https://blog.e-valente.io/tags/bsideslv/Recent content in Bsideslv on Emanuel's BlogHugoen-usMon, 16 Sep 2024 12:00:00 -0300https://blog.e-valente.io/posts/2024-09-16-doh-deception/Mon, 16 Sep 2024 12:00:00 -0300https://blog.e-valente.io/posts/2024-09-16-doh-deception/<p>High accuracy is not the same thing as robustness.[1]</p> <p>That was the question behind my master&rsquo;s research on DNS over HTTPS (DoH) tunnel detection. Several machine-learning classifiers reported excellent performance when evaluated on conventional train/test splits. But an attacker does not need to draw another sample from the same dataset distribution. They can change how a tunnel behaves, observe the detector&rsquo;s output, and search for a traffic pattern that still carries their data while the classifier labels the flow as benign.[1]</p>