Dns over Https/3 Website Fingerprinting Traces

We present a comprehensive dataset designed to support research in Website Fingerprinting (WF) attacks over DNS-over-HTTPS/3 (DoH3). The dataset includes 449 websites from the Majestic Million and Tranco list, each visited 100 times under controlled conditions. All traces are accompanied by corresponding decryption key logs to enable reproducibility and deep analysis.1. captures_all/: Full Browser Sessions (218 domains)This folder contains complete network captures for 449 websites. Each subdirectory, named as url_<index>_<domain>, includes 100 PCAP files, each representing a single browser-based visit, covering full page loads including all third-party resources.2. captures_onlydoh3/: DoH3-Only Traces (231 domains)This folder contains the DoH3-filtered version of the above sessions, with only encrypted DNS traffic retained. It allows researchers to isolate DoH3 behavior for fingerprinting studies without interference from other web traffic.3. captures_openworld/: Open-World DoH3 Samples (Additional domains)This directory includes complete network packet traces from non-monitored websites (i.e., outside the 449 closed-world set), enabling open-world classification experiments. These domains are sampled randomly from the long tail of the Alexa dataset and visited under the same collection protocol.4. merged_ssl_url.log: Unified SSL Key Log (per directory)Each of the three folders above includes a merged_ssl_url.log file, containing TLS key material (SSLKEYLOGFILE format) for all captured sessions in that directory. These files enable full session decryption in tools such as Wireshark, facilitating fine-grained traffic analysis.5. captures_csv: Extracted website visit CSV records (per site and per visit)Each website folder within this directory contains multiple CSV files, where each CSV file corresponds to a complete visit instance for that specific site. These CSV files include the following fields, as shown in the example: relative timestamp, inter-arrival time, source IP, source port, destination IP, destination port, packet length (bytes), and direction. The structured records enable downstream operations such as timing analysis, feature extraction, traffic pattern inspection, and machine-learning model training.