DoH这个词对于很多安全从业人员并不是个新词，但对其前世今生能洞若观火的却不多。本期前瞻洞察将从DNS的隐私与安全问题出发，讲述DoH为什么诞生，DoH的出现到底利弊几何，对其弊端如何应对。为了便于读者理解，对于“何为隐蔽隧道？”、“DoH如何成为隐蔽隧道的利器？”这些基础性的问题也进行阐述。
一、传统DNS的隐私与安全问题催生安全DNS技术
二、DoH如何工作
三、DoH成为隐蔽隧道攻击的利器
四、DoH流量识别技术
五、DoH隧道攻击检测技术
六、总结——强盾在何方
向上滑动，查看所有参考文献
[1] P. Pearce, B. Jones, F. Li, R. Ensafi, N. Feamster, N. Weaver, V. Paxson, Global measurement of DNS manipulation, in: 26th USENIX Security Symposium, USENIX Security, 2017, pp. 307–323.
[2] DNSSEC, https://www.dnssec.net/.
[3] DNScrypt, https://www.dnscrypt.org/.
[4] DNS over TLS (DoT), RFC7858, https://tools.ietf.org/html/rfc7858.
[5] DNS over HTTPS (DOH), RFC8484, https://tools.ietf.org/html/rfc8484
[6] First-ever malware strain spotted abusing new DoH (DNS over HTTPS) protocol, https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusingnew-doh-dns-over-https-protocol/.
[7] Iranian hacker group becomes first known APT to weaponize DNS-over-HTTPS (DoH), https://www.zdnet.com/article/iranian-hacker-group-becomesfirst-known-apt-to-weaponize-dns-over-https-doh/.
[8] DNS exfiltration over DNS over HTTPS (DoH) with godoh, https://sensepost.com/blog/2018/waiting-for-godoh/
[9] Data exfiltration over DNS request covert channel, https://github.com/Arno0x/DNSExfiltrator.
[10] D. A. E. Haddon and H. Alkhateeb. 2019. Investigating Data Exfiltration in DNS Over HTTPS Queries. In 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3).
[11] Drew Hjelm. 2019. A New Needle and Haystack: Detecting DNS over HTTPS Usage. (2019).
[12] D. Vekshin, K. Hynek, T. Cejka, DoH insight: detecting DNS over HTTPS by machine learning, in: Proceedings of the 15th International Conference on Availability, Reliability and Security, 2020, pp. 1–8.[
13] Constantinos Patsakis, Fran Casino, and Vasilios Katos. 2020. Encrypted and covert DNS queries for botnets: Challenges and countermeasures. Computers & Security 88 (2020), 101614.[
14] Jonas Bushart and Christian Rossow. 2019. Padding Ain’t Enough: Assessing the Privacy Guarantees of Encrypted DNS. arXiv preprint arXiv:1907.01317 (2019).
[15] V. Paxson, M. Christodorescu, M. Javed, J. Rao, R. Sailer, D.L. Schales, M. Stoecklin, K. Thomas, W. Venema, N. Weaver, Practical comprehensive bounds on surreptitious communication over DNS, in: 22nd USENIX Security Symposium, USENIX Security, 2013, pp. 17–32.
[16] J. Liu, S. Li, Y. Zhang, J. Xiao, P. Chang, C. Peng, Detecting DNS tunnel through binary-classification based on behavior features, in: 2017 IEEE Trustcom/BigDataSE/ICESS, IEEE, 2017, pp. 339–346.
[17] M. Luo, Q. Wang, Y. Yao, X. Wang, P. Yang, Z. Jiang, Towards comprehensive detection of DNS tunnels, in: IEEE Symposium on Computers and Communications, ISCC, IEEE, 2020, pp. 1–7.
[18] K. Wu, Y. Zhang, T. Yin, TDAE: Autoencoder-based automatic feature learning method for the detection of DNS tunnel, in: 2020 IEEE International Conference on Communications, ICC, IEEE, 2020, pp. 1–7.
[19] B. Anderson, D. McGrew, TLS beyond the browser: Combining end host and network data to understand application behavior, in: Proceedings of the Internet Measurement Conference, IMC, 2019, pp. 379–392.
[20] B. Anderson, D. McGrew, Machine learning for encrypted malware traffic classification: accounting for noisy labels and non-stationarity, in: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD, 2017, pp. 1723–1732.
[21] B. Anderson, S. Paul, D. McGrew, Deciphering malware’s use of TLS (without decryption), J. Comput. Virol. Hacking Tech. 14 (3) (2018) 195–211.
[22] B. Anderson, D. McGrew, Accurate TLS fingerprinting using destination context and knowledge bases, 2020, arXiv preprint arXiv:2009.01939[23] M. MontazeriShatoori, L. Davidson, G. Kaur, A.H. Lashkari, Detection of DoH tunnels using time-series classification of encrypted traffic, in: The 5th IEEE Cyber Science and Technology Congress, IEEE, 2020, pp. 63–70.
[24] Z. Durumeric, Z. Ma, D. Springall, R. Barnes, N. Sullivan, E. Bursztein, M. Bailey, J.A. Halderman, V. Paxson, The security impact of HTTPS interception, in: Network and Distributed System Security Symposium, NDSS, 2017.
作者简介 >>>
韦云川，毕业于北京理工大学，获博士学位；期间，获国家留学基金委资助公派美国加州大学戴维斯分校，从事抗量子密码技术研究。拥有丰富的网络安全、安全通信数据链、密码技术、高级威胁分析等创新技术的理论研究和产品化实战经验，长期从事军民基础软硬件和信息安全相关工作，掌握核心技术。目前就职于山石网科通信技术股份有限公司新技术研究院，研究方向包括：入侵检测关键技术、DoH隐蔽隧道、深度神经网络、高级威胁关联分析、ATT&CK框架等。在过去学习和工作中，共发表学术论文6篇（2篇SCI），其中1篇被计算机顶级会议IEEE INFOCOM录用。共申请专利19项，其中9项已授权。
商务合作 | 开白转载 | 媒体交流 | 理事服务
请联系：15710013727（微信同号）
《信息安全与通信保密》杂志投稿
联系电话：13391516229（微信同号）
邮箱：xxaqtgxt@163.com
《通信技术》杂志投稿
联系电话：15198220331（微信同号）
邮箱：txjstgyx@163.com