[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-121493-en":3,"doc-seo-121493-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},121493,1374391974585,"Genevieve","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","EVALUATION OF MOVING TARGET DOH SERVER DETECTION USING MACHINE LEARNING MODELS - A THESIS","The rapid adoption of DNS over HTTPS (DoH) has created major challenges in balancing privacy, security, and censorship resistance. This thesis studies NinjaDoH, a censorship-resistant DoH service that uses hyperscalers and the InterPlanetary File System (IPFS) to improve accessibility and resilience. It addresses two core questions: how to build and deploy NinjaDoH as a dynamic moving-target DoH service, and how efficiently existing firewall solutions can detect it. Machine learning models evaluate detection effectiveness through adversarial and baseline experiments.","UNIVERSITY OF OKLAHOMA  \nGRADUATE COLLEGE  \nEVALUATION OF MOVING TARGET DOH SERVER DETECTION USING  \nMACHINE LEARNING MODELS  \nA THESIS  \nSUBMITTED TO THE GRADUATE FACULTY in partial fulfillment of the requirements for the Degree of  \nMASTER OF SCIENCE  \nBy  \nMARC C. BERET  \nNorman, Oklahoma  \n2024  \nEVALUATION OF MOVING TARGET DOH SERVER DETECTION USING  \nMACHINE LEARNING MODELS  \nA THESIS APPROVED FOR THE  \nSCHOOL OF COMPUTER SCIENCE  \nBY THE COMMITTEE CONSISTING OF  \nDr. Anindya Maiti, (Chair)  \nDr. Qi Cheng  \nDr. Song Fang  \n© Copyright by MARC C. BERET 2024 All Rights Reserved.  \nAcknowledgements  \nI would like to thank all the people who have accompanied me, taught me, and helped me grow professionally during this thesis.  \nFirstly, my deepest gratitude goes to my advisor, Dr. Anindya Maiti, Assistant Professor at the University of Oklahoma, for his warm welcome, patience, and invaluable expertise, which have guided me throughout this journey.  \nI am also grateful to my committee members, Dr. Song Fang and Dr. Qi Cheng, for their valuable feedback, insightful suggestions, and support, which have greatly enhanced the quality of this work.  \nI would also like to thank Scott Seidenberger for his significant contributions to my research and his essential role in creating the NinjaDoH tool, which played a crucial part in this work.  \nA sincere thank you to all the members of the SECRET LAB for their generosity in sharing their experiences and insights with me, which greatly enriched my learning.  \nLastly, thank you, the readers, for the time and attention you will devote to this thesis.  \nTable of Contents  \nchapterList Of Tablesvii  \nList Of Figures viii Abstract ix 1 Introduction 1  \n2 Literature Review 3  \n2.1 Domain Name System ........................... 3  \n2.2 DNS over [HTTPS ............................. 4](HTTPS ............................. 4)  \n[2.3 Machine Learning Detection ........................ 4](2.3 Machine Learning Detection ........................ 4)  \n[2.4 Literature Gap ............................... 6](2.4 Literature Gap ............................... 6)  \n3 Methods 7  \n3.1 Adversary Model .............................. 7  \n3.2 NinjaDoH .................................. 8  \n3.2.1 Moving Target Defense ....................... 8  \n3.2.2 Decentralized Updates via IPFS .................. 8  \n3.2.3 Automated Certificate Management ................ 9  \n3.2.4 Obfuscating Query Paths ...................... 9  \n3.2.5 Adaptive Client Design ....................... 9  \n3.2.6 Censorship Resistance and Availability .............. 10  \n3.2.7 System Overview .......................... 10  \n3.3 Datasets and Flow Stitching ........................ 11  \n3.3.1 Training and Testing Dataset ................... 11  \n3.3.2 Flow Stitching ............................ 11  \n3.4 Models Selected ............................... 12  \n3.4.1 LSTM-Based Model ........................ 12  \n3.4.2 Fully Dense Model ......................... 13  \n3.4.3 CNN-Based Model ......................... 13  \n3.4.4 Hybrid LSTM-Dense Model .................... 14  \n3.4.5 XGBoost (Decision Tree Classifier) ................ 14  \n3.5 Model Training ............................... 14  \n3.5.1 Baseline Training .......................... 14  \n3.5.2 Adaptive Adversary Training ................... 15  \n3.6 NinjaDoH Evasion Evaluation Setup ................... 15  \n3.6.1 Evaluation Dataset ......................... 15  \n3.6.2 Evaluation Metrics ......................... 16  \n3.6.3 Evaluation Process ......................... 17  \n4 Results 18  \n4.1 Baseline Model Performance ........................ 18  \n4.2 NinjaDoH Detection Results ........................ 18  \n4.2.1 Baseline Model Detection ..................... 18  \n4.2.2 Adversarial Model Detection .................... 19  \n4.2.3 Comparison ............................. 20  \n5 Discussion 22  \n5.1 Analysis of NinjaDoH’s Effectiveness in Evading ML-Based Detection . 22  \n5.2 Scalability of ML-Based Do","cbCaivpmaCvRl3jX","https://ap.wps.com/l/cbCaivpmaCvRl3jX","pdf",292390,1,36,"English","en",105,"# Acknowledgements\n# Table of Contents\n## List Of Tables\n## List Of Figures\n# Abstract\n# 1 Introduction\n# 2 Literature Review\n## 2.1 Domain Name System\n## 2.2 DNS over HTTPS\n## 2.3 Machine Learning Detection\n## 2.4 Literature Gap\n# 3 Methods\n## 3.1 Adversary Model\n## 3.2 NinjaDoH\n## 3.3 Datasets and Flow Stitching\n## 3.4 Models Selected\n## 3.5 Model Training\n## 3.6 NinjaDoH Evasion Evaluation Setup\n# 4 Results\n## 4.1 Baseline Model Performance\n## 4.2 NinjaDoH Detection Results\n# 5 Discussion\n## 5.1 Analysis of NinjaDoH’s Effectiveness in Evading ML-Based Detection\n## 5.2 Scalability of ML-Based DoH Detection\n## 5.3 Limitations and Future Work\n# 6 Conclusion","[{\"question\":\"What problem does this thesis address regarding DNS over HTTPS?\",\"answer\":\"It targets the difficulty of balancing privacy and security with resistance to censorship in DNS over HTTPS deployments.\"},{\"question\":\"What is NinjaDoH and what mechanisms does it use?\",\"answer\":\"NinjaDoH is a censorship-resistant DoH service that uses hyperscalers and IPFS, with a moving-target approach and components such as decentralized updates and automated certificate management.\"},{\"question\":\"How does the research evaluate detection of NinjaDoH by firewalls?\",\"answer\":\"It compares firewall responses and the success of multiple machine learning models, using baseline and adversarial evaluation setups and related datasets/metrics.\"}]","EVALUATION OF MOVING TARGET DOH SERVER DETECTION USING MACHINE LEARNING MODELS - A THESIS | PDF",1785735913,91,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"evaluation-of-moving-target-doh-server-detection-using-machine-learning-models-a-thesis","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/evaluation-of-moving-target-doh-server-detection-using-machine-learning-models-a-thesis/121493/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does this thesis address regarding DNS over HTTPS?","Question",{"text":75,"@type":76},"It targets the difficulty of balancing privacy and security with resistance to censorship in DNS over HTTPS deployments.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What is NinjaDoH and what mechanisms does it use?",{"text":80,"@type":76},"NinjaDoH is a censorship-resistant DoH service that uses hyperscalers and IPFS, with a moving-target approach and components such as decentralized updates and automated certificate management.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the research evaluate detection of NinjaDoH by firewalls?",{"text":84,"@type":76},"It compares firewall responses and the success of multiple machine learning models, using baseline and adversarial evaluation setups and related datasets/metrics.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]