","series-title":"Proc. Internet Meas. Conf.","first-page":"15","article-title":"An empirical study of the cost of DNS-over-HTTPS","author":"B\u00f6ttger","year":"Oct. 21\u201323, 2019"},{"key":"ref11","unstructured":"IETF, \u201cDNS queries over HTTPS (DoH)-request for comments 8484,\u201d 2018. Accessed: Mar. 26, 2023. [Online]. Available: https:\/\/tools.ietf.org\/html\/rfc8484"},{"key":"ref12","unstructured":"Cloudflare, \u201cConnecting apps in cloudflare one,\u201d Accessed: Mar. 23, 2023. [Online]. Available: https:\/\/developers.cloudflare.com\/cloudflare-one\/connections\/connect-apps"},{"key":"ref13","unstructured":"Facebook, \u201cdoh-proxy,\u201d Accessed: Mar. 25, 2023. [Online]. Available: https:\/\/github.com\/facebookexperimental\/doh-proxy"},{"key":"ref14","doi-asserted-by":"crossref","first-page":"1","DOI":"10.14419\/ijet.v7i3.20.17266","article-title":"DNS tunneling: A review on features","volume":"7","author":"Sammour","year":"2018","journal-title":"Int. J. Eng. Technol."},{"key":"ref15","article-title":"Detecting malicious DNS queries over encrypted tunnels using statistical analysis and bi-directional recurrent neural networks","volume":"7","author":"Al-Fawa\u2019reh","year":"2021","journal-title":"Karbala Int. J. Mod. Sci."},{"key":"ref16","series-title":"Proc. ACM CoNEXT","first-page":"123","article-title":"An investigation on information leakage of DNS over TLS","author":"Houser","year":"2019"},{"key":"ref17","doi-asserted-by":"crossref","first-page":"5215","DOI":"10.1007\/s10462-022-10143-2","article-title":"The role of artificial intelligence and machine learning in wireless networks security: Principle, practice and challenges","volume":"55","author":"Waqas","year":"2022","journal-title":"Artif. Intell. Rev."},{"key":"ref18","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1016\/j.cose.2013.03.012","article-title":"Behavior-based tracking: Exploiting characteristic patterns in DNS traffic","volume":"39","author":"Herrmann","year":"2013","journal-title":"Comput. Secur."},{"key":"ref19","series-title":"19th Eur. Conf. Cyber Warf.","first-page":"205","article-title":"Using machine learning for DNS over HTTPS detection","author":"Konopa","year":"2020"},{"key":"ref20","doi-asserted-by":"crossref","first-page":"592","DOI":"10.1093\/jigpal\/jzs029","article-title":"Performance assessment and analysis of DNS tunneling tools","volume":"21","author":"Aiello","year":"2013","journal-title":"Logic J. IGPL"},{"key":"ref21","series-title":"Comput. Intell. Secur. Inform. Syst., CISIS 2011","first-page":"84","article-title":"A comparative performance evaluation of DNS tunneling tools","author":"Merlo","year":"Jun. 8\u201310, 2011"},{"key":"ref22","series-title":"Netw. Syst. Secur.: 13th Int. Conf., NSS 2019","first-page":"520","article-title":"A DNS tunneling detection method based on deep learning models to prevent data exfiltration","author":"Zhang","year":"Dec. 15\u201318, 2019"},{"key":"ref23","article-title":"Malicious network traffic detection for DNS over HTTPS using machine learning algorithms","volume":"12","author":"Casanova","year":"2023","journal-title":"APSIPA Trans. Signal Inf. Process"},{"key":"ref24","unstructured":"NextDNS, \u201cThe new firewall for the modern Internet,\u201d Accessed: Mar. 20, 2024. [Online]. Available: https:\/\/nextdns.io\/"},{"key":"ref25","unstructured":"P. Wu, \u201cUnderstanding DNS encryption,\u201d Cloudflare Blog. Accessed: Jun. 28, 2023. [Online]. Available: https:\/\/blog.cloudflare.com\/dns-encryption-explained\/"},{"key":"ref26","doi-asserted-by":"crossref","unstructured":"S. Siby, M. Juarez, C. Diaz, N. Vallina-Rodriguez, and C. Troncoso, \u201cEncrypted DNS\u2192 privacy? A traffic analysis perspective,\u201d 2019, arXiv:1906.09682.","DOI":"10.14722\/ndss.2020.24301"},{"key":"ref27","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2020.107642","article-title":"Finding disposable domain names: A linguistics-based stacking approach","volume":"184","author":"Zeng","year":"Jan. 2021","journal-title":"Comput. Netw."},{"key":"ref28","series-title":"Proc. Int. Conf. Passive Active Netw. Meas.","first-page":"537","article-title":"One to rule them all? A first look at DNS over QUIC","author":"Kosek","year":"2022"},{"key":"ref29","series-title":"Proc. Web Conf.","first-page":"562","article-title":"Comparing the effects of domain name system, DNS over transport layer security, and DNS over HTTPS on web performance","author":"Hounsel","year":"2020"},{"key":"ref30","series-title":"TPRC47, 47th Res. Conf. Commun., Inform. Internet Policy","first-page":"1","article-title":"How DNS over HTTPS is reshaping privacy, performance, and policy in the internet ecosystem","author":"Borgolte","year":"2019"},{"key":"ref31","series-title":"40th Int. Symp.Reliab. Distrib. Syst. (SRDS)","first-page":"210","article-title":"A comprehensive measurement-based investigation of DNS hijacking","author":"Houser","year":"Sep. 2021"},{"key":"ref32","series-title":"Proc. 15th Int. Conf. Availability, Reliab. Secur.","first-page":"1","article-title":"Leveraging eBPF to preserve user privacy for DNS, DoT, and DoH queries","author":"Rivera","year":"Aug. 25\u201328, 2020"},{"key":"ref33","series-title":"Proc. Internet Meas. Conf.","first-page":"22","article-title":"An end-to-end, large-scale measurement of DNS-over-encryption: How far have we come?","author":"Lu","year":"Oct. 21\u201323, 2019"},{"key":"ref34","series-title":"Proc. 10th USENIX Workshop Free Open Commun. Internet (FOCI 20)","first-page":"1","article-title":"A comprehensive study of DNS-over-HTTPS downgrade attack","author":"Huang","year":"2020"},{"key":"ref35","series-title":"Proc. NDSS DNS Priv. Workshop","first-page":"1","article-title":"User expectations and understanding of encrypted DNS settings","author":"Nisenoff","year":"2021"},{"key":"ref36","unstructured":"M. Vale and A. Dupuy, \u201cGoogle public DNS over HTTPS (DoH) supports RFC 8484 standard,\u201d google security blog. 2019. Accessed: Jul. 21, 2023. [Online]. Available: https:\/\/security.googleblog.com\/2019\/06\/google-public-dns-over-https-doh.html"},{"key":"ref37","unstructured":"S. Garc\u00eda, K. Hynek, D. Vekshin, T. Cejka, and A. Wasicek, \u201cLarge scale measurement on the adoption of encrypted DNS,\u201d 2021, arXiv:2107.04436."},{"key":"ref38","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1109\/MIC.2020.3005388","article-title":"The DNS in IoT: Opportunities, risks, and challenges","volume":"24","author":"Hesselman","year":"2020","journal-title":"IEEE Internet Comput."},{"key":"ref39","doi-asserted-by":"crossref","first-page":"4317","DOI":"10.1109\/TSC.2023.3319953","article-title":"Network intrusion detection system (NIDS) based on pseudo-Siamese stacked autoencoders in fog computing","volume":"16","author":"Tu","year":"2023","journal-title":"IEEE Trans. Serv.. Comput."},{"key":"ref40","unstructured":"C. L\u00f3pez Romera, \u201cDNS over HTTPS traffic analysis and detection,\u201d M.S. thesis, Dept. Informatics, Universitat Oberta de Catalunya (UOC), Spain, 2020."},{"key":"ref41","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2019.101614","article-title":"Encrypted and covert DNS queries for botnets: Challenges and countermeasures","volume":"88","author":"Patsakis","year":"Jan. 2020, Art. no. 101614","journal-title":"Comput. Secur."},{"key":"ref42","series-title":"2010 Second Int. Conf. Netw. Secur., Wireless Commun. Trust. Comput.","first-page":"262","article-title":"A DNS-based anti-phishing approach","volume":"2","year":"2010"},{"key":"ref43","series-title":"Proc. 2020 11th IEEE Annu. Inform. Technol., Electron. Mobile Commun. Conf. (IEMCON)","first-page":"621","article-title":"Privacy illusion: Beware of unpadded DoH","author":"Hynek","year":"Nov. 4\u20137, 2020"},{"key":"ref44","first-page":"79","author":"Aijaz","year":"2021","journal-title":"Data Science and Security"},{"key":"ref45","first-page":"783","article-title":"A comprehensive study of phishing attacks","volume":"4","author":"Banu","year":"2013","journal-title":"Int. J. Comput. Sci. Inform. Technol."},{"key":"ref46","series-title":"Proc. ACM SIGCOMM, 2023 Conf.","first-page":"1120","article-title":"Poster: Off-path DNSSEC downgrade attacks","author":"Heftrig","year":"Sep. 10, 2023"},{"key":"ref47","series-title":"4th Int. Conf. Recent Develop. Control, Autom., Power Eng. (RDCAPE)","first-page":"379","article-title":"An insight into encrypted DNS protocol: DNS over TLS","author":"Kosh","year":"Oct. 7\u20138, 2021"},{"key":"ref48","series-title":"20th Int. Conf., PAM 2019","first-page":"147","article-title":"A first look at QNAME minimization in the domain name system","author":"de Vries","year":"Mar. 27\u201329, 2019"},{"key":"ref49","series-title":"Proc. ACM Internet Meas. Conf.","first-page":"42","article-title":"Clouding up the internet: How centralized is DNS traffic becoming?","author":"Moura","year":"Oct. 27\u201329, 2020"},{"key":"ref50","series-title":"Proc. 1st Workshop Cybersecur. Soc. Sci.","first-page":"19","article-title":"Understanding the security of free content websites by analyzing their SSL certificates: A comparative study","author":"Alabduljabbar","year":"May 30, 2022"},{"key":"ref51","series-title":"24th Int. Conf. Inform. Secur. (ISC 2021)","first-page":"238\u2013225","article-title":"Identifying malicious DNS tunnel tools from DoH traffic using hierarchical machine learning classification","author":"Mitsuhashi","year":"Nov. 10\u201312, 2021"},{"key":"ref52","series-title":"Proc. 15th Int. Conf. Availability, Reliab. Secur.","first-page":"1","article-title":"DoH insight: Detecting DNS over HTTPS by machine learning","author":"Vekshin","year":"Aug. 25\u201328, 2020"},{"key":"ref53","series-title":"Proc. 2020 Int. Conf. Innov. Intell. Inform., Comput., Technol. (3ICT)","first-page":"1","article-title":"Detecting malicious DNS over HTTPS traffic using machine learning","author":"Singh","year":"Dec. 20\u201321, 2020"},{"key":"ref54","series-title":"Proc. ACM SIGCOMM, 2021 Workshop Free Open Commun. Internet","first-page":"37","article-title":"Exploring simple detection techniques for DNS-over-HTTPS tunnels","author":"Kwan","year":"Aug. 27, 2021"},{"key":"ref55","doi-asserted-by":"crossref","DOI":"10.3390\/computers12030047","article-title":"Detection of DoH traffic tunnels using deep learning for encrypted traffic classification","volume":"12","author":"Alzighaibi","year":"2023","journal-title":"Computers"},{"key":"ref56","series-title":"Int. Conf. Dependable, Autonom. Secure Comput.","first-page":"63","article-title":"Detection of DoH tunnels using time-series classification of encrypted traffic","author":"MontazeriShatoori","year":"Aug. 17\u201322, 2020"},{"key":"ref57","series-title":"ICANN Secur. Stability Advis. Committee (SSAC) Rep. Advis.","article-title":"SAC109\u2014The implications of DNS over HTTPS and DNS over TLS","author":"Kumari","year":"2020"},{"key":"ref58","series-title":"Proc. Passive Active Meas.: 22nd Int. Conf., PAM 2021","first-page":"444","article-title":"Can encrypted DNS be fast?","author":"Hounsel","year":"Mar. 29\u2013Apr. 1, 2021"},{"key":"ref59","series-title":"Int. Conf. Inf. Netw. (ICOIN)","first-page":"450","article-title":"Detection of DoH tunneling using semi-supervised learning method","author":"Nguyen","year":"Jan. 12\u201315, 2022"},{"key":"ref60","series-title":"Proc. 16th Int. Conf. Availability, Reliab. Secur. (ARES)","article-title":"How private is Android\u2019s private DNS setting? Identifying apps by encrypted DNS traffic","author":"M\u00fchlhauser","year":"2021"},{"key":"ref61","series-title":"Proc. 13th Int. Conf. COMmun. Syst. NETw. (COMSNETS)","article-title":"Evading DoH via live memory forensics for phishing detection and content filtering","author":"Varshney","year":"2021"},{"key":"ref62","unstructured":"M. MontazeriShatoori, \u201cAn anomaly detection framework for DNS-over-HTTPS (DoH) tunnel using time-series analysis,\u201d Ph.D. thesis, University of New Brunswick, Canada, 2020."},{"key":"ref63","first-page":"46","article-title":"Detecting malicious DNS over HTTPS traffic in domain name system using machine learning classifiers","volume":"8","author":"Banadaki","year":"2020","journal-title":"J. Comput. Sci. Appl."},{"key":"ref64","series-title":"20th Int. Conf. Trust, Secur. Priv. Comput. Commun. (TrustCom)","first-page":"783","article-title":"Peek inside the encrypted world: Autoencoder-based detection of DoH resolvers","author":"Wu","year":"2021"},{"key":"ref65","series-title":"Proc. 2021 Asia-Pacific Signal Inform. Process. Assoc. Annu. Summit Conf. (APSIPA ASC)","first-page":"1903","article-title":"Generalized classification of DNS over HTTPS traffic with deep learning","author":"Casanova","year":"Dec. 14\u201317, 2021"},{"key":"ref66","article-title":"DoH tunneling detection system for enterprise network using deep learning technique","volume":"12","author":"Nguyen","year":"2022","journal-title":"Appl. Sci."},{"key":"ref67","doi-asserted-by":"crossref","unstructured":"P. Mockapetris, \u201cDomain names-implementation and specification,\u201d RFC 1035, Internet Engineering Task Force, Nov. 1987. Accessed: Jul. 21, 2023. [Online]. Available: https:\/\/datatracker.ietf.org\/doc\/html\/rfc1035","DOI":"10.17487\/rfc1035"},{"key":"ref68","series-title":"7th IEEE Int. Conf. Data Sci. Cyberspace (DSC)","first-page":"191","article-title":"A DNS-based data exfiltration traffic detection method for unknown samples","author":"Guo","year":"2022"},{"key":"ref69","doi-asserted-by":"crossref","unstructured":"K. Xu, P. Butler, S. Saha, and D. Yao, \u201cDNS for massive-scale command and control,\u201d IEEE Trans. Dependable Secur. Comput., vol. 10, no. 3, pp. 143\u2013153, 2013. doi: 10.1109\/TDSC.2013.10.","DOI":"10.1109\/TDSC.2013.10"},{"key":"ref70","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2024.110452","article-title":"Comparative analysis of DNS over HTTPS detectors","volume":"247","author":"Jerabek","year":"2024, Art. no. 110452","journal-title":"Comput. Netw."},{"key":"ref71","series-title":"IEEE Symp. Series Comput. Intell. (SSCI)","first-page":"1","article-title":"Classifying DNS tunneling tools for malicious DoH traffic","author":"Alenezi","year":"2021"},{"key":"ref72","series-title":"Proc. Web Conf.","first-page":"484","article-title":"Understanding the impact of encrypted domain name system on internet censorship","author":"Jin","year":"2021"},{"key":"ref73","doi-asserted-by":"crossref","first-page":"32945","DOI":"10.1007\/s11042-023-16956-9","article-title":"An ensemble framework for detection of DNS-over-HTTPS (DoH) traffic","volume":"83","author":"Aggarwal","year":"2024","journal-title":"Multimed. Tools Appl."},{"key":"ref74","series-title":"Proc. 2022 IEEE Conf. Commun. Netw. Secur. (CNS)","first-page":"273","article-title":"Detecting DNS hijacking by using NetFlow data","author":"Fejrskov","year":"2022"},{"key":"ref75","series-title":"Proc. ACM Internet Meas. Conf. (IMC)","first-page":"65","article-title":"Behind closed doors: A network tale of spoofing, intrusion, and false DNS security","author":"Deccio","year":"Oct. 27\u201329, 2020"},{"key":"ref76","doi-asserted-by":"crossref","first-page":"50000","DOI":"10.1109\/ACCESS.2023.3275744","article-title":"DNS over HTTPS detection using standard flow telemetry","volume":"11","author":"Jerabek","year":"2023","journal-title":"IEEE Access"},{"key":"ref77","series-title":"Proc. Siberian Symp. Data Sci. Eng. (SSDSE)","first-page":"84","article-title":"Detection and prevention of DNS spoofing attacks","author":"Maksutov","year":"Apr. 12\u201313, 2017"},{"key":"ref78","doi-asserted-by":"crossref","unstructured":"Z. Hu, L. Zhu, J. Heidemann, A. Mankin, D. Wessels and P. Hoffman, \u201cSpecification for DNS over Transport Layer Security (TLS),\u201d RFC 7858, RFC Editor. 2016. Accessed: Jun. 28, 2023. [Online]. Available: https:\/\/www.rfc-editor.org\/rfc\/rfc7858.html","DOI":"10.17487\/RFC7858"},{"key":"ref79","first-page":"34","article-title":"A survey of domain name system vulnerabilities and attacks","volume":"1","author":"Kim","year":"2020","journal-title":"J. Surveill. Securit. Safety"}],"container-title":["Computers, Materials & Continua"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.techscience.com\/files\/cmc\/2024\/TSP_CMC-80-3\/TSP_CMC_50049\/TSP_CMC_50049.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,7]],"date-time":"2025-03-07T01:36:32Z","timestamp":1741311392000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.techscience.com\/cmc\/v80n3\/57854"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":79,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2024]]},"published-print":{"date-parts":[[2024]]}},"URL":"https:\/\/doi.org\/10.32604\/cmc.2024.050049","relation":{},"ISSN":["1546-2226"],"issn-type":[{"value":"1546-2226","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]},"assertion":[{"value":"2024-01-26","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-08-07","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-09-12","order":2,"name":"published","label":"Published Online","group":{"name":"publication_history","label":"Publication History"}}]}}