Dataset for "DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure"

DICOMHawk (+Dicompot) Deployment Data

This repository contains the data of the paper "DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure".

The data is pseudo-anonymized by replacing IPs with a unique identifier (ID_X) to comply with GDPR, but keep the relationship between the given datasets. The files are provided in JSONline format.

Following data is contained:

• [dicompot.jsonl] Dicompot located in the cloud (FRA) and local (University) over a period of 347 days (June 26, 2025, to June 7, 2026)
• [dicomhawk_dicom.jsonl] & [dicomhawk_dicom.jsonl] DICOMHawk with DICOM and Web/PACS endpoint
  • located in cloud (NY) and local for the same 347 days period
  • located in cloud (FRA) added on the 26th of January 2026
  • this include a testing phase where DICOMHawk returned a default pynetdicom identifier (June 26, 2025 until January 25, 2026)
  • the testing phase also contains days with data loss and one significant dataloss (~end of October until November/January depending on instance), where DICOMHawk did not log any events on the DICOM endpoint
• [ip_information.jsonl] IP Information for the IPs observed by DICOMHawk