ahmedBargady/MIAF_DomainDetection_Infrastructure_Datasets

MIAF: Domain Detection Infrastructure Datasets

<img alt="MIAF infrastructure metadata pipeline" src="https://cdn-uploads.huggingface.co/production/uploads/667889c762292a0dd7b9c561/5T7B3Xp9nj9yc5LEY9T8p.png" width="500" />

This collection is the standardized evaluation benchmark for MIAF (Modular Infrastructure-Aware Fusion). It provides nine classification datasets derived from four public malicious-domain benchmarks, each paired with a shared 137-feature infrastructure representation.

Overview

We evaluate MIAF across nine classification datasets derived from four public malicious-domain benchmarks:

• —[DomainRadar](https://doi.org/10.1016/j.dib.2025.112062) (Hranický et al., 2025)
• —[ThreatFox](https://threatfox.abuse.ch/) (abuse.ch)
• —[DeepURLBench](https://arxiv.org/abs/2501.00356) (Schvartzman et al., 2024)
• —[MACFormer/CURL-IP](https://doi.org/10.1109/TIFS.2026.3709128) (Tian et al., 2026)

These datasets cover malware detection, phishing detection, and long-tailed malware-family attribution. The benchmarks span diverse characteristics in terms of scale, class balance, label granularity, and metadata availability, enabling an evaluation of the efficacy of infrastructure metadata under varied operating conditions.

Quick Start

Install the Datasets library and load one of the nine task-specific configurations:

from datasets import load_dataset

dataset = load_dataset(
    "ahmedBargady/MIAF_DomainDetection_Infrastructure_Datasets",
    "threatfox-malware",
)

train = dataset["train"]
validation = dataset["validation"]
test = dataset["test"]

Available configurations: domainradar-malware, domainradar-phishing, domainradar-malware-family, threatfox-malware, threatfox-malware-family, deepurlbench-malware, deepurlbench-phishing, macformer-malware, and macformer-phishing.

Data Splits and Reorganization

To establish a consistent evaluation baseline, we have reorganized each benchmark into task-specific subsets and partitioned them into disjoint training, development, and testing sets using a 60/20/20 ratio. This stratification was applied to every individual class within the datasets to ensure a fair and consistent baseline across all evaluated methods.

All datasets that lacked native infrastructure metadata (ThreatFox, DeepURLBench, and MACFormer) have been enriched using the uniform EDC pipeline.

Infrastructure Metadata

Each row in train.csv, dev.csv, and test.csv pairs a domain name with 137 standardized numerical infrastructure features. DomainRadar (stored under DataInBriefHranicky/) provides native EDC metadata; we collected the same metadata for ThreatFox, DeepURLBench, and MACFormer with the Enrichment Data Collector (EDC), giving all nine task datasets one shared feature schema.

The 137 fields comprise five semantic metadata categories plus two input-validation flags:

Continuous quantities (for example, registration age and TTL) remain numerical. Boolean properties are binary indicators. High-cardinality concepts such as ASNs, nameservers, and hosting networks are represented through security-specific indicators and diversity counts rather than raw identifiers.

Missing infrastructure observations are retained as empty CSV cells. Presence and availability fields preserve observable missingness where available; the MIAF experiments set remaining missing values to zero during data loading. Infrastructure metadata changes over time, so these values describe the collection-time snapshot and may not match the infrastructure present when a domain was originally labeled.

Complete Feature Catalog

<details> <summary><strong>Input validation (2 features)</strong></summary>

</details>

<details> <summary><strong>RDAP/WHOIS (37 features)</strong></summary>

</details>

<details> <summary><strong>DNS (29 features)</strong></summary>

</details>

<details> <summary><strong>TLS (26 features)</strong></summary>

</details>

<details> <summary><strong>IP/Hosting (31 features)</strong></summary>

</details>

<details> <summary><strong>Cross-signal (12 features)</strong></summary>

</details>

Dataset Characteristics

Structure

Inside each task folder:

• —train.csv: Training split (60%) with domain names, labels, and the 137-feature infrastructure vector.
• —dev.csv: Development/validation split (20%) with the same schema.
• —test.csv: Testing split (20%) with the same schema.
• —*_ip.csv: Resolved-IP sidecar records corresponding to each split; sidecar columns vary by source benchmark.

Data Fields

For MIAF-compatible metadata input, exclude input, class, label, label_int, _error, and _elapsed_s when those columns are present. Preserve the feature columns in their CSV order.

Intended Uses

This release supports research and reproducible benchmarking in:

• —infrastructure-aware malicious domain-name and phishing detection;
• —long-tailed malware-family attribution;
• —multimodal fusion of domain-name strings and infrastructure metadata;
• —metadata-category ablation, missing-data robustness, and temporal-drift studies; and
• —interpretable analysis of registration, DNS, TLS, and hosting evidence.

The data is intended for research and evaluation. A model trained on these snapshots should not be used as the sole basis for production blocking or attribution decisions.

Limitations and Responsible Use

• —Infrastructure metadata is time-dependent. The released values describe the collection-time snapshot and may not match the infrastructure present when a domain was first observed or labeled.
• —Missing values are expected because DNS, RDAP/WHOIS, TLS, and IP/hosting sources differ in coverage, availability, latency, and rate limits.
• —Labels inherit the scope, collection procedures, class balance, and possible noise of the four source benchmarks.
• —Domain names and resolved IP records may identify active or formerly active malicious infrastructure. Do not visit or execute content from listed domains without an isolated security-analysis environment.
• —The standardized feature vectors contain no raw WHOIS/RDAP contact names, email addresses, or postal addresses.

Citation and Attribution

If you use this collection, cite the dataset and the relevant source benchmark linked in the Overview:

@dataset{bargady_2026_miaf_infrastructure,
  author    = {Ahmed Bargady},
  title     = {MIAF: Domain Detection Infrastructure Datasets},
  year      = {2026},
  publisher = {Hugging Face},
  url       = {https://huggingface.co/datasets/ahmedBargady/MIAF_DomainDetection_Infrastructure_Datasets}
}

License

This standardized release is provided under the MIT license declared in the dataset card metadata. The underlying benchmarks remain attributable to their original creators; review their linked publications and terms when redistributing derived data.