Peek Inside the Encrypted World: Autoencoder-Based Detection of DoH Resolvers

Abstract

DNS-over-HTTPS (DoH), as a rising star to improve DNS security and privacy, has developed rapidly in recent years. It mixes with HTTP features, shares ports with other web services and provides API with URI templates. The unique characteristics of DoH, as well as its fast growth, bring both promising prospects and new risks, e.g. botnet communication, name abuse and data exfiltration. It is essential for network operators to learn about adoption and usage of DoH resolvers. Active scanning may be a possible way. However, it is considered to incur significantly additional overhead, which can be inefficient and aggressive. In this paper, we present DOHUNTER, a system for automati-cally discovering DoH resolvers. DOHUNTER: (i) picks DoH flow from miscellaneous HTTPS traffic, (ii)confirms DoH resolvers based on the detected DoH flow, (iii)mines other related DoH resolvers from the known ones. Our real-world experiments demonstrate the effectiveness of DOHUNTER in detecting DoH flow and finding DoH resolvers. Utilizing DOHUNTER, we witness an alarming increase in DoH adoption. Additionally, we also reveal oblivious growing trends of DoH, which may provide advice for both users and network operators.