Active DNS Project

The dataset comes in Avro format which can be processed by several tools like avro-tools or fastavro for Python. We are working on a JSON version of the data for applications that do not rely on Java or Hadoop. This data is freely available to the academic research community for incorporation into new or existing work. This dataset relies on active DNS and a new large scale system, Thales, which is able to systematically query and collect large volumes of active DNS data. The output of this system is a distilled dataset that can be easily used by the security community. Thales has been reliably active for more than six monts and collected many terabytes of DNS data, while causing only a handful of abuse complaints.