Hornet 7: Network Dataset of Geographically Placed Honeypots

Hornet 7 is a dataset of seven days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots were placed in eight different geographical locations: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore. The data was captured in April 2021. The eight cloud servers were created and configured simultaneously following identical instructions. The network capture was performed using the Argus network monitoring tool in each cloud server. The cloud servers had only one service running (SSH on a non-standard port) and was fully dedicated to be used as a honeypot. No honeypot software was used in this dataset. The dataset consists of eight scenarios, one for each geographically located cloud server. Each scenario contains bidirectional NetFlow files in the following format: - hornet7-biargus.tar.gz: all scenarios with bidirectional NetFlow files in Argus binary format; - hornet7-netflow-v5.tar.gz: all scenarios with bidirectional NetFlow v5 files in CSV format; - hornet7-netflow-extended.tar.gz: all scenarios with bidirectional NetFlows files in CSV format containing all features provided by Argus. - hornet7-full.tar.gz: download all the data (biargus, netflow v5 and extended netflows)Hornet 7是一个为期七天的网络流量攻击数据集，其采集自用作蜜罐（honeypot）的云服务器，旨在探究地理区位因素对网络攻击流入规模的影响。本次部署的蜜罐覆盖8个不同地理区域：阿姆斯特丹、伦敦、法兰克福、旧金山、纽约、新加坡、多伦多、班加罗尔。数据采集于2021年4月。这8台云服务器按照完全统一的配置流程同步创建并完成部署。每台云服务器均通过Argus网络监控工具开展网络流量捕获工作。所有云服务器仅运行一项服务：非标准端口下的SSH（Secure Shell，安全外壳协议），且完全专用于蜜罐部署。本数据集未搭载任何专用蜜罐软件。该数据集共包含8个场景，每个场景对应一个地理区位的云服务器。每个场景均包含双向NetFlow（网络流）文件，具体格式如下： - hornet7-biargus.tar.gz：包含所有场景的Argus二进制格式双向NetFlow文件； - hornet7-netflow-v5.tar.gz：包含所有场景的CSV格式双向NetFlow v5文件； - hornet7-netflow-extended.tar.gz：包含所有场景的CSV格式双向NetFlow扩展文件，涵盖Argus提供的全部特征字段； - hornet7-full.tar.gz：可下载包含全部数据（biargus格式、NetFlow v5格式及扩展NetFlow格式文件）的压缩包。