This page contains the DNS datasets used by REMeDy for automatic identification of DNS manipulations. The source code of REMeDy can be found here.
These datasets come from passive measurements and have been collected in real operational networks.
They are CSV file, where an entry corresponds to a DNS response. Each line reports: the IP address of the DNS server, the query, the flags of the DNS packet, and the (eventual) answers.
We offer three datasets, namely ISP1, ISP2 and Campus. The first two datasets come from a European operator, while the third one from a University Campus. They are 1-week long and are represent the traffic generated by 10,000 users. Every personal information is anonymized as well as sensitive IP address, hostnames and queries.
You can find the datasets here.