Find research datasets worth reusing

DoH-Gen-F-AABBC

<p><strong>Please refer to the original data article for further data description:</strong> <a href="https://doi.org/10.1016/j.dib.2022.108310">Jeřábek & Hynek et al., Collection of datasets with DNS over HTTPS traffic In: Data in Brief Journal</a> ,DOI:<a href="https://doi.org/10.1016/j.dib.2022.108310">10.1016/j.dib.2022.108310</a></p> <p><strong>Dataset of DNS over HTTPS traffic  from Firefox </strong><em>(AdGuard, AhaDNS, BlahDNS, BraveDNS, CloudFlare)</em><br> The dataset contains DoH and HTTPS traffic that was captured in a virtualized environment (Docker) and generated automatically by Firefox browser with enabled DoH towards 5 different DoH servers (AdGuard, AhaDNS, BlahDNS, BraveDNS, CloudFlare) and a web page loads towards a sample of web pages taken from Majestic Million dataset. The data are provided in the form of PCAP files. However, we also provided TLS enriched flow data that are generated with opensource [ipfixprobe](https://github.com/CESNET/ipfixprobe) flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <thead> <tr> <th>Column Name</th> <th>Column Description</th> </tr> </thead> <tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong>DoH-Gen-F-AABBC</strong><strong><em>.tar.gz </em></strong>and has the following structure:</p> <p> </p> <pre><code>. └─── data | - Main directory with data └── generated | - Directory with generated captures ├── pcap | - Generated PCAPs │ └── firefox └── tls-flow-csv | - Generated CSV flow data └── firefox</code></pre> <p> </p> <p><strong>Total stats of generated data:</strong></p> <table> <thead> <tr> <th>Name</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>Total Data Size</td> <td>40.2 GB</td> </tr> <tr> <td>Total files</td> <td>10</td> </tr> <tr> <td>DoH extracted tls flows</td> <td>~57 K</td> </tr> <tr> <td>Non-DoH extracted tls flows</td> <td>~327 K</td> </tr> </tbody> </table> <p><strong>DoH Server information</strong></p> <table> <thead> <tr> <th>Name</th> <th>Provider</th> <th>DoH query url</th> </tr> </thead> <tbody> <tr> <td>AdGuard</td> <td><a href="https://adguard-dns.com">https://adguard-dns.com</a></td> <td><a href="https://dns.adguard.com/dns-query">https://dns.adguard.com/dns-query</a></td> </tr> <tr> <td>AhaDNS</td> <td><a href="https://ahadns.com">https://ahadns.com</a></td> <td><a href="https://doh.it.ahadns.net/dns-query">https://doh.it.ahadns.net/dns-query</a></td> </tr> <tr> <td>BlahDNS</td> <td><a href="https://blahdns.com">https://blahdns.com</a></td> <td><a href="https://doh-de.blahdns.com/dns-query">https://doh-de.blahdns.com/dns-query</a></td> </tr> <tr> <td>BraveDNS</td> <td><a href="https://brave.com">https://brave.com</a></td> <td><a href="https://basic.bravedns.com">https://basic.bravedns.com</a></td> </tr> <tr> <td>CloudFlare</td> <td><a href="https://www.cloudflare.com">https://www.cloudflare.com</a></td> <td><a href="https://cloudflare-dns.com/dns-query">https://cloudflare-dns.com/dns-query</a></td> </tr> </tbody> </table> <p>Please cite the original article:</p> <pre><code>@article{Jerabek2022, title = {Collection of datasets with DNS over HTTPS traffic}, journal = {Data in Brief}, volume = {42}, pages = {108310}, year = {2022}, issn = {2352-3409}, doi = {https://doi.org/10.1016/j.dib.2022.108310}, url = {https://www.sciencedirect.com/science/article/pii/S2352340922005121}, author = {Kamil Jeřábek and Karel Hynek and Tomáš Čejka and Ondřej Ryšavý} }</code></pre>

DoH-Gen-C-AABBCC

<p>Dataset of DNS over HTTPS traffic (AdGuard, AhaDNS, BlahDNS, BraveDNS, Comcast, CZNIC)</p> <p>The dataset contains DoH and HTTPS traffic that was captured in controlled environment and generated automatically by Chrome browser with enabled DoH towards 6 different DoH servers (AdGuard, AhaDNS, BlahDNS, BraveDNS, Comcast, CZNIC) and a web page loads towards a sample of web pages taken from Majestic Million dataset. The data are provided in the form of PCAP files. However, we also provided TLS enriched flow data that are generated with opensource <a href="https://github.com/CESNET/ipfixprobe">ipfixprobe</a> flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <thead> <tr> <th>Column Name</th> <th>Column Description</th> </tr> </thead> <tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong><em>DoH-Gen-C-AABBCC.tar.gz </em></strong>and has the following structure:</p> <pre><code>. └─── data | - Main directory with data └── generated | - Directory with generated captures ├── pcap | - Generated PCAPs │ └── chrome └── tls-flow-csv | - Generated CSV flow data └── chrome</code></pre> <p> </p> <p><strong>Total stats of generated data:</strong></p> <table> <thead> <tr> <th>Name</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>Total Data Size</td> <td>39.9 GB</td> </tr> <tr> <td>Total files</td> <td>12</td> </tr> <tr> <td>DoH extracted tls flows</td> <td>~35 K</td> </tr> <tr> <td>Non-DoH extracted tls flows</td> <td>~247 K</td> </tr> </tbody> </table> <p> </p> <p><strong>DoH Server information</strong></p> <p> </p> <table> <thead> <tr> <th>Name</th> <th>Provider</th> <th>DoH query url</th> </tr> </thead> <tbody> <tr> <td>AdGuard</td> <td><a href="https://adguard-dns.com">https://adguard-dns.com</a></td> <td><a href="https://dns.adguard.com/dns-query">https://dns.adguard.com/dns-query</a></td> </tr> <tr> <td>AhaDNS</td> <td><a href="https://ahadns.com">https://ahadns.com</a></td> <td><a href="https://doh.it.ahadns.net/dns-query">https://doh.it.ahadns.net/dns-query</a></td> </tr> <tr> <td>BlahDNS</td> <td><a href="https://blahdns.com">https://blahdns.com</a></td> <td><a href="https://doh-de.blahdns.com/dns-query">https://doh-de.blahdns.com/dns-query</a></td> </tr> <tr> <td>BraveDNS</td> <td><a href="https://brave.com">https://brave.com</a></td> <td><a href="https://basic.bravedns.com">https://basic.bravedns.com</a></td> </tr> <tr> <td>Comcast</td> <td><a href="https://corporate.comcast.com">https://corporate.comcast.com</a></td> <td><a href="https://doh.xfinity.com/dns-query">https://doh.xfinity.com/dns-query</a></td> </tr> <tr> <td>CZNIC</td> <td><a href="https://www.nic.cz">https://www.nic.cz</a></td> <td><a href="https://odvr.nic.cz/doh">https://odvr.nic.cz/doh</a></td> </tr> </tbody> </table> <p> </p>

DoH-Gen-F-FGHOQS

<p><strong>Please refer to the original data article for further data description:</strong> <a href="https://doi.org/10.1016/j.dib.2022.108310">Jeřábek & Hynek et al., Collection of datasets with DNS over HTTPS traffic In: Data in Brief Journal</a> ,DOI:<a href="https://doi.org/10.1016/j.dib.2022.108310">10.1016/j.dib.2022.108310</a></p> <p><strong>Dataset of DNS over HTTPS traffic from Firefox </strong><em>(FFMuc, Google, Hostux, OpenDNS Quad9, Switch)</em><br> The dataset contains DoH and HTTPS traffic that was captured in a virtualized environment (Docker) and generated automatically by Firefox browser with enabled DoH towards 6 different DoH servers (FFMuc, Google, Hostux, OpenDNS Quad9, Switch) and a web page loads towards a sample of web pages taken from Majestic Million dataset. The data are provided in the form of PCAP files. However, we also provided TLS enriched flow data that are generated with opensource <a href="https://github.com/CESNET/ipfixprobe">ipfixprobe</a> flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <thead> <tr> <th>Column Name</th> <th>Column Description</th> </tr> </thead> <tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong><em>DoH-Gen-F-FGHOQS.tar.gz </em></strong>and has the following structure:</p> <p> </p> <pre><code>. └─── data | - Main directory with data └── generated | - Directory with generated captures ├── pcap | - Generated PCAPs │ └── firefox └── tls-flow-csv | - Generated CSV flow data └── firefox</code></pre> <p> </p> <p><strong>Total stats of generated data:</strong></p> <table> <thead> <tr> <th>Name</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>Total Data Size</td> <td>46.7 GB</td> </tr> <tr> <td>Total files</td> <td>12</td> </tr> <tr> <td>DoH extracted tls flows</td> <td>~98 K</td> </tr> <tr> <td>Non-DoH extracted tls flows</td> <td>~353 K</td> </tr> </tbody> </table> <p><strong>DoH Server information</strong></p> <table> <thead> <tr> <th>Name</th> <th>Provider</th> <th>DoH query url</th> </tr> </thead> <tbody> <tr> <td>FFMuc</td> <td><a href="https://ffmuc.net">https://ffmuc.net</a></td> <td><a href="https://doh.ffmuc.net/dns-query">https://doh.ffmuc.net/dns-query</a></td> </tr> <tr> <td>Google</td> <td><a href="https://google.com">https://google.com</a></td> <td><a href="https://dns.google/dns-query">https://dns.google/dns-query</a></td> </tr> <tr> <td>Hostux</td> <td><a href="https://dns.hostux.net/en/">https://dns.hostux.net/en/</a></td> <td><a href="https://dns.hostux.net/dns-query">https://dns.hostux.net/dns-query</a></td> </tr> <tr> <td>OpenDNS</td> <td><a href="https://www.opendns.com">https://www.opendns.com</a></td> <td><a href="https://doh.opendns.com/dns-query">https://doh.opendns.com/dns-query</a></td> </tr> <tr> <td>Quad9</td> <td><a href="https://www.quad9.net">https://www.quad9.net</a></td> <td><a href="https://dns.quad9.net/dns-query">https://dns.quad9.net/dns-query</a></td> </tr> <tr> <td>Switch</td> <td><a href="https://www.switch.ch">https://www.switch.ch</a></td> <td><a href="https://dns.switch.ch/dns-query">https://dns.switch.ch/dns-query</a></td> </tr> </tbody> </table> <p> </p> <p>Please cite the original article:</p> <pre><code>@article{Jerabek2022, title = {Collection of datasets with DNS over HTTPS traffic}, journal = {Data in Brief}, volume = {42}, pages = {108310}, year = {2022}, issn = {2352-3409}, doi = {https://doi.org/10.1016/j.dib.2022.108310}, url = {https://www.sciencedirect.com/science/article/pii/S2352340922005121}, author = {Kamil Jeřábek and Karel Hynek and Tomáš Čejka and Ondřej Ryšavý} }</code></pre>

DoH-Gen-F-CCDDD

<p><strong>Dataset of DNS over HTTPS traffic from Firefox </strong><em>(Comcast, CZNIC, DNSForge, DSNSB, DOHli)</em><br> The dataset contains DoH and HTTPS traffic that was captured in a virtualized environment (Docker) and generated automatically by Firefox browser with enabled DoH towards 5 different DoH servers (Comcast, CZNIC, DNSForge, DSNSB, DOHli) and a web page loads towards a sample of web pages taken from Majestic Million dataset. The data are provided in the form of PCAP files. However, we also provided TLS enriched flow data that are generated with opensource [ipfixprobe](https://github.com/CESNET/ipfixprobe) flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <thead> <tr> <th>Column Name</th> <th>Column Description</th> </tr> </thead> <tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong><em>DoH-Gen-F-CCDDD.tar.gz </em></strong>and has the following structure:</p> <p> </p> <pre><code>. └─── data | - Main directory with data └── generated | - Directory with generated captures ├── pcap | - Generated PCAPs │ └── firefox └── tls-flow-csv | - Generated CSV flow data └── firefox</code></pre> <p> </p> <p><strong>Total stats of generated data:</strong></p> <table> <thead> <tr> <th>Name</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>Total Data Size</td> <td>40.2 GB</td> </tr> <tr> <td>Total files</td> <td>10</td> </tr> <tr> <td>DoH extracted tls flows</td> <td>~100 K</td> </tr> <tr> <td>Non-DoH extracted tls flows</td> <td>~315 K</td> </tr> </tbody> </table> <p><strong>DoH Server information</strong></p> <table> <thead> <tr> <th>Name</th> <th>Provider</th> <th>DoH query url</th> </tr> </thead> <tbody> <tr> <td>Comcast</td> <td><a href="https://corporate.comcast.com">https://corporate.comcast.com</a></td> <td><a href="https://doh.xfinity.com/dns-query">https://doh.xfinity.com/dns-query</a></td> </tr> <tr> <td>CZNIC</td> <td><a href="https://www.nic.cz">https://www.nic.cz</a></td> <td><a href="https://odvr.nic.cz/doh">https://odvr.nic.cz/doh</a></td> </tr> <tr> <td>DNSForge</td> <td><a href="https://dnsforge.de">https://dnsforge.de</a></td> <td><a href="https://dnsforge.de/dns-query">https://dnsforge.de/dns-query</a></td> </tr> <tr> <td>DNSSB</td> <td><a href="https://dns.sb/doh/">https://dns.sb/doh/</a></td> <td><a href="https://doh.dns.sb/dns-query">https://doh.dns.sb/dns-query</a></td> </tr> <tr> <td>DOHli</td> <td><a href="https://doh.li">https://doh.li</a></td> <td><a href="https://doh.li/dns-query">https://doh.li/dns-query</a></td> </tr> </tbody> </table> <p> </p>

DoH-Gen-C-DDD

<p><strong>NOTICE:</strong> The data file 0_chrome_dohli.pcap is corrupted and is not used in our articles that work with this dataset.</p> <p>Dataset of DNS over HTTPS traffic from Chrome Browser <em>(DNSForge, DSNSB, DOHli)</em></p> <p>The dataset contains DoH and HTTPS traffic that was captured in controlled environment and generated automatically by Chrome browser with enabled DoH towards 3 different DoH servers (DNSForge, DSNSB, DOHli) and a web page loads towards a sample of web pages taken from Majestic Million dataset. The data are provided in the form of PCAP files. However, we also provided TLS enriched flow data that are generated with opensource <a href="https://github.com/CESNET/ipfixprobe">ipfixprobe</a> flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <tbody><tr> <th>Column Name</th> <th>Column Description</th> </tr> </tbody><tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong><em>DoH-Gen-C-DDD.tar.gz </em></strong>and has the following structure:</p> <pre><code>. └─── data | - Main directory with data └── generated | - Directory with generated captures ├── pcap | - Generated PCAPs │ └── chrome └── tls-flow-csv | - Generated CSV flow data └── chrome</code></pre> <p><strong>Total stats of generated data:</strong></p> <table> <tbody><tr> <th>Name</th> <th>Value</th> </tr> </tbody><tbody> <tr> <td>Total Data Size</td> <td>34.5 GB</td> </tr> <tr> <td>Total files</td> <td>6</td> </tr> <tr> <td>DoH extracted tls flows</td> <td>~15 K</td> </tr> <tr> <td>Non-DoH extracted tls flows</td> <td>~103 K</td> </tr> </tbody> </table> <p> </p> <p><strong>DoH Server information</strong></p> <p> </p> <table> <tbody><tr> <th>Name</th> <th>Provider</th> <th>DoH query url</th> </tr> </tbody><tbody> <tr> <td>DNSForge</td> <td><a href="https://dnsforge.de">https://dnsforge.de</a></td> <td><a href="https://dnsforge.de/dns-query">https://dnsforge.de/dns-query</a></td> </tr> <tr> <td>DNSSB</td> <td><a href="https://dns.sb/doh/">https://dns.sb/doh/</a></td> <td><a href="https://doh.dns.sb/dns-query">https://doh.dns.sb/dns-query</a></td> </tr> <tr> <td>DOHli</td> <td><a href="https://doh.li">https://doh.li</a></td> <td><a href="https://doh.li/dns-query">https://doh.li/dns-query</a></td> </tr> </tbody> </table> <p> </p> <p> </p> <p> </p>

opencc-by-4.0May 2022View details →

Dataset of DNS over HTTPS (DoH) Internet Servers

<p><strong>Description</strong></p> <p>The DoH Internet Servers dataset comprises a verified list of Internet servers offering DNS over HTTPS (DoH). This is an updated <a href="http://doi.org/10.17632/ny4m53g6bw.1">10.17632/ny4m53g6bw.1</a> The list was created through the aggregation of a previously existing, but incomplete, list of DoH servers. The servers in this dataset went through a verification phase where it was confirmed they were active and working as advertised. The verification was done between May 1st, 2022, and May 4th, 2022. The dataset contains a total of 254 unique DoH servers, out of which 136 are over IPv4 and 118 over IPv6. The DoH servers belong to 59 unique Autonomous Systems and are associated with a total of 106 unique domain names.</p> <p>The following public lists of existing DoH servers were used to create this dataset:</p> <ul> <li>https://developers.google.com/speed/public-dns/docs/doh/json</li> <li>https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/</li> <li>https://github.com/curl/curl/wiki/DNS-over-HTTPS</li> <li>https://help.keenetic.com/hc/en-us/articles/360007687159-DNS-over-TLS-and-DNS-over-HTTPS-proxy-servers-for-DNS-requests-encryption</li> <li>https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Resolvers</li> <li>https://kb.adguard.com/en/general/dns-providers</li> <li>https://applied-privacy.net/services/dns/</li> <li>https://www.pacnog.org/pacnog24/presentations/DoT-DoH-DNS-Privacy.pdf</li> <li>https://www.privacytools.io/providers/dns/</li> </ul> <p> </p> <p>The verification of the DoH servers was performed using a custom-made python script. The script is available at: https://github.com/stratosphereips/DoH-Research/tree/main/validation-script</p>

opencc-by-4.0Sep 2023View details →

Five-week DoH Dataset collected on ISP backbone lines

<p>This dataset is an additional DoH dataset used for researching DoH traffic data drift phenomena. It contains anonymized packet captures (pcaps) from the following days:</p> <ul> <li>2022-11-28</li> <li>2022-12-05</li> <li>2022-12-12</li> <li>2022-12-19</li> <li>2022-12-26</li> </ul> <p>The traffic was captured on the CESNET2 network and anonymized. The packet capturing and anonymization follow the methodology described in [1]. The list of IP addresses used for DoH recognition is also included within the dataset in <code>doh_resolver_ip.csv</code> file.<br> The structure of the dataset is as follows:</p> <pre><code>. ├── doh_resolver_ip.csv ├── pcap │ ├── 2022-11-28 │ │ ├── DoH-20221128180002.pcapng │ │ └── HTTPS-20221128180002.pcapng │ ├── 2022-12-05 │ │ ├── DoH-20221205180001.pcapng │ │ └── HTTPS-20221205180001.pcapng │ ├── 2022-12-12 │ │ ├── DoH-20221212180001.pcapng │ │ └── HTTPS-20221212180001.pcapng │ ├── 2022-12-19 │ │ ├── DoH-20221219180001.pcapng │ │ └── HTTPS-20221219180001.pcapng │ └── 2022-12-26 │ ├── DoH-20221226180001.pcapng │ └── HTTPS-20221226180001.pcapng └── README.md</code></pre> <p> </p> <p>[1] Jeřábek, K., Hynek, K., Čejka, T., & Ry&scaron;avý, O. (2022). Collection of datasets with DNS over HTTPS traffic. Data in Brief, 42, 108310. <a href="https://www.sciencedirect.com/science/article/pii/S2352340922005121">https://www.sciencedirect.com/science/article/pii/S2352340922005121</a></p>

DoH -- Real-World

<p> </p> <p><strong>Please refer to the original data article for further data description:</strong> <a href="https://doi.org/10.1016/j.dib.2022.108310">Jeřábek & Hynek et al., Collection of datasets with DNS over HTTPS traffic In: Data in Brief Journal</a> ,DOI:<a href="https://doi.org/10.1016/j.dib.2022.108310">10.1016/j.dib.2022.108310</a></p> <p>The collection of datasets contains DoH and HTTPS traffic that was captured in a real large ISP network. The data are provided in the form of PCAP files. However, since we needed to anonymize the real captures, we also provided TLS enriched flow data that are generated with opensource <a href="https://github.com/CESNET/ipfixprobe">ipfixprobe</a> flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <thead> <tr> <th>Column Name</th> <th>Column Description</th> </tr> </thead> <tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong><em>DoH-Real-World.tar.gz</em></strong> and has the following structure:</p> <pre><code>. └── data | - Main directory with data └── captured | - Directory with data captured on ISP backbone lines ├── pcap | - ISP backbone PCAPS └── tls-flow-csv | - ISP backbone CSV flow data </code></pre> <p> </p> <p><strong>Dataset collection statistics:</strong></p> <table> <thead> <tr> <th>Name</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>Total Data Size</td> <td>179 GB</td> </tr> <tr> <td>Total Time</td> <td>~10 Days</td> </tr> <tr> <td>Connections</td> <td>~420 M</td> </tr> <tr> <td>Number of unique Client IP addresses</td> <td>116,263</td> </tr> <tr> <td>Number of unique Server IP addresses</td> <td>9343</td> </tr> <tr> <td>Number of unique DoH Resolver's IP addresses</td> <td>142</td> </tr> </tbody> </table> <p> </p> <p>Please cite the original article:</p> <pre><code>@article{Jerabek2022, title = {Collection of datasets with DNS over HTTPS traffic}, journal = {Data in Brief}, volume = {42}, pages = {108310}, year = {2022}, issn = {2352-3409}, doi = {https://doi.org/10.1016/j.dib.2022.108310}, url = {https://www.sciencedirect.com/science/article/pii/S2352340922005121}, author = {Kamil Jeřábek and Karel Hynek and Tomáš Čejka and Ondřej Ryšavý} }</code></pre> <p> </p>

DoH-Gen-C-CFGHOQS

<p><strong>NOTICE:</strong> The data file 1_chrome_ffmuc.pcap is corrupted and is not used in our articles that work with this dataset.</p> <p>Dataset of DNS over HTTPS traffic from Chrome <em>(CloudFlare, FFMuc, Google, Hostux, OpenDNS, Quad9, Switch)</em></p> <p>The dataset contains DoH and HTTPS traffic that was captured in controlled environment and generated automatically by Chrome browser with enabled DoH towards 7 different DoH servers (CloudFlare, FFMuc, Google, Hostux, OpenDNS, Quad9, Switch) and a web page loads towards a sample of web pages taken from Majestic Million dataset. The data are provided in the form of PCAP files. However, we also provided TLS enriched flow data that are generated with opensource <a href="https://github.com/CESNET/ipfixprobe">ipfixprobe</a> flow exporter. Other than TLS related information is not relevant since the dataset comprises only encrypted TLS traffic. The TLS enriched flow data are provided in the form of CSV files with the following columns:</p> <table> <tbody><tr> <th>Column Name</th> <th>Column Description</th> </tr> </tbody><tbody> <tr> <td>DST_IP</td> <td>Destination IP address</td> </tr> <tr> <td>SRC_IP</td> <td>Source IP address</td> </tr> <tr> <td>BYTES</td> <td>The number of transmitted bytes from Source to Destination</td> </tr> <tr> <td>BYTES_REV</td> <td>The number of transmitted bytes from Destination to Source</td> </tr> <tr> <td>TIME_FIRST</td> <td>Timestamp of the first packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>TIME_LAST</td> <td>Timestamp of the last packet in the flow in format YYYY-MM-DDTHH-MM-SS</td> </tr> <tr> <td>PACKETS</td> <td>The number of packets transmitted from Source to Destination</td> </tr> <tr> <td>PACKETS_REV</td> <td>The number of packets transmitted from Destination to Source</td> </tr> <tr> <td>DST_PORT</td> <td>Destination port</td> </tr> <tr> <td>SRC_PORT</td> <td>Source port</td> </tr> <tr> <td>PROTOCOL</td> <td>The number of transport protocol</td> </tr> <tr> <td>TCP_FLAGS</td> <td>Logic OR across all TCP flags in the packets transmitted from Source to Destination</td> </tr> <tr> <td>TCP_FLAGS_REV</td> <td>Logic OR across all TCP flags in the packets transmitted from Destination to Source</td> </tr> <tr> <td>TLS_ALPN</td> <td>The Value of Application Protocol Negotiation Extension sent from Server</td> </tr> <tr> <td>TLS_JA3</td> <td>The JA3 fingerprint</td> </tr> <tr> <td>TLS_SNI</td> <td>The value of Server Name Indication Extension sent by Client</td> </tr> </tbody> </table> <p>The DoH resolvers in the dataset can be identified by IP addresses written in <strong><em>doh_resolver_ip.csv </em></strong>file.</p> <p>The main part of the dataset is located in <strong><em>DoH-Gen-C-CFGHOQS.tar.gz </em></strong>and has the following structure:</p> <pre><code>. └─── data | - Main directory with data └── generated | - Directory with generated captures ├── pcap | - Generated PCAPs │ └── chrome └── tls-flow-csv | - Generated CSV flow data └── chrome</code></pre> <pre> </pre> <p><strong>Total stats of generated data:</strong></p> <table> <tbody><tr> <th>Name</th> <th>Value</th> </tr> </tbody><tbody> <tr> <td>Total Data Size</td> <td>41.5 GB</td> </tr> <tr> <td>Total files</td> <td>14</td> </tr> <tr> <td>DoH extracted tls flows</td> <td>~41 K</td> </tr> <tr> <td>Non-DoH extracted tls flows</td> <td>~284 K</td> </tr> </tbody> </table> <p> </p> <p><strong>DoH Server information</strong></p> <p> </p> <table> <tbody><tr> <th>Name</th> <th>Provider</th> <th>DoH query url</th> </tr> </tbody><tbody> <tr> <td>CloudFlare</td> <td><a href="https://www.cloudflare.com">https://www.cloudflare.com</a></td> <td><a href="https://cloudflare-dns.com/dns-query">https://cloudflare-dns.com/dns-query</a></td> </tr> <tr> <td>FFMuc</td> <td><a href="https://ffmuc.net">https://ffmuc.net</a></td> <td><a href="https://doh.ffmuc.net/dns-query">https://doh.ffmuc.net/dns-query</a></td> </tr> <tr> <td>Google</td> <td><a href="https://google.com">https://google.com</a></td> <td><a href="https://dns.google/dns-query">https://dns.google/dns-query</a></td> </tr> <tr> <td>Hostux</td> <td><a href="https://dns.hostux.net/en/">https://dns.hostux.net/en/</a></td> <td><a href="https://dns.hostux.net/dns-query">https://dns.hostux.net/dns-query</a></td> </tr> <tr> <td>OpenDNS</td> <td><a href="https://www.opendns.com">https://www.opendns.com</a></td> <td><a href="https://doh.opendns.com/dns-query">https://doh.opendns.com/dns-query</a></td> </tr> <tr> <td>Quad9</td> <td><a href="https://www.quad9.net">https://www.quad9.net</a></td> <td><a href="https://dns.quad9.net/dns-query">https://dns.quad9.net/dns-query</a></td> </tr> <tr> <td>Switch</td> <td><a href="https://www.switch.ch">https://www.switch.ch</a></td> <td><a href="https://dns.switch.ch/dns-query">https://dns.switch.ch/dns-query</a></td> </tr> </tbody> </table> <p> </p>

opencc-zeroFeb 2022View details →

Supplementary material 2 from: Kenis M, Agboyi LK, Adu-Acheampong R, Ansong M, Arthur S, Attipoe PT, Baba A-SM, Beseh P, Clottey VA, Combey R, Dzomeku I, Eddy-Doh MA, Fening KO, Frimpong-Anin K, Hevi W, Lekete-Lawson E, Nboyine JA, Ohene-Mensah G, Oppong-Mensah B, Nuamah HSA, van der Puije G, Mulema J (2022) Horizon scanning for prioritising invasive alien species with potential to threaten agriculture and biodiversity in Ghana. NeoBiota 71: 129-148. https://doi.org/10.3897/neobiota.71.72577

Risk scores for potential invasive alien plant pests in Ghana