Abstract:The domain name system (DNS) has evolved into an essential component of network communications, as well as a critical component of critical industrial systems (CIS) and Supervisory Control and Data Acquisition (SCADA) network connection. DNS over HTTPS (DoH) encapsulating DNS within hypertext transfer protocol secure (HTTPS) does not eliminate network access exploitation. This paper proposes a hybrid deep learning model for the early classification of encoded network traffic into one of the two classes: DoH and NonDoH. They can be malicious, benign, or zero-day attacks. The proposed scheme incorporates the swiftness of the convolutional neural network (CNN) in extracting useful information and the ease of long short-term memory (LSTM) in learning long-term dependencies. The simulation results showed that the proposed approach accurately classifies the encoded network traffic as DoH or NonDoH and characterizes the traffic as benign, zero-day, or malicious. The proposed robust hybrid deep learning model had high accuracy and precision of 99.28%, recall of 99.75%, and AUC of 0.9975 at a minimal training and testing time of 745s and 0.000324 s, respectively. In addition to outperforming other compared contemporary algorithms and existing techniques, the proposed technique significantly detects all attack types. This study also investigated the impact of the SMOTE technique as a tool for data balancing. To further validate the reliability of the proposed scheme, an industrial control system SCADA (ICS-SCADA) dataset, in addition to two (2) other cyber-security datasets (NSL-KDD and CICDS2017), were evaluated. Mathews correlation coefficient (MCC) was employed to validate the model performance, confirming the applicability of the proposed model in a critical industrial system such as SCADA.

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

CNN-based DGA Detection with High Coverage

AGCN-Domain: Detecting Malicious Domains with Graph Convolutional Network and Attention Mechanism

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

D3N: DGA Detection with Deep-Learning Through NXDomain

Domain-Embeddings Based DGA Detection with Incremental Training Method

Malicious DNS detection by combining improved transformer and CNN

HINCDG: Multi-Meta-Path Graph Auto-Encoders for Mining of Weak Association Malicious Domains

A Practical Machine Learning-Based Framework to Detect DNS Covert Communication in Enterprises

HANDOM : Heterogeneous Attention Network Model for Malicious Domain Detection

MDD-FedGNN: A vertical federated graph learning framework for malicious domain detection

DNS Tunneling: A Deep Learning based Lexicographical Detection Approach

A Malicious Domain Detection Model Based on Improved Deep Learning

Multi-domain collaborative two-level DDoS detection via hybrid deep learning

DNSRadar: Outsourcing Malicious Domain Detection Based on Distributed Cache-Footprints

Classification and characterization of encoded traffic in SCADA network using hybrid deep learning scheme

Fast3DS: A real-time full-convolutional malicious domain name detection system