恶意域名数据集

本数据集是一个结构化的恶意域名情报数据集。数据通过对中国电信骨干网的海量DNS解析日志进行机器学习建模，并融合业界权威威胁情报源交叉验证后生成。数据集中每一条记录均对一个恶意域名进行了全面的画像，主要包含域名本身、主要威胁类型、风险等级、首次发现时间、当前状态等核心数据项。本数据集主要用于支撑课题二-指标2.1 “恶意域名发现的准确度达到95%”验证。
时间范围：数据采集与分析周期为 2025 年 2 月至 2025 年 11 月。
时间精度：时间相关字段（如首次发现时间、信息更新时间）精确到日。
空间范围：数据分析基于覆盖全国范围的中国电信骨干网DNS日志，具有全国代表性。
计算方式：采用“被动分析为主，情报融合为辅”的综合采集方案，依托自研的“域名服务系统测绘系统V1.0”自动分析生成。系统通过分析域名行为特征自动发现潜在恶意域名，并与权威威胁情报源进行交叉验证和关联，以提升准确率。
本数据集的大小为10MB

This dataset is a structured malicious domain name intelligence dataset. The data is generated by conducting machine learning modeling on massive DNS resolution logs from China Telecom's backbone network, and fusing with cross-validation from authoritative industry threat intelligence sources. Each record in the dataset provides a comprehensive profile of a malicious domain name, mainly including core data items such as the domain name itself, primary threat type, risk level, first discovery time, current status, etc. This dataset is mainly used to support the verification of Task 2 - Indicator 2.1 "The accuracy of malicious domain discovery reaches 95%".
- Time Scope: The data collection and analysis period is from February 2025 to November 2025.
- Time Precision: Time-related fields (such as first discovery time, information update time) are accurate to the day.
- Spatial Scope: The data analysis is based on DNS logs from China Telecom's backbone network covering the entire country, making it nationally representative.
- Calculation Method: Adopt a comprehensive collection scheme of "passive analysis as the primary method and intelligence fusion as the supplementary method", and automatically generate data relying on the self-developed "Domain Service System Mapping System V1.0". The system automatically discovers potential malicious domain names by analyzing domain name behavior characteristics, and conducts cross-validation and correlation with authoritative threat intelligence sources to improve accuracy.
The size of this dataset is 10 MB.

搜集汇总

背景与挑战

背景概述

该数据集是一个结构化的恶意域名情报数据集，通过对中国电信骨干网DNS解析日志进行机器学习建模，并融合权威威胁情报交叉验证生成，包含域名、威胁类型、风险等级等核心数据项。数据集覆盖2025年2月至11月全国范围，用于支撑恶意域名发现准确度验证，数据量32.75MB，格式包括csv、pdf等。