DNSTunnel2026

# DNSTunnel2026: A Realistic Dataset for DNS Tunneling Detection This repository contains the **DNSTunnel2026** dataset and the associated quantized AI model as presented in the research paper: > **"Detecting DNS Tunneling Attacks via a Realistic Dataset in a Multi-Dimensional Feature-Driven Machine Learning Framework"** ## Project Overview DNS tunneling is a covert communication technique that abuses DNS queries and responses to bypass security controls, exfiltrate data, or establish command-and-control channels. DNSTunnel2026 provides a large-scale and realistic dataset for training and evaluating machine learning models that detect these hidden DNS channels. Unlike purely synthetic laboratory datasets, DNSTunnel2026 combines **real-world enterprise DNS logs** with **realistic adversarial DNS tunneling scenarios**. The dataset is designed to support practical DNS tunneling detection research under enterprise-like conditions, where malicious traffic is rare, benign traffic is highly diverse, and false positives can cause operational disruption. ## Dataset Description: DNSTunnel2026 DNSTunnel2026 consists of DNS requests and their corresponding responses. Sensitive client information is anonymized before distribution. The dataset is based on DNS logs collected from **25 enterprise clients** provided by DNSSense, together with synthetically generated DNS tunneling traffic produced under multiple adversarial scenarios. ### Key Characteristics | Property | Description ||---|---|| Raw dataset size | Greater than 10 GB || Processed CSV size | Approximately 5.3 GB || Benign samples | 37,447,179 || DNS tunneling samples | 31,135 || Class distribution | Highly imbalanced, intentionally preserved to reflect real-world network conditions || Number of features | 38 discriminative DNS features || Feature extraction granularity | Per `<company>-<domain>` pair || Temporal analysis | Sliding window analysis with 5-minute windows and 1-minute step size || Historical context | Includes 24-hour historical aggregate features || AI integration | Quantized readability model for identifying algorithmically generated or encoded subdomain strings | ## Raw DNS Data Schema The raw DNS traffic was parsed into a structured format before feature extraction. The following fields are used as the foundational input for the DNSTunnel2026 feature extraction pipeline. | Field | Meaning ||---|---|| `Domain` | Primary registered domain associated with the queried DNS address, such as `example.com`. || `FQDN` | Fully Qualified Domain Name. Represents the complete domain name including all hierarchical subdomains, such as `sub.example.com`. || `TLD` | Top-Level Domain at the end of the domain name, such as `.com`, `.org`, or `.edu`. || `DNS Type Name` | DNS query type used in the request, such as `A`, `AAAA`, `MX`, `TXT`, `CNAME`, or `NS`. || `Response` | DNS server response returned for the query. This may include IP addresses, canonical names, text records, mail server information, or other DNS outputs. || `Date` | Timestamp at which the DNS request and response were recorded. Used for temporal and behavioral analysis. || `Is Tunnel Data` | Classification label indicating whether the DNS record is associated with DNS tunneling activity. || `Company_uid` | Masked privacy-preserving identifier representing the client organization that generated the DNS traffic. | ## Dataset Realism and Scope DNSTunnel2026 differs from controlled benchmark datasets by incorporating real enterprise DNS traffic and realistic attack behavior. Its design emphasizes operational realism in the following ways: - **Real enterprise traffic:** DNS logs originate from multiple companies and domains rather than from a single synthetic lab environment.- **Context-aware labeling:** Labels are supported by behavioral indicators, domain reputation, global access patterns, and tunneling generation context.- **Organization-specific analysis:** Feature extraction is performed per `<company>-<domain>` pair, enabling detection of anomalies relative to each organization.- **False positive mitigation:** Cross-company domain popularity and access statistics help avoid misclassifying legitimate but atypical domains, such as CDN or infrastructure domains.- **Temporal awareness:** Sliding windows and 24-hour historical aggregates capture both short-term spikes and longer-term behavior.- **AI-based lexical analysis:** A quantized model evaluates whether subdomains appear human-readable or algorithmically generated. ## Adversarial DNS Tunneling Scenarios The attack traffic was generated using **SmoothFlow**, an open-source DNS traffic generation and flow simulation tool. SmoothFlow fragments and encodes files, transmits the fragments through DNS requests, and reconstructs the file on the server side. The dataset includes the following realistic tunneling scenarios: 1. **Different waiting times between DNS requests** Attack traffic was generated with inter-request intervals of **0.1, 0.5, 1.0, 5.0, 10.0, and 15.0 seconds** to simulate both aggressive and stealthy tunneling behavior. 2. **Different file sizes and file types** DNS tunneling traffic was generated by exfiltrating files of different sizes and formats, including structured and unstructured content. 3. **Different DNS query types** Attacks use multiple DNS record types to mimic legitimate behavior and reduce the effectiveness of static rules. Supported query types include `A`, `AAAA`, `MX`, `TXT`, `CNAME`, `NS`, and related DNS types. 4. **Different DNS request lengths** Encoded payload length is controlled through `min_length` and `max_length` parameters. The dataset includes seven request-length configurations, enabling analysis of short, normal-looking, and long encoded subdomains. 5. **Domains registered only for DNS tunneling** The attacker registers and configures a domain dedicated to the DNS tunnel, turning it into a covert communication endpoint. 6. **Safe-looking domains** Attack traffic is mixed with domains that host legitimate-looking web content, making the domain appear benign and reducing the likelihood of blocking. 7. **Safe-looking infrastructure domains** Attacks use or mimic domains with infrastructure-like behavior, such as CDN-style patterns with many FQDNs and complex subdomain structures. 8. **Repeated DNS requests** Attackers repeat DNS queries to make tunneling traffic resemble legitimate repeated access patterns and hide single-use FQDN behavior. ## SmoothFlow Attack Configuration Parameters SmoothFlow supports configurable DNS tunneling behavior through the following parameters: | Parameter | Meaning ||---|---|| `Min Length` | Minimum character length assigned to the generated subdomain field. Smaller values may resemble legitimate DNS behavior. || `Max Length` | Maximum character length allowed for the generated subdomain field. Larger values allow more payload data per query but may increase detectability. || `Timeout` | Time interval between consecutive DNS requests. Short values create high-frequency traffic; longer values simulate stealthier tunneling. || `DNS Query Type` | DNS record type used during tunneling, such as `A`, `AAAA`, `MX`, `TXT`, `CNAME`, or `NS`. | ## Feature Extraction Methodology A total of **38 DNS-based features** are extracted from the processed traffic. Feature extraction is performed using a sliding-window strategy: - Each analysis window covers the **last 5 minutes** of DNS traffic.- The window advances every **1 minute**.- Some features use **last-24-hour historical aggregates**.- Features are computed separately for each `<company>-<domain>` pair.- The extracted features combine behavioral, structural, temporal, cross-organizational, and AI-based lexical characteristics. This design improves robustness against false positives by considering not only one organization's traffic to a domain, but also how the same domain behaves across other companies. ## Feature Groups | Category | Feature Count | Included Feature Types ||---|---:|---|| Behavioral / volumetric | 6 | Request counts, FQDN counts, request ratios, most frequent records || Structural DNS record-type profile | 21 | DNS type counts and ratios for `A`, `AAAA`, `TXT`, `SOA`, `NS`, `MX`, `DS`, `CNAME`, `HTTPS`, and `OTHER` || Cross-organizational temporal behavior | 8 | Other-company traffic statistics in the current window and previous 24 hours || AI-based lexical analysis | 3 | File chunk detection outputs based on subdomain readability || **Total** | **38** | Full multi-dimensional DNS tunneling feature set | ## Feature Dictionary: Table 3 Columns The processed dataset contains the following 38 feature columns. | No | Feature Name | Meaning ||---:|---|---|| 1 | `company_domain_hits` | Total number of DNS requests made by the company to the domain within the current window. || 2 | `domain_data_portion` | Ratio of DNS requests made by `<company>` to `<domain>` to the total DNS traffic within the company's current window. || 3 | `fqdn_count` | Number of unique FQDNs used in visits to the domain by the relevant company within the current window. || 4 | `fqdn_hit_ratio` | Average number of DNS requests made per FQDN. || 5 | `unique_dns_types` | Number of distinct DNS query types used in requests to the domain within the current window. || 6 | `dns_type_A_count` | Number of DNS requests of type `A` made to the domain. || 7 | `dns_type_A_ratio` | Ratio of `A` type DNS requests to the domain to the total traffic in the current window. || 8 | `dns_type_AAAA_count` | Number of DNS requests of type `AAAA` made to the domain. || 9 | `dns_type_AAAA_ratio` | Ratio of `AAAA` type DNS requests to the domain to the total traffic in the current window. || 10 | `dns_type_TXT_count` | Number of DNS requests of type `TXT` made to the domain. || 11 | `dns_type_TXT_ratio` | Ratio of `TXT` type DNS requests to the domain to the total traffic in the current window. || 12 | `dns_type_SOA_count` | Number of DNS requests of type `SOA` made to the domain. || 13 | `dns_type_SOA_ratio` | Ratio of `SOA` type DNS requests to the domain to the total traffic in the current window. || 14 | `dns_type_NS_count` | Number of DNS requests of type `NS` made to the domain. || 15 | `dns_type_NS_ratio` | Ratio of `NS` type DNS requests to the domain to the total traffic in the current window. || 16 | `dns_type_MX_count` | Number of DNS requests of type `MX` made to the domain. || 17 | `dns_type_MX_ratio` | Ratio of `MX` type DNS requests to the domain to the total traffic in the current window. || 18 | `dns_type_DS_count` | Number of DNS requests of type `DS` made to the domain. || 19 | `dns_type_DS_ratio` | Ratio of `DS` type DNS requests to the domain to the total traffic in the current window. || 20 | `dns_type_CNAME_count` | Number of DNS requests of type `CNAME` made to the domain. || 21 | `dns_type_CNAME_ratio` | Ratio of `CNAME` type DNS requests to the domain to the total traffic in the current window. || 22 | `dns_type_HTTPS_count` | Number of DNS requests of type `HTTPS` made to the domain. || 23 | `dns_type_HTTPS_ratio` | Ratio of `HTTPS` type DNS requests to the domain to the total traffic in the current window. || 24 | `dns_type_OTHER_count` | Number of DNS requests to `<domain>` excluding `A`, `AAAA`, `SOA`, `NS`, `MX`, `DS`, `CNAME`, and `HTTPS` query types. || 25 | `dns_type_OTHER_ratio` | Ratio of DNS requests to `<domain>` to the total traffic in the current window, excluding `A`, `AAAA`, `SOA`, `NS`, `MX`, `DS`, `CNAME`, and `HTTPS` query types. || 26 | `top1_records_count` | Number of requests to the most frequently queried DNS record for the domain in the current window. || 27 | `top1_records_ratio` | Ratio of requests to the most frequently queried DNS record to the total number of requests in the current window. || 28 | `other_comp_last_24_fqdn_count` | Number of unique FQDNs queried for `<domain>` in the last 24 hours, excluding `<company>`. || 29 | `other_comp_last_24_fqdn_hit_ratio` | Average number of DNS requests made to queried FQDNs belonging to the domain in the last 24 hours, excluding the current company. || 30 | `other_comp_last_24_hits` | Total number of DNS requests made to `<domain>` in the last 24 hours, excluding `<company>`. || 31 | `other_comp_last_24_unique_company` | Number of unique companies that made DNS requests to the domain in the last 24 hours, excluding the current company. || 32 | `other_comp_window_fqdn_count` | Number of unique FQDNs queried for the domain within the current window by companies other than the current company. || 33 | `other_comp_window_fqdn_hit_ratio` | Average request frequency or hit ratio for FQDNs queried for the domain within the current window by companies other than the current company. || 34 | `other_comp_window_hits` | Total number of DNS requests made to the domain within the current window, excluding the current company. || 35 | `other_comp_window_unique_company` | Number of unique companies making DNS requests to `<domain>` within the current window, excluding `<company>`. || 36 | `file_chunk_detection_positive` | Number of FQDNs classified as positive by the file chunk detection model. Positive values indicate subdomain strings that look like encoded or non-human-readable file chunks. || 37 | `file_chunk_detection_negative` | Number of FQDNs classified as negative by the file chunk detection model. Negative values indicate subdomain strings that appear more human-readable or benign. || 38 | `file_chunk_detection_positive_ratio` | Ratio of chunk-positive FQDNs to the total number of FQDNs. | ## AI-Based File Chunk Detection Model DNS tunneling often encodes file fragments into subdomain strings. These encoded strings typically do not look human-readable. By contrast, benign domains often use meaningful subdomains such as `mail.example.com` or `smtp.example.com`. To capture this difference, DNSTunnel2026 uses an AI-based readability model that evaluates whether the subdomain portion of a DNS query appears human-readable or algorithmically generated. The outputs of this model are used as the following dataset features: - `file_chunk_detection_positive`- `file_chunk_detection_negative`- `file_chunk_detection_positive_ratio` The project uses the quantized version of the model, approximately **50 MB**, to reduce deployment and processing overhead while preserving the lexical signal needed for DNS tunneling detection. ## Included Files - `Archive.zip` Contains the processed dataset split into: - `train_data.csv`: training set, approximately 80% of the processed data. - `test_data.csv`: testing set, approximately 20% of the processed data. - `dga_quantized_model.bin` Quantized AI-based readability model used to generate lexical features for subdomains. ## Train / Test Split The processed dataset is split into training and test sets while preserving class distribution. | Split | Benign / Safe Samples | DNS Tunneling Samples ||---|---:|---:|| Train | 29,957,743 | 24,908 || Test | 7,489,436 | 6,227 | ## Model Information The primary evaluation framework uses **XGBoost** because it is scalable, efficient for high-dimensional tabular data, and suitable for imbalanced cybersecurity datasets. The model is trained to classify DNS traffic as either benign or DNS tunneling traffic. The broader experimental comparison also evaluates classical and deep learning models, including Random Forest, LightGBM, TabNet, and DNN. Ensemble-based models, especially Random Forest and LightGBM, provide strong balanced performance, while XGBoost remains attractive for efficient and scalable deployment. ## Usage 1. Extract `Archive.zip` to access the CSV files.2. Load `train_data.csv` and `test_data.csv` with a tabular data processing library such as Pandas.3. Use the 38 feature columns listed above as model inputs.4. Use the dataset label column to train a binary classifier for benign vs. DNS tunneling classification.5. Load `dga_quantized_model.bin` in the feature extraction pipeline when reproducing AI-based readability features. Recommended environment: - Python 3.x- Pandas- Scikit-learn- XGBoost- LightGBM, optional- Elasticsearch, optional for large-scale raw log indexing and feature extraction ## Citation When using this dataset, please cite the accompanying research paper: **Detecting DNS Tunneling Attacks via a Realistic Dataset in a Multi-Dimensional Feature-Driven Machine Learning Framework**