{"id":2824,"date":"2025-08-06T10:27:24","date_gmt":"2025-08-06T14:27:24","guid":{"rendered":"https:\/\/www.yorku.ca\/research\/bccc\/?page_id=2824"},"modified":"2025-08-06T10:27:24","modified_gmt":"2025-08-06T14:27:24","slug":"dns-over-https-bccc-cira-cic-dohbrw-2020","status":"publish","type":"page","link":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/","title":{"rendered":"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 )"},"content":{"rendered":"\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p>The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset was created to address the imbalance in the 'CIRA-CIC-DoBre-2020' dataset. Unlike the 'CIRA-CIC-DoHBrw-2020' dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the 'BCCC-CIRA-CIC-DoHBrw-2020' dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\">\n<p><strong>The full research paper outlining the details of the dataset and its underlying principles:<br><\/strong><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:85em\">\n<p><a href=\"https:\/\/link.springer.com\/article\/10.1007\/s12083-023-01597-4\">https:\/\/link.springer.com\/article\/10.1007\/s12083-023-01597-4<\/a>\u201cUnveiling DoH Tunnel: Toward Generating a Balanced DoH EncryptedTraffic Dataset and Profiling malicious Behaviour using InherentlyInterpretable Machine Learning\u201c, Sepideh Niktabe, Arash Habibi Lashkari, Arousha Haghighian Roudsari, Peer-to-Peer Networking and Applications, Vol. 17, 2023<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\">\n<p><strong>Download Dataset:<\/strong><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:85em\">\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button bg-primary-2 text-white rounded-0 learnmore-block p-2\"><a class=\"wp-block-button__link has-text-color has-background no-border-radius wp-element-button\" href=\"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dataset-request\/\" style=\"color:#ffffff;background-color:#810001\" target=\"_blank\" rel=\"noreferrer noopener\">Request Dataset <i class=\"fas fa-chevron-right small pl-2\"><\/i><\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset was created to address the imbalance in the 'CIRA-CIC-DoBre-2020' dataset. Unlike the 'CIRA-CIC-DoHBrw-2020' dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the 'BCCC-CIRA-CIC-DoHBrw-2020' dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with [&hellip;]<\/p>\n","protected":false},"author":1159,"featured_media":0,"parent":349,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"tags":[8,38,42,12,13,16],"class_list":["post-2824","page","type-page","status-publish","hentry","tag-behaviour-centric-cybersecurity-center-bccc","tag-dataset","tag-dns-over-https-bccc-cira-cic-dohbrw-2020","tag-everyone","tag-public","tag-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 ) - Behaviour-Centric Cybersecurity Center (BCCC)<\/title>\n<meta name=\"description\" content=\"The &#039;BCCC-CIRA-CIC-DoHBrw-2020&#039; dataset was created to address the imbalance in the &#039;CIRA-CIC-DoBre-2020&#039; dataset. Unlike the &#039;CIRA-CIC-DoHBrw-2020&#039; dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the &#039;BCCC-CIRA-CIC-DoHBrw-2020&#039; dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The &#039;BCCC-CIRA-CIC-DoHBrw-2020&#039; dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 ) - Behaviour-Centric Cybersecurity Center (BCCC)\" \/>\n<meta property=\"og:description\" content=\"The &#039;BCCC-CIRA-CIC-DoHBrw-2020&#039; dataset was created to address the imbalance in the &#039;CIRA-CIC-DoBre-2020&#039; dataset. Unlike the &#039;CIRA-CIC-DoHBrw-2020&#039; dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the &#039;BCCC-CIRA-CIC-DoHBrw-2020&#039; dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The &#039;BCCC-CIRA-CIC-DoHBrw-2020&#039; dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/\" \/>\n<meta property=\"og:site_name\" content=\"Behaviour-Centric Cybersecurity Center (BCCC)\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/cybersecurity-datasets-cds\\\/dns-over-https-bccc-cira-cic-dohbrw-2020\\\/\",\"url\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/cybersecurity-datasets-cds\\\/dns-over-https-bccc-cira-cic-dohbrw-2020\\\/\",\"name\":\"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 ) - Behaviour-Centric Cybersecurity Center (BCCC)\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/#website\"},\"datePublished\":\"2025-08-06T14:27:24+00:00\",\"description\":\"The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset was created to address the imbalance in the 'CIRA-CIC-DoBre-2020' dataset. Unlike the 'CIRA-CIC-DoHBrw-2020' dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the 'BCCC-CIRA-CIC-DoHBrw-2020' dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/cybersecurity-datasets-cds\\\/dns-over-https-bccc-cira-cic-dohbrw-2020\\\/#breadcrumb\"},\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/cybersecurity-datasets-cds\\\/dns-over-https-bccc-cira-cic-dohbrw-2020\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/cybersecurity-datasets-cds\\\/dns-over-https-bccc-cira-cic-dohbrw-2020\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Data Analyzers &amp; Datasets\",\"item\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Cybersecurity Datasets (Intelligence-led Security)\",\"item\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/ucs-technical\\\/cybersecurity-datasets-cds\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 )\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/#website\",\"url\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/\",\"name\":\"Behaviour-Centric Cybersecurity Center (BCCC)\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.yorku.ca\\\/research\\\/bccc\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-CA\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 ) - Behaviour-Centric Cybersecurity Center (BCCC)","description":"The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset was created to address the imbalance in the 'CIRA-CIC-DoBre-2020' dataset. Unlike the 'CIRA-CIC-DoHBrw-2020' dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the 'BCCC-CIRA-CIC-DoHBrw-2020' dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/","og_locale":"en_US","og_type":"article","og_title":"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 ) - Behaviour-Centric Cybersecurity Center (BCCC)","og_description":"The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset was created to address the imbalance in the 'CIRA-CIC-DoBre-2020' dataset. Unlike the 'CIRA-CIC-DoHBrw-2020' dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the 'BCCC-CIRA-CIC-DoHBrw-2020' dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.","og_url":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/","og_site_name":"Behaviour-Centric Cybersecurity Center (BCCC)","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/","url":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/","name":"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 ) - Behaviour-Centric Cybersecurity Center (BCCC)","isPartOf":{"@id":"https:\/\/www.yorku.ca\/research\/bccc\/#website"},"datePublished":"2025-08-06T14:27:24+00:00","description":"The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset was created to address the imbalance in the 'CIRA-CIC-DoBre-2020' dataset. Unlike the 'CIRA-CIC-DoHBrw-2020' dataset, which is skewed with about 90% malicious and only 10% benign Domain over HTTPS (DoH) network traffic, the 'BCCC-CIRA-CIC-DoHBrw-2020' dataset offers a more balanced composition. It includes equal numbers of malicious and benign DoH network traffic instances, with 249,836 instances in each category. This balance was achieved using the Synthetic Minority Over-sampling Technique (SMOTE). The 'BCCC-CIRA-CIC-DoHBrw-2020' dataset comprises three CSV files: one for malicious DoH traffic, one for benign DoH traffic, and a third that combines both types.","breadcrumb":{"@id":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/#breadcrumb"},"inLanguage":"en-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/dns-over-https-bccc-cira-cic-dohbrw-2020\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.yorku.ca\/research\/bccc\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Data Analyzers &amp; Datasets","item":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/"},{"@type":"ListItem","position":3,"name":"Cybersecurity Datasets (Intelligence-led Security)","item":"https:\/\/www.yorku.ca\/research\/bccc\/ucs-technical\/cybersecurity-datasets-cds\/"},{"@type":"ListItem","position":4,"name":"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 )"}]},{"@type":"WebSite","@id":"https:\/\/www.yorku.ca\/research\/bccc\/#website","url":"https:\/\/www.yorku.ca\/research\/bccc\/","name":"Behaviour-Centric Cybersecurity Center (BCCC)","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.yorku.ca\/research\/bccc\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-CA"}]}},"taxonomy_info":{"post_tag":[{"value":8,"label":"Behaviour-Centric Cybersecurity Center (BCCC)"},{"value":38,"label":"Dataset"},{"value":42,"label":"DNS over HTTPS ( BCCC-CIRA-CIC-DoHBrw-2020 )"},{"value":12,"label":"Everyone"},{"value":13,"label":"Public"},{"value":16,"label":"Research"}]},"featured_image_src_large":false,"author_info":{"display_name":"ahabibil","author_link":"https:\/\/www.yorku.ca\/research\/bccc\/author\/ahabibil\/"},"comment_info":"","_links":{"self":[{"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/pages\/2824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/users\/1159"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/comments?post=2824"}],"version-history":[{"count":1,"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/pages\/2824\/revisions"}],"predecessor-version":[{"id":2825,"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/pages\/2824\/revisions\/2825"}],"up":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/pages\/349"}],"wp:attachment":[{"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/media?parent=2824"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yorku.ca\/research\/bccc\/wp-json\/wp\/v2\/tags?post=2824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}