{"id":"https://openalex.org/W4306824696","doi":"https://doi.org/10.1145/3551663.3558605","title":"Detecting Malicious Use of DoH Tunnels Using Statistical Traffic Analysis","display_name":"Detecting Malicious Use of DoH Tunnels Using Statistical Traffic Analysis","publication_year":2022,"publication_date":"2022-10-19","ids":{"openalex":"https://openalex.org/W4306824696","doi":"https://doi.org/10.1145/3551663.3558605"},"language":"en","primary_location":{"id":"doi:10.1145/3551663.3558605","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3551663.3558605","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks on 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5039026107","display_name":"Marta Moure-Garrido","orcid":"https://orcid.org/0000-0001-6068-6233"},"institutions":[{"id":"https://openalex.org/I50357001","display_name":"Universidad Carlos III de Madrid","ror":"https://ror.org/03ths8210","country_code":"ES","type":"education","lineage":["https://openalex.org/I50357001"]}],"countries":["ES"],"is_corresponding":true,"raw_author_name":"Marta Moure-Garrido","raw_affiliation_strings":["University Carlos III of Madrid, Legan\u00e9s, Spain"],"affiliations":[{"raw_affiliation_string":"University Carlos III of Madrid, Legan\u00e9s, Spain","institution_ids":["https://openalex.org/I50357001"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021832848","display_name":"Celeste Campo","orcid":"https://orcid.org/0000-0003-1788-890X"},"institutions":[{"id":"https://openalex.org/I50357001","display_name":"Universidad Carlos III de Madrid","ror":"https://ror.org/03ths8210","country_code":"ES","type":"education","lineage":["https://openalex.org/I50357001"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Celeste Campo","raw_affiliation_strings":["University Carlos III of Madrid, Legan\u00e9s, Spain"],"affiliations":[{"raw_affiliation_string":"University Carlos III of Madrid, Legan\u00e9s, Spain","institution_ids":["https://openalex.org/I50357001"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089344826","display_name":"Carlos Garc\u00eda-Rubio","orcid":"https://orcid.org/0000-0002-4635-722X"},"institutions":[{"id":"https://openalex.org/I50357001","display_name":"Universidad Carlos III de Madrid","ror":"https://ror.org/03ths8210","country_code":"ES","type":"education","lineage":["https://openalex.org/I50357001"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Carlos Garcia-Rubio","raw_affiliation_strings":["University Carlos III of Madrid, Legan\u00e9s, Spain"],"affiliations":[{"raw_affiliation_string":"University Carlos III of Madrid, Legan\u00e9s, Spain","institution_ids":["https://openalex.org/I50357001"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5039026107"],"corresponding_institution_ids":["https://openalex.org/I50357001"],"apc_list":null,"apc_paid":null,"fwci":0.7957,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.76945728,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"25","last_page":"32"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7961701154708862},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.7164102792739868},{"id":"https://openalex.org/keywords/traffic-analysis","display_name":"Traffic analysis","score":0.5972216129302979},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5940515995025635},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5742937922477722},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5629737377166748},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.5295456647872925},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.39482811093330383},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.09513181447982788}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7961701154708862},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.7164102792739868},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.5972216129302979},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5940515995025635},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5742937922477722},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5629737377166748},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.5295456647872925},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.39482811093330383},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.09513181447982788}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3551663.3558605","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3551663.3558605","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks on 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Decent work and economic growth","id":"https://metadata.un.org/sdg/8","score":0.4399999976158142}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W85558978","https://openalex.org/W1989598342","https://openalex.org/W2401862431","https://openalex.org/W2806616617","https://openalex.org/W2892556724","https://openalex.org/W2937224677","https://openalex.org/W3025921802","https://openalex.org/W3080354144","https://openalex.org/W3080730509","https://openalex.org/W3105087971","https://openalex.org/W3120774524","https://openalex.org/W3161297440","https://openalex.org/W3185198511","https://openalex.org/W3199534252","https://openalex.org/W4206837062","https://openalex.org/W4206898372","https://openalex.org/W4213362721","https://openalex.org/W4214533612","https://openalex.org/W4221077261","https://openalex.org/W4285160154","https://openalex.org/W4285184946"],"related_works":["https://openalex.org/W2362737126","https://openalex.org/W2130966263","https://openalex.org/W1867585695","https://openalex.org/W2369342331","https://openalex.org/W2521024223","https://openalex.org/W2771252882","https://openalex.org/W2069613467","https://openalex.org/W2348544381","https://openalex.org/W1762411088","https://openalex.org/W2383950765"],"abstract_inverted_index":{"DNS":[0,18,42,66,71,80,98,123],"plays":[1],"a":[2,82,97],"fundamental":[3],"role":[4],"in":[5,96,168],"the":[6,41,105,111,119,122,145,161,169],"operation":[7],"of":[8,85,107,118,121],"ubiquitous":[9],"networks.":[10],"All":[11],"devices":[12],"connected":[13],"to":[14,19,26,92,132,184],"these":[15,108,137],"networks":[16],"need":[17],"work,":[20],"both":[21],"for":[22,31],"traditional":[23],"domain":[24],"name":[25],"IP":[27],"address":[28],"translation,":[29],"and":[30,51,70,101,173],"more":[32],"advanced":[33],"services":[34],"such":[35],"as":[36],"resource":[37],"discovery.":[38],"At":[39],"first,":[40],"communication":[43],"protocol":[44],"presented":[45],"certain":[46,189],"security":[47,55],"problems:":[48],"integrity,":[49],"authenticity":[50],"confidentiality.":[52,61],"DNSSEC":[53],"provides":[54],"but":[56,136],"still":[57],"does":[58],"not":[59],"guarantee":[60],"To":[62],"solve":[63],"this":[64,141],"problem,":[65],"over":[67,72],"TLS":[68],"(DoT)":[69],"HTTPS":[73],"(DoH)":[74],"were":[75],"defined.":[76],"In":[77,140],"recent":[78],"years,":[79],"tunneling,":[81],"covert":[83],"form":[84],"encapsulating":[86],"data":[87,113],"transmission,":[88],"has":[89,127],"been":[90],"used":[91,128],"encapsulate":[93],"malicious":[94,151,174],"traffic":[95,152,155,186],"connection.":[99],"DoT":[100],"DoH":[102,134,175],"versions":[103],"complicate":[104],"detection":[106],"tunnels":[109],"because":[110],"encrypted":[112],"prevents":[114],"performing":[115],"an":[116],"analysis":[117],"content":[120],"traffic.":[124,176],"Previous":[125],"work":[126],"machine":[129],"learning":[130],"techniques":[131],"identify":[133,144],"tunnels,":[135],"have":[138],"limitations.":[139],"study,":[142],"we":[143,164],"most":[146],"significant":[147],"features":[148],"that":[149,180],"singularize":[150],"from":[153],"benign":[154,172],"by":[156],"statistical":[157,190],"analysis.":[158],"Based":[159],"on":[160,188],"selected":[162],"features,":[163],"obtain":[165],"satisfactory":[166],"results":[167],"classification":[170],"between":[171],"The":[177],"study":[178],"reveals":[179],"it":[181],"is":[182],"possible":[183],"differentiate":[185],"based":[187],"parameters.":[191]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":3}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}