HoneyMal-VirusTotal

This dataset was collected from a honeypot server designed to capture and record malicious network traffic. The honeypot actively interacts with potential attackers, logging the details of incoming network traffic and generating data from various attack attempts. The dataset comprises 100 rows and 12 feature columns, with each entry representing a unique network interaction captured by the honeypot. Data Collection and Integration with VirusTotal: The data collection process involved monitoring and recording network traffic from the honeypot, including both benign and malicious interactions. Each network connection was logged with essential features such as source and destination IP addresses, ports, hash values, and data content. To enhance the accuracy of malicious traffic classification, the dataset was integrated with VirusTotal's API. Each IP address present in the dataset was checked against VirusTotal's threat intelligence to label it as either "malicious" or "benign." The VirusTotal analysis provided additional context for classification by identifying whether any associated files, IP addresses, or URLs were flagged by multiple antivirus engines. This integration helps ensure that the dataset contains accurately labeled examples of malicious and benign network traffic. Dataset Features: The dataset contains 100 rows and 12 columns of data, with the following features: Protocol: The network protocol used in the connection (e.g., TCP, UDP). Remote IP: The IP address of the external system initiating the connection. Remote Port: The port number on the remote system used for the connection. Local IP: The IP address of the honeypot system receiving the connection. Local Port: The port number on the honeypot system accepting the connection. MD5 Hash: The MD5 hash of the data packet, used for identifying files or data blocks in the network traffic. SHA512 Hash: The SHA512 hash of the data packet, providing a cryptographic fingerprint for integrity checking. Length: The length of the data packet. Data Hex: The hexadecimal representation of the packet’s data, used for analyzing the contents of network traffic. Class_with_IP: The classification label indicating whether the source IP address is deemed malicious or benign, based on VirusTotal analysis. Classification and Labeling: The Class_with_IP column contains the classification label for each entry, which was determined by integrating VirusTotal’s analysis of the remote IP address. If the IP address was flagged as malicious by one or more antivirus engines in VirusTotal, it was labeled as "malicious"; otherwise, it was classified as "benign." This classification process ensures that the dataset is ready for use in machine learning models for malware detection or network traffic analysis.