HIVE-AI Live Snapshot Dataset: 500 Captured Attack Events Against Five LLM API Facades (26 April 2026)

This dataset is the supplementary material accompanying the paper "HIVE-AI: A Defended Multi-Service Honeypot Framework for Generative AI APIs" (Vargas Yáñez & Tobón, 2026), submitted to the International Journal of Information Security (Springer). It contains a frozen snapshot of 500 attack events captured by the HIVE-AI production honeypot deployment at honeypot.ttpsec.cl:4443/api/public/livemap on 26 April 2026 at 12:48 UTC. The window spans approximately 19 hours (2026-04-25 17:18 UTC to 2026-04-26 12:12 UTC) and includes the four distinct attacker-payload patterns documented in §6.6 of the manuscript: — Pattern A: Mirai-variant remote-code-execution attempts via the OpenAI facade— Pattern B: Server-side prototype-pollution chain matching CVE-2025-55182 (React2Shell), exhibiting cross-facade probing across Claude, HuggingFace, and OpenAI from the same boundary IP— Pattern C: Ollama model-availability enumeration from CN-origin scanning networks— Pattern D: Tool-call abuse through OpenAI-compatible /v1/chat/completions endpoint targeting OWASP LLM07 The snapshot complements the paper's principal empirical findings (16,683 attacks captured over 20 days from 1,229 unique source IPs in 50 countries) by providing a reviewer-verifiable evidence base for the operational documentation in §6.6. Reviewers can independently reproduce all four pattern descriptions by filtering this JSON file with the Python snippets provided in the manuscript's supplementary README. DATASET STRUCTURE JSON file with top-level keys:- total: 17,064 (cumulative deployment count at snapshot time)- geo_total: 17,056 (events with geolocation)- countries: 50 (distinct source countries)- events: array of 500 event objects Each event object contains:- id: Unique event identifier- ts: ISO 8601 timestamp (UTC)- service: Honeypot facade — one of {openai, claude, ollama, huggingface, clawbot}- category: Rule-based classifier output — one of {reconnaissance, api_abuse, fuzzing, model_enumeration, generic_probe, prompt_injection}- method: HTTP method (GET, POST, CONNECT)- path: HTTP request path- country: ISO 3166-1 alpha-2 country code (MaxMind GeoLite2)- city: City name (MaxMind GeoLite2)- lat, lng: Latitude / Longitude- asn_org: Autonomous System Organization (where available)- threat: Threat score (integer 0–100)- payload: Attacker request body, anonymized (credentials, tokens, and email addresses redacted)- ip_masked: Source IP address with /24 boundary masking PRIVACY AND ANONYMIZATION Source IP addresses are masked at the /24 network boundary. Credentials, API tokens, and email addresses observed in payloads are redacted before publication. The full 16,683-event production dataset is not redistributed in this snapshot due to the volume of partially identifying metadata; aggregated statistics for the full dataset are accessible from the public read-only API at https://honeypot.ttpsec.cl:4443/api/public/. LICENSE Creative Commons Attribution 4.0 International (CC BY 4.0). You are free to share and adapt the material under the terms of the license, provided proper attribution is given. CITATION Vargas Yáñez, S., & Tobón, S. (2026). HIVE-AI Live Snapshot Dataset: 500 Captured Attack Events Against Five LLM API Facades (26 April 2026) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.PENDING If you use this dataset in your research, please cite both the dataset and the accompanying manuscript. RELATED RESOURCES - Source code: https://github.com/ttpsec/hive-ai (MIT License)- Live API: https://honeypot.ttpsec.cl:4443/api/public/livemap- Manuscript: International Journal of Information Security (Springer), 2026 (under review) ETHICAL STATEMENT All captured data originates from unsolicited probes against a publicly advertised research honeypot. Source IPs probing public infrastructure have no reasonable expectation of privacy. The deployment was reviewed against the Menlo Report (Dittrich & Kenneally, 2012) prior to becoming operational and is registered with the institutional research office at Universidad de Santiago de Chile (USACH). CONTACT Corresponding author: Prof. Sergio Tobón — [e-mail] author: Sebastián Vargas Yáñez — [e-mail]