---
title: DNS-Tunnel Datasets for Detection Research
url: https://www.emergentmind.com/topics/dns-tunnel-datasets
type: topic
---

# DNS-Tunnel Datasets for Detection Research

The DNS-Tunnel-Datasets are a family of labeled, structured datasets specifically developed to support research in DNS tunneling analysis and detection. DNS tunneling encodes arbitrary data within DNS queries and responses, facilitating covert data exfiltration, command-and-control channels, and protocol bridging. DNS-Tunnel-Datasets systematically capture the multi-class and multi-tool diversity of tunneled and benign DNS traffic, providing standardized resources for reproducible protocol inference, anomaly detection, and machine learning evaluation on DNS tunnel scenarios [2512.09565].

## 1. Dataset Origins and Composition

DNS-Tunnel-Datasets consolidate several domain-specific corpora, each targeting distinct aspects of DNS tunneling and its detection in both lab-controlled and wild settings.

**a. Gao et al. DNS-Tunnel-Datasets (2024):**

- The primary dataset, curated by Gao et al., comprises raw DNS query and response packet logs across twelve classes:
  - Benign (normal recursive queries)
  - Wildcard DNS responses (authoritative wildcard behaviors)
  - Eleven tunneling tool families, including tcp-over-dns, dnscat2, andiodine, dns2tcp, iodine, dnspot, dns-shell, tuns, CobaltStrike, and OzymanDNS
- Approximate class proportions: benign (58%), wildcard (4%), each tunneling tool (2–4%) [2512.09565]
- Data splits: 60% train, 20% validation, 20% test; additional reduced-data splits as low as 10% labeled training data

**b. Additional Datasets in the Ecosystem:**

- **Homem et al. (2017):** DNS tunnel capture (Iodine tool, HTTP/FTP over DNS, 20 tunnel sessions, 2 plain sessions) for protocol inference [1709.06363]
- **Palau et al. DNSTunnelData (2020):** VM-based, 5 tunneling tools, ≈8000 tunneling and ≈8500 benign domains, HDI/CSV format [2006.06122]
- **Meyer et al. (2019):** Passive DNS (pDNS) measurement of tunnel domains in the wild, 273 suspicious tunnel SLDs extracted from 2B+ new FQDNs, with meta-features and clustering [1902.08454]

All datasets are publicly downloadable for research under open licenses, e.g., https://github.com/ggyggy666/DNS-Tunnel-Datasets and https://github.com/PalauLab/DNSTunnelData [2512.09565][2006.06122].

## 2. Labeling, Class Taxonomy, and Ground Truth

The core DNS-Tunnel-Datasets employ a multi-class taxonomy:

| Class         | Description                                  | Example Tools    |
| ------------- | -------------------------------------------- | ---------------- |
| benign        | Legitimate recursive DNS traffic             | n/a              |
| wildcard      | Responses from wildcard records              | n/a              |
| tcp-over-dns  | TCP tunneled in DNS queries                  | tcp-over-dns     |
| dnscat2       | C2 and bidirectional comms over DNS          | dnscat2          |
| andiodine     | Variant of Iodine                            | andiodine        |
| dns2tcp       | TCP-over-DNS tunneling                       | dns2tcp          |
| iodine        | IPv4-over-DNS                                | iodine           |
| dnspot        | DNSSpot tunnel traffic                       | dnspot           |
| dns-shell     | Shell via DNS                                | dns-shell        |
| tuns          | IPv4-through-DNS tool                        | tuns             |
| CobaltStrike  | C2/RedTeaming framework utilizing DNS        | CobaltStrike     |
| OzymanDNS     | Exfiltration tool over DNS                   | OzymanDNS        |

Ground truth is established by controlled tool execution or rigorous pDNS filtering, often referencing synchronized script logs (“time-injection” alignment) or explicit domain whitelists/blacklists [2512.09565][2006.06122][1902.08454].

The Palau et al. dataset encodes ground-truth with the fields `label` (0=normal, 1=tunneling) and `tool_code` (tool identifier) [2006.06122].

## 3. Feature Representation and Preprocessing

DNS-Tunnel-Datasets provide both raw and feature-engineered fields capable of supporting symbolic, statistical, or deep sequence models:

- **Domain Embeddings:** Fully qualified domain names (FQDNs) are tokenized at each label (by “.”), each mapped by a hash function to a fixed bucket count (B = 2¹⁵ = 32,768), and then embedded (64-dimensional dense vector per token). Sequences are padded or truncated to T=15 tokens to ensure uniformity [2512.09565].
- **Numeric DNS Features:** Standardized (z-scored) features from the DNS packet: frame length, response TTL, query/response counts per window, inter-arrival time Δt, and Shannon entropy of the subdomain. These accommodate statistical modeling or serve as direct input to hybrid neural architectures [2512.09565].
- **Raw and CSV/JSON Schemas:** Per-packet fields include timestamp, src_ip, dst_ip, protocol_label, tunnel_flag, packet_index, byte_entropy, and tool-specific features (see per-dataset schema for full details) [1709.06363][2006.06122][1902.08454].
- **No Pre-computed Lexical Stats:** In Palau et al., only raw QNAMEs are distributed, leaving n-gram, entropy, and lexical ratio feature extraction to downstream users [2006.06122].

## 4. Detection Methodologies and Benchmarking

DNS-Tunnel-Datasets underlie several detection paradigms:

- **Sequence Models:** DNS-HyXNet applies a hybrid xLSTM architecture, ingesting concatenated [numeric, embedding] per-packet vectors, learning multi-class discrimination within a two-layer xLSTM stack. After T steps, the last hidden state (`h_T`) and numeric vector (`\hat n_T`) are conjoined and classified by a 3-layer MLP; softmax outputs multinomial tunnel class probabilities [2512.09565].
- **Entropy-Based Classification:** Homem et al. extract per-packet Shannon entropy (\(H(X) = -\sum_i p(x_i) \log_2 p(x_i)\)) and use mean-difference classification. For each session, the mean entropy is compared to reference means, and the protocol label with minimal absolute distance (“MeanDiff”) is chosen. Reported accuracy is 75% (15/20 sessions), with protocol-specific confusion metrics [1709.06363].
- **CNN-based Lexicographical Detection:** Palau et al. model QNAME strings as integer sequences passed to a 1D ConvNet with filters trained for 4-gram local patterns, achieving detection F1 ≈ 0.96 with a 0.8% false positive rate [2006.06122].
- **Step-wise Filtering and Profiling:** Meyer et al. identify tunnel domains from 2B+ pDNS queries via a filter cascade (rrtype, whitelist, FQDN level, fan-out, domain profiling) and manually tag resulting domains as Service/Organization/Private/Other, mapping to tool families by structural fingerprint [1902.08454].

## 5. Composition, Distribution, and Access

The principal DNS-Tunnel-Datasets and related corpora provide structured access and transparent distributional balance:

| Dataset                    | Tool Families         | Benign Samples | Tunnel Samples | Classes | Main Format | Access URL                                      |
|----------------------------|----------------------|---------------|---------------|---------|-------------|-------------------------------------------------|
| DNS-Tunnel-Datasets (Gao)  | 11 (+ benign, wildc) | 58%           | 38%           | 12      | PCAP/table  | https://github.com/ggyggy666/DNS-Tunnel-Datasets|
| DNSTunnelData (Palau)      | 5                    | 8,511         | 8,000         | 2+tool  | CSV         | https://github.com/PalauLab/DNSTunnelData        |
| Homem et al. (2017)        | 1 (Iodine) + plain   | n/a           | 20 sessions   | 2+ref   | PCAP/CSV    | Code in TunnelStatsTests GitHub                  |
| Meyer et al. (2019)        | pDNS wild, profiled  | n/a           | 273 SLDs      | n/a     | CSV/JSON    | https://www.rub.de/dns-tunnels-dataset           |

Datasets handle privacy by full session anonymization or by releasing only summary/statistical features. Licensing varies (MIT, CC BY-NC 4.0, CC-BY-4.0), allowing broad academic reuse.

## 6. Benchmark Performance and Limitations

Benchmarking on DNS-Tunnel-Datasets enables rigorous evaluation of detection pipelines:

- **DNS-HyXNet Results [2512.09565]:**
  - Macro-averaged accuracy: 99.99%
  - Macro precision/recall/F1: ≥ 99.96%
  - Average detection time: 0.041 ms/sample, throughput ≈24,215 samples/s
  - Per-class F1-scores all >0.9997, indicating near-perfect inter-class separation
- **Homem et al. MeanDiff Classifier [1709.06363]:**
  - 75% tunnel protocol inference accuracy using entropy histograms
  - False positive/recall/precision per protocol are explicitly reported
- **Palau et al. CNN Lexicographical Classifier [2006.06122]:**
  - Overall balanced F1 ≈ 0.9605, tunneling recall 92.4%, normal recall 99.5%
  - “More than 92% of total tunneling domains detected with a false positive rate close to 0.8%”
- **Meyer et al. Wild Dataset [1902.08454]:**
  - 273 suspicious tunnel SLDs discovered, “iodine-like” accounting for ≈80% of labeled tunnel behavior

All results are reported verbatim from the cited sources, with reproducible splits and confusion matrices.

## 7. Applicability, Extensions, and Community Impact

DNS-Tunnel-Datasets serve as benchmarks for:

- Real-time tunnel detection under adversarial, open-world conditions
- Multi-family and multi-protocol evaluation, including emerging tool variants (e.g., CobaltStrike, dnspot)
- Research on privacy-preserving forensic analysis, entropy/probabilistic features, protocol fingerprinting, and sequence-based classification
- Standardization of evaluation for new detection algorithms, model robustness, and transfer learning in DNS anomaly detection

The broad spectrum of DNS-Tunnel-Datasets supports not only protocol-level inference but also the development of lightweight, low-latency real-time detection systems for deployment on commodity infrastructure [2512.09565]. The availability of both raw and derived feature corpora, multiple types of tunnel traffic, and open metrics establishes these datasets as central resources for DNS security research and engineering.

Source: https://www.emergentmind.com/topics/dns-tunnel-datasets