@article{van2022addressing,
  title={Addressing the challenges of modern DNS a comprehensive tutorial},
  author={Van Der Toorn, Olivier and M{\"u}ller, Moritz and Dickinson, Sara and Hesselman, Cristian and Sperotto, Anna and van Rijswijk-Deij, Roland},
  journal={Computer Science Review},
  volume={45},
  pages={100469},
  year={2022},
  publisher={Elsevier}
}

@incollection{schwenk2022dns,
  title={Dns security},
  author={Schwenk, J{\"o}rg},
  booktitle={Guide to Internet Cryptography: Security Protocols and Real-World Attack Implications},
  pages={353--375},
  year={2022},
  publisher={Springer}
}

@article{zhan2022detecting,
  title={Detecting DNS over HTTPS based data exfiltration},
  author={Zhan, Mengqi and Li, Yang and Yu, Guangxi and Li, Bo and Wang, Weiping},
  journal={Computer Networks},
  volume={209},
  pages={108919},
  year={2022},
  publisher={Elsevier}
}

@article{lyu2022survey,
  title={A survey on DNS encryption: Current development, malware misuse, and inference techniques},
  author={Lyu, Minzhao and Gharakheili, Hassan Habibi and Sivaraman, Vijay},
  journal={ACM Computing Surveys},
  volume={55},
  number={8},
  pages={1--28},
  year={2022},
  publisher={ACM New York, NY}
}

@article{kosek2022measuring,
  title={Measuring DNS over TCP in the Era of increasing DNS Response Sizes: A View from the Edge},
  author={Kosek, Mike and Doan, Trinh Viet and Huber, Simon and Bajpai, Vaibhav},
  journal={ACM SIGCOMM Computer Communication Review},
  volume={52},
  number={2},
  pages={44--55},
  year={2022},
  publisher={ACM New York, NY, USA}
}

@inproceedings{houser2022comprehensive,
  title={A comprehensive, longitudinal study of government DNS deployment at global scale},
  author={Houser, Rebekah and Hao, Shuai and Cotton, Chase and Wang, Haining},
  booktitle={2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)},
  pages={193--204},
  year={2022},
  organization={IEEE}
}

@inproceedings{chhabra2021measuring,
  title={Measuring DNS-over-HTTPS Performance around the World},
  author={Chhabra, Rishabh and Murley, Paul and Kumar, Deepak and Bailey, Michael and Wang, Gang},
  booktitle={Proceedings of the 21st ACM Internet Measurement Conference},
  pages={351--365},
  year={2021}
}

@article{jerabek2024comparative,
  title={Comparative analysis of DNS over HTTPS detectors},
  author={Jerabek, Kamil and Hynek, Karel and Rysavy, Ondrej},
  journal={Computer Networks},
  volume={247},
  pages={110452},
  year={2024},
  publisher={Elsevier}
}

@article{lin2022novel,
  title={A novel multimodal deep learning framework for encrypted traffic classification},
  author={Lin, Peng and Ye, Kejiang and Hu, Yishen and Lin, Yanying and Xu, Cheng-Zhong},
  journal={IEEE/ACM Transactions on Networking},
  volume={31},
  number={3},
  pages={1369--1384},
  year={2022},
  publisher={IEEE}
}

@article{lee2024measuring,
  title={Measuring DNS-over-HTTPS Downgrades: Prevalence, Techniques, and Bypass Strategies},
  author={Lee, Jinseo and Mohaisen, David and Kang, Min Suk},
  journal={Proceedings of the ACM on Networking},
  volume={2},
  number={CoNEXT4},
  pages={1--22},
  year={2024},
  publisher={ACM New York, NY, USA}
}

@inproceedings{williams2024seeds,
  title={Seeds of Scanning: Exploring the Effects of Datasets, Methods, and Metrics on IPv6 Internet Scanning},
  author={Williams, Grant and Pearce, Paul},
  booktitle={Proceedings of the 2024 ACM on Internet Measurement Conference},
  pages={295--313},
  year={2024}
}

@inproceedings{kumar2023health,
  title={Health Care DNS Tunnelling Detection Method via Spiking Neural Network},
  author={Kumar, Narendra and Surendiran, R and Samuel, GK Jabash and Bhavana, N and Shirgire, Anil and Malar, A Jasmine Gnana and Qalid, Aznul},
  booktitle={International Conference on Emergent Converging Technologies and Biomedical Systems},
  pages={715--725},
  year={2023},
  organization={Springer}
}

@article{zuo2025metc,
  title={METC: A Hybrid Deep Learning Framework for Cross-Network Encrypted DNS over HTTPS Traffic Detection and Tunnel Identification},
  author={Zuo, Ming and Guo, Changyong and Xu, Haiyan and Zhang, Zhaoxin and Cheng, Yanan},
  journal={Information Fusion},
  pages={103125},
  year={2025},
  publisher={Elsevier}
}

@article{aggarwal2024ensemble,
  title={An ensemble framework for detection of DNS-Over-HTTPS (DOH) traffic},
  author={Aggarwal, Akarsh and Kumar, Manoj},
  journal={Multimedia Tools and Applications},
  volume={83},
  number={11},
  pages={32945--32972},
  year={2024},
  publisher={Springer}
}

@article{fesl2023novel,
  title={A novel deep-learning based approach to DNS over HTTPS network traffic detection},
  author={Fesl, Jan and Konopa, Michal and Jel{\'\i}nek, Ji{\v{r}}{\'\i}},
  journal={International Journal of Electrical and Computer Engineering},
  volume={13},
  number={6},
  pages={6691--6700},
  year={2023}
}

@inproceedings{anjum2022removing,
  title={Removing the reliance on perimeters for security using network views},
  author={Anjum, Iffat and Kostecki, Daniel and Leba, Ethan and Sokal, Jessica and Bharambe, Rajit and Enck, William and Nita-Rotaru, Cristina and Reaves, Bradley},
  booktitle={Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies},
  pages={151--162},
  year={2022}
}

@article{adiwal2023dns,
  title={Dns intrusion detection (did)—a snort-based solution to detect dns amplification and dns tunneling attacks},
  author={Adiwal, Sanjay and Rajendran, Balaji and Sudarsan, Sithu D and others},
  journal={Franklin Open},
  volume={2},
  pages={100010},
  year={2023},
  publisher={Elsevier}
}

@inproceedings{sommese2022investigating,
  title={Investigating the impact of DDoS attacks on DNS infrastructure},
  author={Sommese, Raffaele and Claffy, KC and van Rijswijk-Deij, Roland and Chattopadhyay, Arnab and Dainotti, Alberto and Sperotto, Anna and Jonker, Mattijs},
  booktitle={proceedings of the 22nd ACM Internet Measurement Conference},
  pages={51--64},
  year={2022}
}

@article{niakanlahiji2023toward,
  title={Toward practical defense against traffic analysis attacks on encrypted DNS traffic},
  author={Niakanlahiji, Amirreza and Orlowski, Soeren and Vahid, Alireza and Jafarian, J Haadi},
  journal={Computers \& Security},
  volume={124},
  pages={103001},
  year={2023},
  publisher={Elsevier}
}

@article{nadler2022vulnerability,
  title={On the vulnerability of anti-malware solutions to DNS attacks},
  author={Nadler, Asaf and Bitton, Ron and Brodt, Oleg and Shabtai, Asaf},
  journal={Computers \& Security},
  volume={116},
  pages={102687},
  year={2022},
  publisher={Elsevier}
}

@incollection{bannat2023insights,
  title={Insights into doh: Traffic classification for dns over https in an encrypted network},
  author={Bannat Wala, Fatema and Campbell, Scott and Kiran, Mariam},
  booktitle={Proceedings of the 2023 on Systems and Network Telemetry and Analytics},
  pages={9--17},
  year={2023}
}

@inproceedings{akiwate2022retroactive,
  title={Retroactive identification of targeted DNS infrastructure hijacking},
  author={Akiwate, Gautam and Sommese, Raffaele and Jonker, Mattijs and Durumeric, Zakir and Claffy, KC and Voelker, Geoffrey M and Savage, Stefan},
  booktitle={Proceedings of the 22nd ACM Internet Measurement Conference},
  pages={14--32},
  year={2022}
}

@article{li2024dns,
  title={DNS root server resolution anomaly detection},
  author={Li, Chao and Chen, Jian and Zhang, Zhaoxin and Li, Zhiping and Cheng, Yanan and Ma, Chendi},
  journal={Computers \& Security},
  volume={144},
  pages={103946},
  year={2024},
  publisher={Elsevier}
}

@article{akgun2022new,
  title={A new DDoS attacks intrusion detection model based on deep learning for cybersecurity},
  author={Akgun, Devrim and Hizal, Selman and Cavusoglu, Unal},
  journal={Computers \& Security},
  volume={118},
  pages={102748},
  year={2022},
  publisher={Elsevier}
}

@article{quezada2023real,
  title={Real-time bot infection detection system using DNS fingerprinting and machine-learning},
  author={Quezada, Vicente and Astudillo-Salinas, Fabian and Tello-Oquendo, Luis and Bernal, Paul},
  journal={Computer Networks},
  volume={228},
  pages={109725},
  year={2023},
  publisher={Elsevier}
}

@article{tu2023dns,
  title={DNS tunnelling detection by fusing encoding feature and behavioral feature},
  author={Tu, Yu and Liu, Shuang and Sun, Qian},
  journal={Computers \& Security},
  volume={132},
  pages={103357},
  year={2023},
  publisher={Elsevier}
}

@article{mittal2023deep,
  title={Deep learning approaches for detecting DDoS attacks: A systematic review},
  author={Mittal, Meenakshi and Kumar, Krishan and Behal, Sunny},
  journal={Soft computing},
  volume={27},
  number={18},
  pages={13039--13075},
  year={2023},
  publisher={Springer}
}

@article{moure2023real,
  title={Real time detection of malicious DoH traffic using statistical analysis},
  author={Moure-Garrido, Marta and Campo, Celeste and Garcia-Rubio, Carlos},
  journal={Computer Networks},
  volume={234},
  pages={109910},
  year={2023},
  publisher={Elsevier}
}

@inproceedings{moure2022detecting,
  title={Detecting malicious use of doh tunnels using statistical traffic analysis},
  author={Moure-Garrido, Marta and Campo, Celeste and Garcia-Rubio, Carlos},
  booktitle={Proceedings of the 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, \& Ubiquitous Networks},
  pages={25--32},
  year={2022}
}

@inproceedings{tapsoba2024analysis,
  title={Analysis of plaintext features in doh traffic for dga domains detection},
  author={Tapsoba, Abdou Romaric and Ou{\'e}draogo, Tounwendyam Fr{\'e}d{\'e}ric and Zongo, Wend-Benedo Simeon},
  booktitle={International Conference on Information Technology \& Systems},
  pages={127--138},
  year={2024},
  organization={Springer}
}

@article{singh2023identifying,
  title={Identifying bot infection using neural networks on DNS traffic},
  author={Singh, Manmeet and Singh, Maninder and Kaur, Sanmeet},
  journal={Journal of Computer Virology and Hacking Techniques},
  volume={19},
  number={4},
  pages={549--563},
  year={2023},
  publisher={Springer}
}

@article{monroy2023detection,
  title={Detection of malicious DNS-over-HTTPS traffic: An anomaly detection approach using autoencoders},
  author={Monroy, Sergio Salinas and Gupta, Aman Kumar and Wahlstedt, Garrett},
  journal={arXiv preprint arXiv:2310.11325},
  year={2023}
}
@article{zhang2023detecting,
  title={Detecting and measuring security risks of hosting-based dangling domains},
  author={Zhang, Mingming and Li, Xiang and Liu, Baojun and Lu, Jianyu and Zhang, Yiming and Chen, Jianjun and Duan, Haixin and Hao, Shuang and Zheng, Xiaofeng},
  journal={Proceedings of the ACM on Measurement and Analysis of Computing Systems},
  volume={7},
  number={1},
  pages={1--28},
  year={2023},
  publisher={ACM New York, NY, USA}
}

@inproceedings{mirsadeghi2024poster,
  title={Poster: In-switch Defense against DNS Amplification DDoS Attacks},
  author={Mirsadeghi, Seyed Mohammad Hadi},
  booktitle={Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security},
  pages={4964--4966},
  year={2024}
}