{"id":"W7115000244","doi":"10.2139/ssrn.5914736","title":"Beyond IP Memorization: Robust DoH Tunneling Detection using DNSAGuard and Flow-Based Sequence Modeling","year":2025,"lang":"","type":"preprint","venue":"SSRN Electronic Journal","topic":"Internet Traffic Analysis and Secure E-voting","field":"Computer Science","cited_by":0,"is_retracted":false,"has_abstract":false,"ca_institutions":"Université du Québec à Trois-Rivières","funders":"","keywords":"Intrusion detection system; Encryption; Leverage (statistics); Interpretability; Anomaly detection; Network packet; Identifier; Robustness (evolution); Cloud computing","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow","sts","scholarly_communication","research_integrity"],"consensus_categories":[],"category_scores_codex":[0.006940278,0.001119783,0.001245336,0.001138261,0.002098642,0.002037124,0.001907873,0.0007969486,0.00002744578],"category_scores_gemma":[0.000226952,0.001182998,0.0008202627,0.001303999,0.0001455981,0.001005358,0.0008475478,0.009539004,0.000006544622],"about_ca_system_candidate":true,"about_ca_system_consensus":true,"about_ca_system_score_codex":0.004313492,"about_ca_system_score_gemma":0.01119031,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0002334898,"about_ca_topic_score_gemma":0.001690782,"domain_scores_codex":[0.9894197,0.0007252641,0.002188211,0.001995978,0.00128013,0.004390731],"domain_scores_gemma":[0.9961495,0.0001739088,0.001371333,0.0006420863,0.001330046,0.0003330641],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"simulation_or_modeling","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.00005819657,0.00005845913,0.00002229611,0.0001149044,0.0004817887,0.00001960005,0.0009155226,0.913407,0.0001986886,0.02928707,6.612551e-7,0.05543578],"study_design_scores_gemma":[0.0008343098,0.0002133652,0.000001593264,0.001187226,0.0007076666,0.0007618215,0.001194739,0.9852027,0.0001872742,0.008690425,0.00001137584,0.001007492],"study_design_candidate":"simulation_or_modeling","study_design_consensus":"simulation_or_modeling","genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.1134697,0.005809398,0.87723,0.0003411862,0.002578591,0.0003675761,0.000007104233,0.0001130769,0.00008341678],"genre_scores_gemma":[0.9708838,0.003270327,0.02379505,0.0001880198,0.001533359,0.00001012609,0.00001668949,0.00006058471,0.0002420458],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.8574141,"threshold_uncertainty_score":0.9995088,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02717211004895698,"score_gpt":0.2571865687500995,"score_spread":0.2300144587011426,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}