Hornet: Network Dataset of Geographically Placed Honeypots

The Hornet datasets are a series of datasets designed to help understand how geography may impact the inflow of network attacks. The data was collected from eight identically configured honeypot servers located in eight different locations across North America, Europe, and Asia throughout April and May 2021.

There are currently three datasets in this series:

Hornet 40: features 40 days of network traffic captured in April,May and June 2021.
Hornet 15: features 15 days of network traffic captured in April and May 2021.
Hornet 7: features 7 days of network traffic captured in April 2021.

Hornet 40: Network Dataset of Geographically Placed Honeypots

Hornet 40 is a dataset of 40 days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots are located in eight different cities: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore. The data was captured in April, May, and June 2021.

Citation: Valeros, Veronica (2021), “Hornet 40: Network Dataset of Geographically Placed Honeypots”, Mendeley Data, V3, doi: 10.17632/tcfzkbpw46.3

DOWNLOAD FROM MENDELEY

Download from stratosphere

Distribution of the number of flows per hour per scenario in logarithmic scale.

Hornet 15: Network Dataset of Geographically Placed Honeypots

Hornet 15 is a dataset of fifteen days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots are located in eight different cities: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore. The data was captured in April and May 2021.

Citation: Valeros, Veronica (2021), “Hornet 15: Network Dataset of Geographically Placed Honeypots”, Mendeley Data, V2, doi: 10.17632/rry7bhc2f2.2

download from mendeley

download from stratosphere

The dataset overview is presented in the table below, with the location, the total unique source IP addresses, the total flows, bytes, and packets per honeypot.

    Honeypot
    City
    Total Unique Src IPs
    Total Flows
    Total Bytes
    Total Packets
  


    Honeypot-Cloud-DigitalOcean-Geo-1
    Amsterdam
    18,070
    142,009
    209,507,220
    780,333
  

    Honeypot-Cloud-DigitalOcean-Geo-2
    Bangalore
    27,775
    161,388
    28,540,764
    405,570
  

    Honeypot-Cloud-DigitalOcean-Geo-3
    Frankfurt
    39,810
    1,180,656
    127,002,746
    1,416,327
  

    Honeypot-Cloud-DigitalOcean-Geo-4
    London
    26,621
    130,605
    20,472,105
    339,379
  

    Honeypot-Cloud-DigitalOcean-Geo-5
    New York
    23,433
    104,453
    19,618,190
    317,612
  

    Honeypot-Cloud-DigitalOcean-Geo-6
    San Francisco
    19,723
    104,522
    16,135,014
    261,307
  

    Honeypot-Cloud-DigitalOcean-Geo-7
    Singapore
    31,659
    133,081
    25,257,663
    357,693
  

    Honeypot-Cloud-DigitalOcean-Geo-8
    Toronto
    24,470
    147,457
    22,562,115
    361,886
  

A breakdown of the number of flows per protocol is shown in the table below.

    Honeypot
    TCP Flows
    UDP Flows
    ICMP Flows
    ARP Flows
    SCTP Flows
    UDT Flows
  


    Honeypot-Cloud-DigitalOcean-Geo-1
    126,031
    6,990
    8,504
    482
    2
    0
  

    Honeypot-Cloud-DigitalOcean-Geo-2
    133,010
    15,140
    12,754
    481
    2
    1
  

    Honeypot-Cloud-DigitalOcean-Geo-3
    135,712
    1,034,781
    9,665
    483
    2
    13
  

    Honeypot-Cloud-DigitalOcean-Geo-4
    117,100
    6,410
    6,606
    486
    2
    1
  

    Honeypot-Cloud-DigitalOcean-Geo-5
    94,919
    5,797
    3,249
    485
    2
    1
  

    Honeypot-Cloud-DigitalOcean-Geo-6
    91,508
    5,746
    6,785
    481
    2
    0
  

    Honeypot-Cloud-DigitalOcean-Geo-7
    114,293
    15,407
    2,894
    483
    3
    1
  

    Honeypot-Cloud-DigitalOcean-Geo-8
    134,663
    5,958
    6,353
    481
    2
    0
  

Hornet 7: Network Dataset of Geographically Placed Honeypots

Hornet 7 is a dataset of seven days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots were placed in eight different geographical locations: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore. The data was captured in April 2021.

Citation: Valeros, Veronica (2021), “Hornet 7: Network Dataset of Geographically Placed Honeypots”, Mendeley Data, V3, doi: 10.17632/w6yskg3ffy.3

Download from mendeley