.png){kind=icon}
返回
Feature Engineering and Machine Learning Model Comparison for Malicious Activity Detection in the DNS-Over-HTTPS Protocol
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2021.3113294.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The Domain Name System (DNS) is among the most ubiquitous and important protocols for network communication; however, security concerns regarding DNS have been on the rise and demand for encrypted traffic has followed suit. Using a publicly available dataset, this work compares 10 different machine learning classifiers using stratified 10-fold cross-validation. The classifiers are used to determine the most effective and efficient way of detecting malicious DNS over Hypertext Transfer Protocol Secure (HTTPS) traffic, dubbed DoH traffic. Model performance is evaluated on Non-DoH vs. DoH traffic, then tested on benign vs. malicious DoH traffic. Additionally, this paper seeks to build upon existing research by removing noise and introducing feature selection methods and feature explainability to produce a better model for real-world deployment. After eliminating five overfitting features, our findings indicate that light gradient boosting machine (LGBM) yielded the highest accuracy to training time ratio while approaching 0% error using 20 top features.
Keyword:
Servers
Protocols
Security
IP networks
Feature extraction
Browsers
Privacy
Chi-squared
DNS
DoH
decision tree
LGBM
machine learning
pearson correlation
random forest
sequential forward selection
XGBM
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
.png){kind=icon}
分享收藏Serial changes of prefrontal lobe growth in the patients with benign childhood epilepsy with centrotemporal spikes presenting with cognitive impairments/behavioral problems伴有认知障碍/行为问题的良性儿童癫痫患者中前额叶生长的系列变化
PREAI
分享收藏Permeation and separation of aqueous alcohol solutions through grafted poly(vinyl alcohol) latex membranes通过接枝聚乙烯醇胶乳膜的含水酒精溶液的渗透与分离
PREAI
分享收藏
查看更多内容