CTU Hornet 65 Niner: A Network Dataset of Geographically Distributed Low-Interaction Honeypots

CTU Hornet 65 Niner is a dataset of 65 days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots were placed in nine different geographical locations: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore, and Sydney. The data was captured from April 28th to July 1st, 2024. The nine cloud servers were created and configured following identical instructions using Ansible [1] in DigitalOcean [2] cloud provider. The network capture was performed using the Zeek [3] network monitoring tool, which was installed on each cloud server. The cloud servers had only one service running (SSH on a non-standard port) and were fully dedicated to being used as a honeypot. No honeypot software was used in this dataset. The dataset is composed of nine scenarios: - Honeypot-Cloud-DigitalOcean-Geo-1: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-2: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-3: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-4: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-5: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-6: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-7: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-8: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files - Honeypot-Cloud-DigitalOcean-Geo-9: has 65 folders (YYYY-MM-DD), each containing 24 Zeek conn.log files and other Zeek files References: [1] Ansible IT Automation Engine, https://www.ansible.com/. Accessed on 08/28/2024. [2] DigitalOcean, https://www.digitalocean.com/. Accessed on 08/28/2024. [3] Zeek Documentation, https://docs.zeek.org/en/master/index.html. Accessed on 08/28/2024.CTU Hornet 65 Niner是一款涵盖65天网络攻击流量数据的数据集，其采集自用作蜜罐（honeypot）的云服务器，旨在探究地理位置对网络攻击流入量的影响。本次部署的蜜罐分布于9个不同地理位置：阿姆斯特丹、伦敦、法兰克福、旧金山、纽约、新加坡、多伦多、班加罗尔及悉尼。数据采集周期为2024年4月28日至2024年7月1日。 该9台云服务器均通过Ansible[1]在DigitalOcean[2]云服务商平台上，依照统一配置指令完成创建与部署。网络流量捕获工作借助Zeek[3]网络监控工具实现，该工具部署于每台云服务器之上。所有云服务器仅运行一项服务（非标准端口的SSH服务），且完全专用于蜜罐功能，本数据集未使用任何专用蜜罐软件。 本数据集包含9个场景： - Honeypot-Cloud-DigitalOcean-Geo-1：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-2：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-3：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-4：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-5：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-6：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-7：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-8：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 - Honeypot-Cloud-DigitalOcean-Geo-9：包含65个以YYYY-MM-DD格式命名的文件夹，每个文件夹内均包含24个Zeek的conn.log文件及其他Zeek生成文件 参考文献： [1] Ansible IT自动化引擎（Ansible IT Automation Engine），https://www.ansible.com/，2024年8月28日访问。 [2] DigitalOcean，https://www.digitalocean.com/，2024年8月28日访问。 [3] Zeek官方文档（Zeek Documentation），https://docs.zeek.org/en/master/index.html，2024年8月28日访问。