TGM: A fine-grained classification method for DoH tunneling tools based on Transformer-GRU-MLP

DNS-over-HTTPS (DoH) effectively improves domain name system (DNS) security by encapsulating DNS query and response content in HTTPS packets, and also provides an opportunity for DoH-based covert tunneling attacks. Aiming at the problems of poor feature representation ability and low classification accuracy in the classification research of existing DoH tunneling tools, a multi-modal fusion deep learning classification model of DoH tunneling tools based on transformer-gated unit recurrent (GRU)-multilayer perceptron (MLP) (TGM) is proposed to help security personnel accurately locate specific threat types and take corresponding defensive measures. The model combines the spatial sequence feature extraction ability of the transformer encoder and the time sequence feature learning advantage of GRU to capture deep-level features between traffic generated by different DoH tunneling tools, and uses MLP to learn statistical features. Finally, we fuse the output embeddings of the three branches and learn the weights of different branch features through an attention mechanism. The experimental results show that our method achieves classification accuracy of 98.87% and F1-score of 98.02%, which are all better than the existing state-of-the-art methods.