HIVE-OT Corpus: A 31-Day Industrial Honeypot Capture of 147,553 Protocol Events Across 14 OT/IT Protocols

HIVE-OT Corpus — Industrial Honeypot Capture (31 days, 147,553 events) This dataset accompanies the manuscript "HIVE-OT: A Physics-Coupled Industrial Honeypot Reveals an Inverted IT–OT Attack Distribution" (Tobón & Vargas Yáñez, 2026), submitted to the Journal of Information Security and Applications (Elsevier). CONTENTS hiveot_corpus_2026-05-22.txt (15.66 MiB): tab-separated text file with 147,553 protocol events captured during a 31.09-day continuous deployment (2026-04-20 22:55:00 UTC to 2026-05-22 01:00:00 UTC) of a high-interaction industrial honeypot. Each row is an eleven-column record: timestamp (UTC, microsecond precision), session_id, protocol, function_code, source_ip, dest_port, intent_class, intent_confidence, mitre_technique, physical_impact_severity (0.0 to 0.5), payload (JSON). - SHA-256 integrity hash: 65457273cc610ae27db6e4ddc55afd8374e189307eddef4e337ed4ded1c9d7f3 DEPLOYMENT CONTEXT HIVE-OT is a high-interaction industrial honeypot that simultaneously exposes seven operational-technology (OT) protocols — Modbus/TCP, S7comm, DNP3, IEC-60870-5-104, BACnet, SNMP, MQTT/OPC-UA — and seven information-technology (IT) protocols — HTTP-admin, Telnet, SMB, RDP, SSH, VNC, FTP — against a deterministic Rust process-surrogate engine simulating a five-stage water-treatment plant at 10 Hz, with four non-bypassable safety interlocks. The honeypot was reachable on the public internet without any active Shodan or Censys listing; all captured traffic is the consequence of internet-wide scanning and opportunistic exploitation. KEY EMPIRICAL FINDING The corpus exhibits an inverted IT–OT attack distribution: 147,320 IT-stack events (99.84%) versus 233 OT events (0.16%), a 632:1 ratio that is statistically significant (chi-squared (1) = 146,622, p < 10^-300) and temporally stable across the 31-day window (per-day IT share 99.62% to 99.97%, sigma = 0.09 percentage points). The small OT sliver concentrates the highest physical-impact severities: 155 events map to Impact or Inhibit-Response-Function tactics under MITRE ATT&CK for ICS. ANNOTATION QUALITY MITRE ATT&CK for ICS mapping was validated by independent re-annotation on a stratified 500-event sample with a priori power calculation (Cohen's kappa = 0.872, 95% confidence interval 0.838 to 0.906), corresponding to "almost perfect agreement" per Landis and Koch (1977). INTENDED USES This corpus supports: (1) volumetric and distributional analyses of OT/IT adversary behavior; (2) MITRE ATT&CK distributional studies; (3) session-level engagement reconstruction; (4) cross-corpus meta-analysis using the five-metric reporting baseline defined in the accompanying manuscript; (5) classifier training on protocol/function-code/MITRE-technique features. Inappropriate uses include any inference about specific identifiable persons or organizations — the IP addresses are network endpoints, not individuals. No personally identifying information was captured. REPRODUCIBILITY Every quantitative claim in the manuscript is recomputable from this single text file. A query cookbook of ten DuckDB queries (Appendix B of the manuscript) reproduces all reported numbers. A Datasheet-for-Datasets following Gebru et al. (2021) is reproduced as Appendix A of the manuscript and is distributed with the full software artefact. CITATION Tobón, S., & Vargas Yáñez, S. (2026). HIVE-OT Corpus: A 31-day industrial honeypot capture of 147,553 protocol events across 14 OT/IT protocols [Data set]. Zenodo. [DOI to be assigned by Zenodo] LICENSE AGPL-3.0-or-later. See the LICENSE file in the accompanying software repository.