Publications
2025
Csikor, Levente; Lian, Ziyue; Zhang, Haoran; Lakshmanan, Nitya; Divakaran, Dinil Mon
DNS-over-QUIC and HTTP/3 in the Era of Transformers: The New Internet Privacy Battle Journal Article Forthcoming
In: IEEE Communications Magazine, Forthcoming.
Abstract | Links | BibTeX | Tags: dns, DoQ, privacy, website fingerprinting
@article{doq_commag,
title = {DNS-over-QUIC and HTTP/3 in the Era of Transformers: The New Internet Privacy Battle},
author = {Levente Csikor and Ziyue Lian and Haoran Zhang and Nitya Lakshmanan and Dinil Mon Divakaran},
editor = {Dr. Nils Nordbotten and EiC Prof. Rose Qingyang Hu.
},
url = {https://cslev.vip/wp-content/uploads/2025/04/DoQ_COMMAG-CR.pdf},
year = {2025},
date = {2025-04-10},
urldate = {2025-04-10},
journal = {IEEE Communications Magazine},
abstract = {Moving away from plain-text DNS communications, users now can switch to encrypted DNS protocols for name resolutions. DNS-over-QUIC (DoQ) employs QUIC—the latest transport protocol—for encrypted communications between users and their recursive DNS servers. QUIC is also poised to become the foundation of our daily web browsing by becoming the transport for HTTP/3, the latest version of the HTTP protocol. Traditional TCP-based web browsing is vulnerable to website fingerprinting (WFP) attacks that can identify the websites a user visits. The emergence of QUIC-based DNS and HTTP protocols raises an important question: are regular users better protected from WFP attacks when using these new protocols?
To investigate this, we first collect and publicly release the first benchmark dataset of network traffic corresponding to real visits to QUIC-enabled websites while using DoQ for domain resolution. This dataset will help advance the research on WFP attacks and defenses. Second, we implement and evaluate the
first WFP attack targeting the combined use of DoQ and HTTP/3 protocols by users by developing two transformer models tailored for WFP attacks. Finally, we conduct comprehensive experiments, which reveal that these models are effective in identifying user-visited websites, emphasizing the need for defensive measures.},
keywords = {dns, DoQ, privacy, website fingerprinting},
pubstate = {forthcoming},
tppubtype = {article}
}
Moving away from plain-text DNS communications, users now can switch to encrypted DNS protocols for name resolutions. DNS-over-QUIC (DoQ) employs QUIC—the latest transport protocol—for encrypted communications between users and their recursive DNS servers. QUIC is also poised to become the foundation of our daily web browsing by becoming the transport for HTTP/3, the latest version of the HTTP protocol. Traditional TCP-based web browsing is vulnerable to website fingerprinting (WFP) attacks that can identify the websites a user visits. The emergence of QUIC-based DNS and HTTP protocols raises an important question: are regular users better protected from WFP attacks when using these new protocols?
To investigate this, we first collect and publicly release the first benchmark dataset of network traffic corresponding to real visits to QUIC-enabled websites while using DoQ for domain resolution. This dataset will help advance the research on WFP attacks and defenses. Second, we implement and evaluate the
first WFP attack targeting the combined use of DoQ and HTTP/3 protocols by users by developing two transformer models tailored for WFP attacks. Finally, we conduct comprehensive experiments, which reveal that these models are effective in identifying user-visited websites, emphasizing the need for defensive measures.
To investigate this, we first collect and publicly release the first benchmark dataset of network traffic corresponding to real visits to QUIC-enabled websites while using DoQ for domain resolution. This dataset will help advance the research on WFP attacks and defenses. Second, we implement and evaluate the
first WFP attack targeting the combined use of DoQ and HTTP/3 protocols by users by developing two transformer models tailored for WFP attacks. Finally, we conduct comprehensive experiments, which reveal that these models are effective in identifying user-visited websites, emphasizing the need for defensive measures.