{"id":"W7115000244","doi":"10.2139/ssrn.5914736","title":"Beyond IP Memorization: Robust DoH Tunneling Detection using DNSAGuard and Flow-Based Sequence Modeling","year":2025,"lang":"","type":"preprint","venue":"SSRN Electronic Journal","topic":"Internet Traffic Analysis and Secure E-voting","field":"Computer Science","cited_by":0,"is_retracted":false,"has_abstract":false,"ca_institutions":"Université du Québec à Trois-Rivières","funders":"","keywords":"Intrusion detection system; Encryption; Leverage (statistics); Interpretability; Anomaly detection; Network packet; Identifier; Robustness (evolution); Cloud computing","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001622078,0.0007468061,0.001149316,0.001211085,0.0005013903,0.001222308,0.001114241,0.001121396,0.0009342893],"category_scores_gemma":[0.006314819,0.0003201542,0.0004481964,0.0007923137,0.000591712,0.00223199,0.001152827,0.001277456,0.0005246091],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0004857615,"about_ca_system_score_gemma":0.001067935,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.002023928,"about_ca_topic_score_gemma":0.001987278,"domain_scores_codex":[0.9990778,0.0002483792,0.00004796361,0.0001965001,0.0002972398,0.0001320758],"domain_scores_gemma":[0.9971743,0.001297862,0.0004088472,0.0005877442,0.0003848445,0.0001464652],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"simulation_or_modeling","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0009962127,0.0005656066,0.0254874,0.0001686426,0.000180266,0.0004336594,0.0002080911,0.4555085,0.06061678,0.03488867,0.002267218,0.4186789],"study_design_scores_gemma":[0.000002972884,0.00002863061,0.0007614593,0.000003589394,0.000006412769,0.00005883524,0.0000104995,0.9910424,0.004105018,0.003769097,0.0002037792,0.00000723466],"study_design_candidate":"simulation_or_modeling","study_design_consensus":"simulation_or_modeling","genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.1488795,0.0002177694,0.8480535,0.0002373471,0.00007120515,0.00005529282,0.0001137242,0.001196392,0.001175325],"genre_scores_gemma":[0.945263,0.0001094551,0.05299457,0.00006517784,0.00005108315,0.00001988255,0.0001511653,0.00006312259,0.001282548],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.002023928,"threshold_uncertainty_score":0.008578479,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02717211004895698,"score_gpt":0.2571865687500995,"score_spread":0.2300144587011426,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}