SIP_scanning_2016 (08/29/2016 to 08/29/2016)

This real-world dataset inlcludes several instances of malicious scanners that were attempting connections to the SIP port on many hosts within Merit Network. In particular, the SIP OPTIONS "ping" was being employed. More info for SIP OPTIONS ping can be found here: http://www.voip-info.org/wiki/view/SIP+method+options. This is a Netflow dataset, that contains the SIP malicious activity intermixed with regular/normal communication flows. Flows collected at Merit's monitoring location in Detroit. This is an anonymized dataset (last 11 bits of each IP stripped to zero).

本真实世界数据集包含多起恶意扫描器尝试连接Merit网络内众多主机的会话初始协议（Session Initiation Protocol，简称SIP）端口的事件。具体而言，该类扫描器采用了SIP OPTIONS "ping"探测方式。更多关于SIP OPTIONS ping的详细信息可访问以下链接：http://www.voip-info.org/wiki/view/SIP+method+options。本数据集属于Netflow数据集，其中混杂了SIP恶意活动与常规/正常通信流。数据流采集自Merit网络位于底特律的监测节点。本数据集为匿名化数据集（每个IP地址的最后11比特位均被置零）。