Sources and Attribution

This page tracks scientific sources, dataset origins, and model attribution notes for HAMSTRING detector models.

Domainator Model Sources

The Domainator detector and attributor models use the same subdomain-level feature family and differ by their label space. The current model family combines malware, tunneling-tool, and benign DNS traffic sources:

Domainator training sources

Source	Contribution	Citation
Domainator malware samples	Real DNS-tunneling malware samples and the feature processing procedure used for subdomain sequence metadata.	Petrov et al. [Petrov et al., 2025]
LSTM DNS covert-channel dataset	DNS tunneling/covert-channel tool traffic used as malicious tunneling examples.	Chen et al. [Chen et al., 2021]
GraphTunnel dataset	DNS tunneling samples used to broaden tunneling-tool coverage.	Gao et al. [Gao et al., 2024]
Benign DNS traffic	Real DNS traffic used as legitimate traffic for training and evaluation.	Žiža et al. [Žiža et al., 2023]

Attribution Notes

• Keep new detector or attributor model descriptions in Overview.

• Add scientific publications to docs/refs.bib and cite them from the relevant model documentation.

• Record dataset provenance here whenever a model release changes training sources, label definitions, or intended attribution semantics.