Abstract: With the increasing adoption of DNS-over-HTTPS (DoH), its encrypted nature enhances privacy protection but simultaneously poses significant challenges for detecting DoH tunnel traffic.