CO-DEFEND: Continuous Decentralized Federated Learning for Secure DoH-Based Threat Detection

The use of DNS over HTTPS (DoH) tunneling by an attacker to hide malicious activity within encrypted DNS traffic poses a serious threat to network security, as it allows malicious actors to bypass traditional monitoring and intrusion detection systems while evading detection by conventional traffic analysis techniques. Machine Learning (ML) techniques can be used to detect DoH tunnels; however, their effectiveness relies on large datasets containing both benign and malicious traffic. Sharing such datasets across entities is challenging due to privacy concerns. In this work, we propose CO-DEFEND (Continuous Decentralized Federated Learning for Secure DoH-Based Threat Detection), a Decentralized Federated Learning (DFL) framework that enables multiple entities to collaboratively train a classification machine learning model while preserving data privacy and enhancing resilience against single points of failure. The proposed DFL framework, which is scalable and privacy-preserving, is based on a federation process that allows multiple entities to train online their local models using incoming DoH flows in real time as they are processed by the entity. In addition, we adapt four classical machine learning algorithms, Support Vector Machines (SVM), Logistic Regression (LR), Decision Trees (DT), and Random Forest (RF), for federated scenarios, comparing their results with more computationally complex alternatives such as neural networks. We compare our proposed method by using the dataset CIRA-CIC-DoHBrw-2020 with existing machine learning approaches to demonstrate its effectiveness in detecting malicious DoH tunnels and the benefits it brings.

@article{cajaraville-aboy2025_2504.01882,
  title={ CO-DEFEND: Continuous Decentralized Federated Learning for Secure DoH-Based Threat Detection },
  author={ Diego Cajaraville-Aboy and Marta Moure-Garrido and Carlos Beis-Penedo and Carlos Garcia-Rubio and Rebeca P. Díaz-Redondo and Celeste Campo and Ana Fernández-Vilas and Manuel Fernández-Veiga },
  journal={arXiv preprint arXiv:2504.01882},
  year={ 2025 }
}