Building a DNS Sandbox Dataset for ML Research

The growing interest in applying machine learning to DNS data for security, operational intelligence, and anomaly detection has created a pressing need for high-quality, accessible datasets that can support experimentation, model training, and benchmarking. DNS logs contain rich, temporal, and behavioral signals that are valuable for identifying malicious domains, modeling query patterns, detecting tunneling attempts, and profiling network usage. However, real-world DNS datasets are often proprietary, sensitive, or subject to privacy regulations that limit their availability for open research. This makes building a DNS sandbox dataset a crucial step for enabling reproducible machine learning workflows and fostering innovation in the domain. Constructing such a dataset involves thoughtful data generation, simulation of realistic behaviors, anonymization strategies, labeling efforts, and structuring the data in a way that reflects the complexity of live DNS environments.

A DNS sandbox dataset must first represent the diversity of query types and behavioral patterns seen in actual networks. This includes queries to common top-level domains, dynamically generated subdomains, content delivery networks, ad and tracking domains, as well as long-tail domains with low frequency. To simulate this variety, data can be synthesized using a mix of real domain lists—such as the Alexa Top 1M, Umbrella Popular Domains, and various public threat feeds—and generated domains that represent benign and malicious behaviors. Tools like Domain Generation Algorithm (DGA) simulators can be used to create domains that mimic malware activity, while DNS tunneling traffic can be modeled using patterns of subdomain depth, entropy, and unusual query timing.

The temporal dimension of DNS activity is critical for machine learning models that rely on sequence or time-series features. A realistic sandbox dataset includes timestamped records that simulate diurnal patterns, burst activity, periodic beaconing, and other time-dependent behaviors. Event generators can model these effects by varying query rates over simulated hours or days, injecting scheduled or random noise, and embedding behavioral triggers such as system updates, application startups, or malware callbacks. The inclusion of time windows that mimic weekday and weekend traffic, normal user logins, or known malware campaigns allows models to be trained and evaluated on scenarios that reflect production environments.

Each DNS query entry in the dataset typically includes fields such as timestamp, query name, query type (e.g., A, AAAA, MX, TXT), response code, client ID or anonymized IP, TTL, and optionally the resolved IP address or CNAME target. Additional metadata such as geolocation, ASN, device type, or protocol (e.g., UDP, TCP, DoH) can be synthesized or inferred to enrich the dataset and allow for more advanced feature engineering. For instance, associating a client with a specific country or ISP can help train models to detect geo-specific anomalies, while encoding the presence of encrypted DNS protocols helps differentiate legacy traffic from privacy-aware clients.

Labeling is essential for supervised learning tasks. In a sandbox dataset, labels can be derived from the domain’s source list (e.g., known good vs. malicious), the method of generation (e.g., DGA vs. user-generated), or by manually annotating a subset of traffic based on behavior profiles. For classification models, a binary label indicating whether a query is benign or suspicious is often sufficient to begin. For more advanced tasks, multi-class labels might include categories such as legitimate CDNs, tracking domains, phishing sites, C2 domains, or tunneling endpoints. Label confidence scores can be included to reflect uncertainty and support probabilistic model training.

Privacy is a central concern when designing DNS datasets, even in synthetic environments. While sandbox datasets typically avoid using real client identifiers or IPs, precautions must still be taken to prevent deanonymization. This includes tokenizing or masking client IDs, truncating IP addresses to their subnet (e.g., /24 for IPv4), and avoiding domains that may inadvertently reveal sensitive or proprietary infrastructure. Care should also be taken when using publicly available domain lists, ensuring that data licensing and attribution requirements are respected. When anonymizing data, it is important to preserve the structural and statistical properties that models rely on, such as query cardinality, inter-arrival time distributions, and co-occurrence patterns between domains and clients.

The format of the DNS sandbox dataset influences how easily it can be used by machine learning pipelines. Columnar formats like Apache Parquet or ORC are well-suited for big data processing in Spark or Dask environments, while CSV or JSON Lines formats are convenient for smaller-scale analysis using pandas or scikit-learn. Splitting the dataset into train, validation, and test partitions—either temporally or randomly—supports robust model development and benchmarking. Additionally, including utility scripts for data loading, feature extraction, and baseline evaluation accelerates adoption by researchers and practitioners.

Feature engineering is a critical component of working with DNS data in machine learning. A well-constructed sandbox dataset should support the derivation of features such as domain length, entropy of the query name, subdomain depth, frequency of query repetition, TTL variance, and response type ratios. Sequence models like RNNs or transformers can benefit from tokenized domain representations, where each label in the domain hierarchy is treated as a feature. Temporal models require inter-arrival time calculations, sliding window aggregations, and sessionization logic to group queries into meaningful units of behavior. By providing sample feature extraction code and clear documentation, dataset authors can enable effective use of the sandbox data across a range of model architectures.

The final component of a useful DNS sandbox dataset is evaluation. This includes benchmark tasks and metrics for comparing model performance. Tasks may include detecting malicious queries, clustering similar behavioral profiles, forecasting query volumes, or classifying query intent. Metrics such as precision, recall, F1 score, ROC-AUC, and log-loss are commonly used, depending on the nature of the task. Providing a standardized benchmark suite with the dataset allows researchers to compare approaches on equal footing and fosters a culture of reproducibility and transparent progress.

Building a DNS sandbox dataset for machine learning research is a non-trivial effort, requiring careful design to simulate real-world dynamics while protecting privacy and supporting diverse analytical goals. However, the benefits are substantial. Such datasets empower security researchers, data scientists, and infrastructure engineers to explore new detection methods, improve threat intelligence, and contribute to the broader body of knowledge in network telemetry analytics. As DNS continues to serve as both a fundamental internet service and a vital telemetry source, the role of accessible, high-fidelity sandbox datasets in advancing machine learning will only become more critical.

The growing interest in applying machine learning to DNS data for security, operational intelligence, and anomaly detection has created a pressing need for high-quality, accessible datasets that can support experimentation, model training, and benchmarking. DNS logs contain rich, temporal, and behavioral signals that are valuable for identifying malicious domains, modeling query patterns, detecting tunneling attempts,…