![[ICO]](/icons/blank.gif){kind=icon}
![[PARENTDIR]](/icons/back.gif){kind=icon}
![[TXT]](/icons/text.gif){kind=icon}
Hornet 40 is a dataset of 40 days of network traffic attacks captured in cloud servers used as honeypots to help understand how geography may impact the inflow of network attacks. The honeypots were placed in eight different geographical locations: Amsterdam, London, Frankfurt, San Francisco, New York, Singapore, Toronto, Bangalore. The data was captured through April, May, and June 2021.
The eight cloud servers were created and configured simultaneously following identical instructions. The network capture was performed using the Argus network monitoring tool in each cloud server. The cloud servers had only one service running (SSH on a non-standard port) and was fully dedicated to be used as a honeypot. No honeypot software was used in this dataset.
Honeypot location: Amsterdam
Honeypot IP: 167.71.64.32
Administration IPs: 88.103.231.202,147.32.83.155
Administration Port: 902
Instance OS: Ubuntu 20.04LTS
Instance Capacity: 1GB / 1 Intel CPU
Instance Storage: 25 GB NVMe SSDs
Instance Transfer: 1000 GB transferAll droplets have times in UTC, two hours behind CEST. E.g.: 6AM UTC is 8AM CEST.
To cite this work: "Valeros, Veronica (2021), “Hornet 40: Network Dataset of Geographically Placed Honeypots”, Mendeley Data, V1, doi: 10.17632/tcfzkbpw46.1"
Argus and ra started. Administration SSH is running on port 902/TCP. No honeypot software running. The honeypot is idle.
The description of fields available in the bi-argus files are described at https://www.systutorials.com/docs/linux/man/1-ra/.