Fast-Flux Dataset: Enhancing Cybersecurity Analysis and Defense
Description
The enhanced fast-flux domain dataset comprises a comprehensive collection of 91,530 domain records systematically gathered through active DNS monitoring and the integration of threat intelligence over a two-month observation period. The dataset represents one of the largest publicly available collections of fast-flux domain data, featuring detailed behavioral and structural analysis. It provides researchers with unprecedented access to real-world cybersecurity threat data. The dataset structure incorporates 20 distinct features for each domain record, carefully engineered to capture the multifaceted nature of fast-flux network operations. These features span four primary categories: network connectivity characteristics, domain naming and structural properties, historical relationship data, and web infrastructure presence indicators. Each feature has been validated through statistical analysis and correlation studies to ensure discriminative power and analytical relevance. Network connectivity features form the foundation of the dataset, capturing the distinctive IP rotation patterns that define fast-flux operations. The number of associated IP addresses per domain ranges from a minimum of 1 to a maximum of 440, with fast-flux domains typically demonstrating significantly higher IP counts compared to legitimate domains. Geographic distribution analysis reveals that fast-flux domains span multiple countries and cities, with a median of 2 countries and two cities per domain, reflecting the distributed nature of fast-flux infrastructure. The Autonomous System Number (ASN) diversity metric provides insights into the network infrastructure preferences of fast-flux operators, with values ranging from 2 to 194 ASNs per domain. This high variability indicates that while most domains utilize relatively few ASNs, sophisticated fast-flux operations may leverage dozens or hundreds of different network providers to maximize resilience and evade detection. Domain naming characteristics reveal significant behavioral differences between fast-flux and legitimate domains. Domain length analysis reveals a range of 4 to 244 characters, with a median length of 16 characters and a mean of approximately 19.7 characters. More significantly, domain entropy analysis reveals that fast-flux domains exhibit higher randomness in naming patterns, with entropy values averaging 3.5-4 bits, compared to 3.0-3.3 bits for legitimate domains. This entropy differential reflects the algorithmic or pseudo-random generation techniques commonly employed in fast-flux domain creation. Top-level domain (TLD) distribution analysis reveals that 99.5% of domains in the dataset utilize Type 2 TLDs (primarily .com), indicating a strong preference for common, trusted TLD types that may help evade suspicion. Additionally, 16% of domains utilize private WHOIS registration, indicating that operational security considerations are a factor in the deployment of fast-flux networks.
Files
Steps to reproduce
The data collection process begins with the establishment of a seed set comprising 80 confirmed fast-flux domains identified through a systematic literature review and threat intelligence analysis. These seed domains were sourced from recent academic publications, including seminal works by Massa [1] and Zang et al. [2], as well as other foundational studies on fast-flux and botnet detection. The process also incorporates real-time threat intelligence feeds and social media monitoring for emerging fast-flux domain reports. This multi-source approach ensures comprehensive coverage of known fast-flux operational patterns, while also incorporating emerging threats that may not yet be documented in the academic literature. Active DNS monitoring forms the core of the data collection methodology, utilizing the Linux dig utility to perform systematic DNS lookups for each domain in the seed set over a continuous two-month observation period. This extended monitoring window captures the temporal dynamics of fast-flux operations, including IP rotation patterns, infrastructure changes, and operational lifecycle characteristics that are essential for understanding fast-flux network behavior. For each DNS query, comprehensive response data is captured, including all resolved IP addresses, response timing information, and any additional DNS record types returned. The IP address extraction process focuses on A records while also capturing AAAA, CNAME, and other relevant record types that may provide insights into domain infrastructure and operational patterns. This comprehensive approach ensures that the dataset captures the full spectrum of DNS behavior associated with fast-flux operations. Code available upon request
Institutions
- Jordan University of Science and Technology