Csikor, L., Lian, Z., Zhang, H., Lakshmanan, N., & Divakaran, D. M. (2025). DNS-over-QUIC and HTTP/3 in the Era of Transformers: The New Internet Privacy Battle. IEEE Communications Magazine, 1–7. https://doi.org/10.1109/mcom.004.2400680
Abstract:
Moving away from plain-text DNS communications, users can now switch to encrypted DNS protocols for name resolutions. DNS-over-QUIC (DoQ) employs QUIC - the latest transport protocol - for encrypted communications between users and their recursive DNS servers. QUIC is also poised to become the foundation of our daily web browsing by becoming the transport for HTTP/3, the latest version of the HTTP protocol. Traditional TCP-based web browsing is vulnerable to website fingerprinting (WFP) attacks that can identify the websites a user visits. The emergence of QUIC-based DNS and HTTP protocols raises an important question: are regular users better protected from WFP attacks when using these new protocols? To investigate this, we first collect and publicly release the first benchmark dataset of network traffic corresponding to real visits to QUIC-enabled websites while using DoQ for domain resolution. This dataset will help advance the research on WFP attacks and defenses. Second, we implement and evaluate the first WFP attack targeting the combined use of DoQ and HTTP/3 protocols by users by developing two transformer models tailored for WFP attacks. Finally, we conduct comprehensive experiments, which reveal that these models are effective in identifying user-visited websites, emphasizing the need for defensive measures.
License type:
Publisher Copyright
Funding Info:
This research/project is supported by the National Research Foundation, Singapore, and the Cyber Security Agency of Singapore under the National Cybersecurity R&D Programme and the CyberSG R&D Programme Office (Award CRPO-GC2-ASTAR-001). Any opinions, findings, conclusions, or recommendations expressed in these materials are those of the author(s) and do not reflect the views of the National Research Foundation, Singapore, the Cyber Security Agency of Singapore, or the CyberSG R&D Programme Office.