Comparative Classification of DNS-over-HTTPS Traffic on the CIRACIC-DoHBrw-2020 Dataset Using Logistic Regression, Random Forest and XGBoost
DOI:
https://doi.org/10.63158/journalisi.v8i5.1914Keywords:
DNS over HTTPS, Encrypted Traffic Classification, Random Forest, XGBoost, Feature PermutationAbstract
DNS over HTTPS (DoH) improves the confidentiality of domain-name resolution but reduces the visibility available to enterprise monitoring and security systems because DNS is carried within encrypted HTTPS traffic. This study compares Logistic Regression, Random Forest, and XGBoost for distinguishing DoH from non-DoH HTTPS traffic while examining predictive performance, computational cost, and model interpretability. The models were evaluated using the cleaned Layer 1 representation of the CIRA-CIC-DoHBrw-2020 dataset, which contains 1,019,117 flow records and 29 statistical predictors. The controlled protocol used three repeated 80:20 stratified development-test splits (seeds 42, 52, and 62), three-fold cross-validation, class-imbalance treatment, held-out testing, execution-time measurement, and permutation importance. Random Forest produced the strongest threshold-dependent results, achieving a macro F1 of 0.9965, MCC of 0.9930, and false-positive rate of 0.0011. XGBoost obtained the highest Average Precision (0.9994) and required a mean training time of 31.40 seconds, approximately 95.8% lower than Random Forest (743.42 seconds). Logistic Regression was computationally efficient but yielded lower DoH precision and a false-positive rate of 0.1197. PacketLengthMode was the most influential feature for both tree-based models. The results demonstrate strong within-benchmark separation, but they do not establish cross-network or operational generalisation.
Downloads
References
[1] P. Hoffman and P. McManus, ‘DNS Queries over HTTPS (DoH)’, RFC Editor, RFC8484, Oct. 2018. doi: 10.17487/RFC8484.
[2] K. Hynek, D. Vekshin, J. Luxemburk, T. Cejka, and A. Wasicek, ‘Summary of DNS Over HTTPS Abuse’, IEEE Access, vol. 10, pp. 54668–54680, 2022, doi: 10.1109/ACCESS.2022.3175497.
[3] Y. Li et al., ‘Temporal Association-Aware Dual-Sequence Modeling for Robust DoH Tunnel Detection’, in 2026 29th International Conference on Computer Supported Cooperative Work in Design (CSCWD), Fuzhou, China: IEEE, May 2026, pp. 2375–2380. doi: 10.1109/CSCWD68734.2026.11582286.
[4] D. Vekshin, K. Hynek, and T. Cejka, ‘DoH Insight: detecting DNS over HTTPS by machine learning’, in Proceedings of the 15th International Conference on Availability, Reliability and Security, Virtual Event Ireland: ACM, Aug. 2020, pp. 1–8. doi: 10.1145/3407023.3409192.
[5] M. MontazeriShatoori, L. Davidson, G. Kaur, and A. Habibi Lashkari, ‘Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic’, in 2020 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), Calgary, AB, Canada: IEEE, Aug. 2020, pp. 63–70. doi: 10.1109/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026.
[6] A. R. Alzighaibi, ‘Detection of DoH Traffic Tunnels Using Deep Learning for Encrypted Traffic Classification’, Computers, vol. 12, no. 3, p. 47, Feb. 2023, doi: 10.3390/computers12030047.
[7] F. Bannat Wala, S. Campbell, and M. Kiran, ‘Insights into DoH: Traffic Classification for DNS over HTTPS in an Encrypted Network’, in Proceedings of the 2023 on Systems and Network Telemetry and Analytics, Orlando FL USA: ACM, Jul. 2023, pp. 9–17. doi: 10.1145/3589012.3594895.
[8] K. Jerabek, K. Hynek, O. Rysavy, and I. Burgetova, ‘DNS Over HTTPS Detection Using Standard Flow Telemetry’, IEEE Access, vol. 11, pp. 50000–50012, 2023, doi: 10.1109/ACCESS.2023.3275744.
[9] K. Jerabek, K. Hynek, and O. Rysavy, ‘Comparative analysis of DNS over HTTPS detectors’, Comput. Netw., vol. 247, p. 110452, Jun. 2024, doi: 10.1016/j.comnet.2024.110452.
[10] M. Lyu, H. H. Gharakheili, and V. Sivaraman, ‘A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques’, ACM Comput. Surv., vol. 55, no. 8, pp. 1–28, Aug. 2023, doi: 10.1145/3547331.
[11] S. Siby, M. Juarez, C. Diaz, N. Vallina-Rodriguez, and C. Troncoso, ‘Encrypted DNS Privacy? A Traffic Analysis Perspective’, in Proceedings 2020 Network and Distributed System Security Symposium, San Diego, CA: Internet Society, 2020. doi: 10.14722/ndss.2020.24301.
[12] J. Bushart and C. Rossow, ‘Padding Ain’t Enough: Assessing the Privacy Guarantees of Encrypted DNS – Subpage-Agnostic Domain Classification Tor Browser’. Zenodo, Nov. 15, 2022. doi: 10.5281/ZENODO.7319379.
[13] M. Behnke et al., ‘Feature Engineering and Machine Learning Model Comparison for Malicious Activity Detection in the DNS-Over-HTTPS Protocol’, IEEE Access, vol. 9, pp. 129902–129916, 2021, doi: 10.1109/ACCESS.2021.3113294.
[14] M. Moure-Garrido, S. K. Das, C. Campo, and C. Garcia-Rubio, ‘Real-Time Analysis of Encrypted DNS Traffic for Threat Detection’, in ICC 2024 - IEEE International Conference on Communications, Denver, CO, USA: IEEE, Jun. 2024, pp. 3292–3297. doi: 10.1109/ICC51166.2024.10622347.
[15] M. Irénée, Y. Wang, X. Hei, X. Song, J. C. Turiho, and E. M. Nyesheja, ‘XTS: A Hybrid Framework to Detect DNS-Over-HTTPS Tunnels Based on XGBoost and Cooperative Game Theory’, Mathematics, vol. 11, no. 10, p. 2372, May 2023, doi: 10.3390/math11102372.
[16] L. D’hooge, T. Wauters, B. Volckaert, and F. De Turck, ‘Inter-dataset generalization strength of supervised machine learning methods for intrusion detection’, J. Inf. Secur. Appl., vol. 54, p. 102564, Oct. 2020, doi: 10.1016/j.jisa.2020.102564.
[17] R. Xie et al., ‘Rosetta: Enabling Robust TLS Encrypted Traffic Classification in Diverse Network Environments with TCP-Aware Traffic Augmentation’, in Proceedings of the ACM Turing Award Celebration Conference - China 2023, Wuhan China: ACM, Jul. 2023, pp. 131–132. doi: 10.1145/3603165.3607437.
[18] Canadian Institute for Cybersecurity, ‘University of New Brunswick, “CIRA-CIC-DoHBrw-2020’. 2026. Accessed: Aug. 01, 2026. [Online]. Available: https://www.unb.ca/cic/datasets/dohbrw-2020.html
[19] L. Breiman, ‘Random Forests’, Mach. Learn., vol. 45, no. 1, pp. 5–32, Oct. 2001, doi: 10.1023/A:1010933404324.
[20] T. Chen and C. Guestrin, ‘XGBoost: A Scalable Tree Boosting System’, in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco California USA: ACM, Aug. 2016, pp. 785–794. doi: 10.1145/2939672.2939785.
[21] D. Chicco and G. Jurman, ‘The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation’, BMC Genomics, vol. 21, no. 1, p. 6, Dec. 2020, doi: 10.1186/s12864-019-6413-7.
[22] T. Saito and M. Rehmsmeier, ‘The Precision-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets’, PLOS ONE, vol. 10, no. 3, p. e0118432, Mar. 2015, doi: 10.1371/journal.pone.0118432.
[23] F. Pedregosa et al., ‘Scikit-learn: Machine Learning in Python’, 2012, doi: 10.48550/ARXIV.1201.0490.
[24] F. Ceschin et al., ‘Machine Learning (In) Security: A Stream of Problems’, Digit. Threats Res. Pract., vol. 5, no. 1, pp. 1–32, Mar. 2024, doi: 10.1145/3617897.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Information Systems and Informatics
This work is licensed under a Creative Commons Attribution 4.0 International License.
Author's Declaration
- The Authors certify that they have read, understood, and agreed to the Journal of Information Systems and Informatics (JournalISI) submission guidelines, policies, and submission declaration. The submission has been prepared using the provided template.
- The Authors certify that all authors have approved the publication of this manuscript and that there is no conflict of interest.
- The Authors confirm that the manuscript is their original work, has not received prior publication, is not under consideration for publication elsewhere, and has not been previously published.
- The Authors confirm that all authors listed on the title page have contributed significantly to the work, have read the manuscript, attest to the validity and legitimacy of the data and its interpretation, and agree to its submission.
- The Authors confirm that the manuscript is not copied from or plagiarized from any other published work.
- The Authors declare that the manuscript will not be submitted for publication in any other journal or magazine until a decision is made by the journal editors.
- If the manuscript is finally accepted for publication, the Authors confirm that they will either proceed with publication immediately or withdraw the manuscript in accordance with the journal’s withdrawal policies.
- The Authors agree that, upon publication of the manuscript in this journal, they transfer copyright or assign exclusive rights to the publisher, including commercial rights
