A Unified Knowledge-Driven Framework for Encrypted DNS Threat Awareness

The rapid adoption of encrypted Domain Name System (DNS) protocols has brought about a critical dilemma: while significantly enhancing user privacy, it has also blurred network visibility, creating blind spots for traffic monitoring and enabling malicious actors to evade detection and launch sophisticated attacks. Existing research often focuses on single directions, such as traffic classification or anomaly detection, lacking a unified framework that incorporates accurate identification, structured modeling, and intelligent reasoning. To address this issue, we propose a novel unified framework that integrates deep learning, knowledge graphs, and large language models. Our Long Short-Term Memory (LSTM)-based classifier achieved an F1 score of 98.9% in identifying encrypted DNS traffic. The dynamically constructed knowledge graph in Neo4j captures complex threat relationships and temporal evolution. Finally, we leverage the DeepSeek Large Language Model (LLM) for predictive reasoning and generation of mitigation strategies. Experimental results validate the effectiveness of our framework in accurate traffic classification, threat association, and proactive defense. This work provides a pioneering and scalable solution to the growing challenges of encrypted DNS security.