CTU Hornet 65 Niner: A network dataset of geographically distributed low-interaction honeypots

This data article introduces a new network dataset created to help understand how geographical location impacts the quality, type, and amount of incoming network attacks received by honeypots. The dataset consists of 12.4 million network flows collected from nine low-interaction honeypots in nine ci...

Full description

Saved in:
Bibliographic Details
Published in:Data in brief 2025-02, Vol.58, p.111261, Article 111261
Main Authors: Valeros, Veronica, Garcia, Sebastian
Format: Article
Language:English
Subjects:
Cyber security
Distributed attacks
Geolocation
Honeypots dataset
Network attacks
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:This data article introduces a new network dataset created to help understand how geographical location impacts the quality, type, and amount of incoming network attacks received by honeypots. The dataset consists of 12.4 million network flows collected from nine low-interaction honeypots in nine cities across the world for 65 days, from April 29th to July 1st, 2024. Each low-interaction honeypot was identically configured to capture incoming attacks using a state-of-the-art network flow collector, Zeek. Honeypots were distributed in nine cities: Amsterdam, Bangalore, Frankfurt, London, New York, San Francisco, Singapore, Toronto, and Sydney. The dataset is in JSON format and contains all types of Zeek network flow files, including protocol-specific logs.
ISSN:2352-3409
2352-3409
DOI:10.1016/j.dib.2024.111261