Hornet 7: Network Dataset of Geographical Placed Honeypots

Hornet 7 is a dataset of seven days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots were placed in eight different geographical locations: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore. The data was captured in April 2021. The eight cloud servers were created and configured simultaneously following identical instructions. The network capture was performed using the Argus network monitoring tool in each cloud server. The cloud servers had only one service running (SSH on a non-standard port) and was fully dedicated to be used as a honeypot. No honeypot software was used in this dataset. The dataset consists of eight scenarios, one for each geographically located cloud server. Each scenario contains bidirectional NetFlow files in the following format: - hornet7-biargus.tar.gz: all scenarios with bidirectional NetFlow files in Argus binary format; - hornet7-netflow-v5.tar.gz: all scenarios with bidirectional NetFlow v5 files in CSV format; - hornet7-netflow-extended.tar.gz: all scenarios with bidirectional NetFlows files in CSV format containing all features provided by Argus. - hornet7-full.tar.gz: download all the data (biargus, netflow v5 and extended netflows)