Comparative Classification of DNS-over-HTTPS Traffic on the CIRACIC-DoHBrw-2020 Dataset Using Logistic Regression, Random Forest and XGBoost
Abstract
DNS over HTTPS (DoH) improves the confidentiality of domain-name resolution but reduces the visibility available to enterprise monitoring and security systems because DNS is carried within encrypted HTTPS traffic. This study compares Logistic Regression, Random Forest, and XGBoost for distinguishing DoH from non-DoH HTTPS traffic while examining predictive performance, computational cost, and model interpretability. The models were evaluated using the cleaned Layer 1 representation of the CIRA-CIC-DoHBrw-2020 dataset, which contains 1,019,117 flow records and 29 statistical predictors. The controlled protocol used three repeated 80:20 stratified development-test splits (seeds 42, 52, and 62), three-fold cross-validation, class-imbalance treatment, held-out testing, execution-time measurement, and permutation importance. Random Forest produced the strongest threshold-dependent results, achieving a macro F1 of 0.9965, MCC of 0.9930, and false-positive rate of 0.0011. XGBoost obtained the highest Average Precision (0.9994) and required a mean training time of 31.40 seconds, approximately 95.8% lower than Random Forest (743.42 seconds). Logistic Regression was computationally efficient but yielded lower DoH precision and a false-positive rate of 0.1197. PacketLengthMode was the most influential feature for both tree-based models. The results demonstrate strong within-benchmark separation, but they do not establish cross-network or operational generalisation.
Related
- Zero-Complement Extrapolation: Parameter Recovery and Classification in Severely Imbalanced Logistic Regression under Rank-Deficient Regimes
- Data generation for the logistic regression model under controlled conditions
- A penalized logistic generalized regression estimator
- Large Stepsizes Federated Learning on Logistic Regression with Linearly Separable Data: The Case of Heterogeneous Devices
- Tight Transition Time Bounds for Separable Logistic Regression at the Edge of Stability
BibTeX
@article{emmanuel2026comparative,
title = {{Comparative Classification of DNS-over-HTTPS Traffic on the CIRACIC-DoHBrw-2020 Dataset Using Logistic Regression, Random Forest and XGBoost}},
author = {Ikiomoye Douglas Emmanuel},
journal = {Journal of Information Systems and Informatics},
year = {2026},
month = oct,
doi = {10.63158/journalisi.v8i5.1914},
url = {https://doi.org/10.63158/journalisi.v8i5.1914},
note = {CC BY},
}
RIS
TY - JOUR
TI - Comparative Classification of DNS-over-HTTPS Traffic on the CIRACIC-DoHBrw-2020 Dataset Using Logistic Regression, Random Forest and XGBoost
AU - Ikiomoye Douglas Emmanuel
PY - 2026
DA - 2026/10/24
JO - Journal of Information Systems and Informatics
DO - 10.63158/journalisi.v8i5.1914
UR - https://doi.org/10.63158/journalisi.v8i5.1914
AB - DNS over HTTPS (DoH) improves the confidentiality of domain-name resolution but reduces the visibility available to enterprise monitoring and security systems because DNS is carried within encrypted HTTPS traffic. This study compares Logistic Regression, Random Forest, and XGBoost for distinguishing DoH from non-DoH HTTPS traffic while examining predictive performance, computational cost, and model interpretability. The models were evaluated using the cleaned Layer 1 representation of the CIRA-CIC-DoHBrw-2020 dataset, which contains 1,019,117 flow records and 29 statistical predictors. The controlled protocol used three repeated 80:20 stratified development-test splits (seeds 42, 52, and 62), three-fold cross-validation, class-imbalance treatment, held-out testing, execution-time measurement, and permutation importance. Random Forest produced the strongest threshold-dependent results, achieving a macro F1 of 0.9965, MCC of 0.9930, and false-positive rate of 0.0011. XGBoost obtained the highest Average Precision (0.9994) and required a mean training time of 31.40 seconds, approximately 95.8% lower than Random Forest (743.42 seconds). Logistic Regression was computationally efficient but yielded lower DoH precision and a false-positive rate of 0.1197. PacketLengthMode was the most influential feature for both tree-based models. The results demonstrate strong within-benchmark separation, but they do not establish cross-network or operational generalisation.
SN - 2656-5935
SN - 2656-4882
ER -