Dataset for "DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure"

DICOMHawk (+Dicompot) Deployment Data This repository contains the data of the paper "DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure". The data is pseudo-anonymized by replacing IPs with a unique identifier (ID_X) to comply with GDPR, but keep the relationship between the given datasets. The files are provided in JSONline format. Following data is contained: [dicompot.jsonl] Dicompot located in the cloud (FRA) and local (University) over a period of 347 days (June 26, 2025, to June 7, 2026) [dicomhawk_dicom.jsonl] & [dicomhawk_dicom.jsonl] DICOMHawk with DICOM and Web/PACS endpoint located in cloud (NY) and local for the same 347 days period located in cloud (FRA) added on the 26th of January 2026 this include a testing phase where DICOMHawk returned a default pynetdicom identifier (June 26, 2025 until January 25, 2026) the testing phase also contains days with data loss and one significant dataloss (~end of October until November/January depending on instance), where DICOMHawk did not log any events on the DICOM endpoint [ip_information.jsonl] IP Information for the IPs observed by DICOMHawk