Deployment of 160 Cowrie SSH honeypot instances across four distinct configurations

This dataset contains unsolicited SSH interactions collected over a continuous 50-day period using 160 Cowrie honeypot instances deployed concurrently across 14 countries in Europe, North America, Asia, and Australia. To enable configuration-aware comparative analysis, four distinct honeypot configurations were operated in parallel: a default Baseline, an Enhanced hardened setup, and two persistence-enabled environments providing per-user and global filesystem state. Except data itself, the repository contains all the schems, description and link for Github repository with all relevant information about usage of Data (creation and populating of database, example usage and more). Dataset Overview: Scale: Over 211 million Cowrie event records and 38 million SSH sessions. Sources: Interactions originating from more than 214,000 unique source IP addresses. File Artifacts: 1,770 unique transferred file artifacts (deduplicated by SHA-256) captured during attacker interactions. Format: Event-level and session-level logs are provided in compressed JSON/JSONL format. Dataset structure: data_all.zip - Archive with 51 files containing log from separate days. session_aggregation.jsonl.gz- Aggregated sessions data from logs. malformed.txt - All malformed logs collected during deployment. transferred_files.zip - 1770 files downloaded or uploaded by remote actors, named by SHA256 hashes. transferred_files_metadata.csv - Metadata relevant to transferred files mapped by SHA256 hashes. ! Important Security Warning: The transferred_files.zip archive contains concrete file payloads uploaded by attackers during honeypot interactions. These files are potentially malicious. For safety, they are packaged in individual password-protected archives (password: infected) and named by their SHA-256 hashes. These files should be accessed and analyzed exclusively within isolated and execution-restricted environments. Code Availability: Supporting code for data ingestion (ELK/ClickHouse), example usage and honeypot configurations can be found at: https://github.com/matusmikulas/COW160x4_dataset. Dataset schemas: This section description of 3 schemas associated with: transferred_files_metadata.csv (Table 1.) session_aggregation.jsonl.gz (Table 2.) data_all.zip (Table 3.) Table 1. transferred_files_metadata.csv data schema No. Property Description 1 sha256 SHA-256 hash of file 2 file_type File type determined by Linux file utility 3 size_bytes Size of file in bytes 4 creation_date Date of file creation on filesystem 5 count Number of occurrences across all honeypots instances 6 in_downloads File present in downloaded files set 7 in_logs File present in logs Table 2. session_aggregation.jsonl.gz data schema No. Property Description 1 session Session identifier 2 src_ip Client source IP address in anonymized form 3 honeypot_ip Honeypot instance IP address in anonymized form 4 first_seen First timestamp seen for associated session identifier 5 last_seen Last timestamp seen for associated session identifier 6 total_events Total count of events for associated session identifier 7 cnt_client_fingerprint Count of cowrie.client.fingerprint events 8 cnt_client_kex Count of cowrie.client.kex events 9 cnt_client_size Count of cowrie.client.size events 10 cnt_client_var Count of cowrie.client.var events 11 cnt_client_version Count of cowrie.client.version events 12 cnt_command_failed Count of cowrie.command.failed events 13 cnt_command_input Count of cowrie.command.input events 14 cnt_command_success Count of cowrie.command.success events 15 cnt_direct_tcpip_data Count of cowrie.direct-tcpip.data events 16 cnt_direct_tcpip_request Count of cowrie.direct-tcpip.request events 17 cnt_file_download Count of cowrie.file.download events 18 cnt_file_download_failed Count of cowrie.file.download events 19 cnt_file_upload Count of cowrie.file.upload events 20 cnt_log_closed Count of cowrie.log.closed events 21 cnt_login_failed Count of cowrie.login.failed events 22 cnt_login_success Count of cowrie.login.success events 23 cnt_session_closed Count of cowrie.session.closed events 24 cnt_session_connect Count of cowrie.session.connect events 25 cnt_session_params Count of cowrie.session.params events Table 3. data_all.zip data schema No. Property Description 1 arch CPU architecture and operating system profile emulated by the Cowrie 2 compCS Compression lib used by SSH 3 data Raw payload transmitted during direct-tcpip redirection events 4 destfile Destination filename specified by the attacker during file download operations 5 dst_ip Destination IP address, representing either the internal honeypot address or the redirection target in port-forwarding activity 6 dst_port Destination port associated with the internal honeypot service or redirection target 7 duration Total session duration in seconds 8 encCS Encryption (cipher) algorithms supported by the SSH client during handshake (client-to-server direction). 9 eventid Identifier of the Cowrie event type 10 filename Filename used during file upload operations. 11 fingerprint SSH public key fingerprint associated with authentication attempts. 12 group Cowrie configuration group 13 hassh MD5 hash of SSH client list calculated from hasshAlgorithms 14 hasshAlgorithms Concatenated ordered list of kexAlgs, encCS, macCS used to compute the HASSH fingerprint 15 height Terminal height (in character rows) reported by the SSH client 16 honeypot_ip Anonymized IP address of the honeypot instance receiving the connection 17 honeypot_ip_geoip_asn_number Autonomous System Number (ASN) associated with the honeypot IP address 18 honeypot_ip_geoip_asn_org Organization associated with the honeypot IP address ASN 19 honeypot_ip_geoip_city_name City associated with the honeypot IP address 20 honeypot_ip_geoip_country_iso_code ISO country code of the honeypot IP address 21 honeypot_ip_geoip_country_name Country associated with the honeypot IP address 22 honeypot_ip_geoip_location Geographic coordinates (latitude, longitude) of the honeypot IP address 23 honeypot_ip_geoip_region_name Administrative region associated with the honeypot IP address 24 id Identifier associated with direct-tcpip redirection request events 25 input Command string executed by the SSH client within the emulated shell environment. 26 kexAlgs Key exchange algorithms supported by the SSH client during handshake 27 Key SSH public key provided during public key authentication attempts 28 keyAlgs Public key algorithms supported by the SSH client 29 langCS Language preferences advertised by the SSH client (client-to-server direction) 30 macCS Message Authentication Code (MAC) algorithms supported by the SSH client during handshake (client-to-server direction) 31 message Human-readable log message generated by Cowrie for the event 32 name Name of an environment variable forwarded by the SSH client during session initialization 33 outfile Local filename assigned by Cowrie when storing a transferred file 34 password Password string used during authentication attempts 35 protocol Application layer protocol used for communication 36 realm Optional command execution context label recorded for a subset of cowrie.command.input events 37 sensor Identifier of the honeypot sensor instance generating the log record 38 session Unique session identifier assigned by Cowrie for each SSH connection 39 shasum SHA-256 hash of a transferred file artifact 40 size Size associated with Cowrie TTY session recording log 41 src_ip Anonymized source IP address of the connecting client 42 src_ip_geoip_asn_number Autonomous System Number (ASN) associated with the source IP address 43 src_ip_geoip_asn_org Organization associated with the source IP address ASN 44 src_ip_geoip_city_name City associated with the source IP address 45 src_ip_geoip_country_iso_code ISO country code of the source IP address 46 src_ip_geoip_country_name Country associated with the source IP address 47 src_ip_geoip_location Geographic coordinates (latitude, longitude) of the source IP address 48 src_ip_geoip_region_name Administrative region associated with the source IP address 49 src_port Source TCP port used by the client 50 ts Event timestamp in UTC with microsecond precision (as recorded by Cowrie) 51 ts_indexed Timestamp of ingestion into the centralized logging infrastructure (UTC, millisecond precision) 52 type SSH key algorithm type associated with a public key authentication 53 url URL referenced by the attacker during file download operations 54 username Username string used during authentication attempts 55 value Corresponding value of the forwarded environment variable for cowrie.client.var events 56 version SSH client identification string (SSH banner) advertised during connection setup 57 width Terminal width (in character columns) reported by the SSH client