{
  "abstract": "DNS over HTTPS (DoH) improves the confidentiality of domain-name resolution but reduces the visibility available to enterprise monitoring and security systems because DNS is carried within encrypted HTTPS traffic. This study compares Logistic Regression, Random Forest, and XGBoost for distinguishing DoH from non-DoH HTTPS traffic while examining predictive performance, computational cost, and model interpretability. The models were evaluated using the cleaned Layer 1 representation of the CIRA-CIC-DoHBrw-2020 dataset, which contains 1,019,117 flow records and 29 statistical predictors. The controlled protocol used three repeated 80:20 stratified development-test splits (seeds 42, 52, and 62), three-fold cross-validation, class-imbalance treatment, held-out testing, execution-time measurement, and permutation importance. Random Forest produced the strongest threshold-dependent results, achieving a macro F1 of 0.9965, MCC of 0.9930, and false-positive rate of 0.0011. XGBoost obtained the highest Average Precision (0.9994) and required a mean training time of 31.40 seconds, approximately 95.8% lower than Random Forest (743.42 seconds). Logistic Regression was computationally efficient but yielded lower DoH precision and a false-positive rate of 0.1197. PacketLengthMode was the most influential feature for both tree-based models. The results demonstrate strong within-benchmark separation, but they do not establish cross-network or operational generalisation.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": null,
  "author_total": 1,
  "authors": [
    {
      "name": "Ikiomoye Douglas Emmanuel"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/fj41pgxwta4hk.bib",
  "cited_by": 0,
  "doi": "10.63158/journalisi.v8i5.1914",
  "fulltext_url": "https://journal-isi.org/index.php/isi/article/view/1914",
  "id": "fj41pgxwta4hk",
  "issns": [
    "2656-5935",
    "2656-4882"
  ],
  "landing_url": "https://doi.org/10.63158/journalisi.v8i5.1914",
  "language": "en",
  "licence": "CC-BY",
  "licence_label": "CC BY",
  "licence_source": "journal",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "lcc",
      "QA1-939"
    ],
    [
      "lcc",
      "QA75.5-76.95"
    ],
    [
      "openalex",
      "1702|Internet Traffic Analysis and Secure E-voting"
    ]
  ],
  "openalex": "W7223285475",
  "pdf_url": "https://journal-isi.org/index.php/isi/article/download/1914/1073",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-24",
  "publisher": "Asosiasi Doktor Sistem Informasi Indonesia",
  "ris": "https://research.draconitic.com/paper/fj41pgxwta4hk.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T13:44:46Z",
      "native_id": "a7a26cd089d0465f945bc95133f82696",
      "source": "doaj",
      "url": "https://doi.org/10.63158/journalisi.v8i5.1914"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "lcc:QA1-939",
      "subfield": "general"
    }
  ],
  "title": "Comparative Classification of DNS-over-HTTPS Traffic on the CIRACIC-DoHBrw-2020 Dataset Using Logistic Regression, Random Forest and XGBoost",
  "title_text": "Comparative Classification of DNS-over-HTTPS Traffic on the CIRACIC-DoHBrw-2020 Dataset Using Logistic Regression, Random Forest and XGBoost",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T13:44:46Z",
  "url": "https://research.draconitic.com/paper/fj41pgxwta4hk",
  "venue": "Journal of Information Systems and Informatics",
  "versions": []
}