Operational Research Data from Internet NAmespace Logs (ORDINAL) (2017-05-31)

The Domain Name System (DNS) is a method to identify resources on the Internet. Unfortunately, the DNS has historically been misused as an AUTHENTICATION system instead. The ORDINAL dataset contains robust DNS protocol layer data, select application layer data, standard activity logs, received select transmissions, and packet captures of associated activity originally intended to study the impact of DNS namespace collisions. The dataset is generated via Internet activity to sensor nodes which are linked to high activity Domain Names. The highest volume names have been used commonly in misconfigurations or in internal environments across the Internet, but none of the names in the ORDINAL dataset have ever to our knowledge, provided services for any public facing purpose other than research data collection and providing awareness of misconfiguration issues. All sensors operate DNS, SMTP, HTTP, and HTTPS listeners on IPv4 and IPv6. All information received by the sensor nodes is provided unsolicited. Log data made available under ORDINAL are IP-address anonymized. Objectives * Raise awareness of the "Misuse of the DNS for authentication" issue * Improve protocol and application design * Help software vendors identify and remediate problems * Help system administrators identify and remediate problems * Provide data to spam/phishing/malware researchers What ORDINAL can make available to researchers * DNS query logs (named logs) * All behavior supports IPv4 and IPv6 * Open to running experiments (based on risk assessment)