CyberLab honeynet dataset

This dataset contains all data collected by the CyberLab honeynet experiment, from May 2019 to February 2020.

The experiment was based on the Cowrie honeypot (https://github.com/cowrie/cowrie, versions 1.6.0 and 2.0.2, see below for the timeline) deployed on approximately 50 nodes at different EU and US universities and companies. This number has varied throughout the duration of the experiment due to scaling efforts and the target node availability. All public IP addresses in the dataset are pseudonymized to protect the identity of the destination nodes.

Each file in the dataset is a daily compilation of all connections starting at midnight on that date (date in filename, midnight in UTC time), grouped into "attack sessions". Each event in such a session includes all the data reported by the honeypot software (https://github.com/cowrie/cowrie). The honeypot has been operating in its default (low-interaction) mode using version 1.6.0 from the start of the experiment until November 8, 2019; after that date, we upgraded to Cowrie version 2.0.2, which allowed us to back it by a pool of real Linux instances to provide more convincing high-interaction mode. Results from high-interaction mode are tagged with "sensor:ubuntu_basic_pool". 

Geolocation data was added to Cowrie output messages based on the source IP address.

Field                             Description
===============================   ===========================================================
session_id                        Unique ID of the session
dst_ip_identifier                 Pseudonymized dst public IPv4 of the honeypot node
dst_host_identifier               Obfuscated (pseudonymized) name of the honeypot node
src_ip_identifier                 Obfuscated (pseudonymized) IP address of the attacker
eventid                           Event id of the session in the cowrie honeypot
timestamp                         UTC time of the event
message                           Message of the Cowrie honeypot
protocol                          Protocol used in the cowrie honeypot; either ssh or telnet
geolocation_data/postal_code      Source IP postal code as (determined by logstash)
geolocation_data/continent_code   Source IP continent code (as determined by logstash)
geolocation_data/country_code3    Source IP country code3 (as determined by logstash)
geolocation_data/region_name      Source IP region name (as determined by logstash)
geolocation_data/latitude         Source IP latitude (as determined by logstash)
geolocation_data/longitude        Source IP longitude (as determined by logstash)
geolocation_data/country_name     Source IP full country name (as determined by logstash)
geolocation_data/timezone         Source IP timezone
geolocation_data/country_code2    Source IP country code2
geolocation_data/region_code      Source IP region code
geolocation_data/city_name        Source IP city name
src_port                          Source TCP port
sensor                            Sensor name; serves to identify our experiment config
arch                              Represents the CPU/OS architecture emulated by cowrie
duration                          Session duration in seconds
ssh_client_version                Attacker's SSH client version
username                          Login username; only used for login events
password                          Password; only used for login events
macCS                             HMAC algorithms supported by the client
encCS                             Encryption algorithms supported by the client
kexAlgs                           Key exchange algorithms supported by the client
keyAlgs                           Public key algorithms supported by the client

More detailed description of the fields (with examples) and all subsequent data (after February 2020) can be found at cyber.ltfe.org.