Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Descriptor: Multi-Regional Cloud Honeypot Dataset (MURHCAD)

Enrique Feito-Casares, Ismael Gómez-Talal, José-Luis Rojo-Álvarez

TL;DR

This data article introduces a comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors and provides actionable guidance for researchers seeking to leverage this dataset in anomaly detection, protocol-misuse studies, threat intelligence, and defensive policy design.

Abstract

This data article introduces a comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors. Collected over a continuous 72-hour window (June 9 to 11, 2025) on Microsoft Azure, the dataset comprises 132,425 individual attack events captured by three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. Each event record includes enriched metadata (UTC timestamps, source/destination IPs, autonomous system and organizational mappings, geolocation coordinates, targeted ports, and honeypot identifiers alongside derived temporal features and standardized protocol classifications). We provide actionable guidance for researchers seeking to leverage this dataset in anomaly detection, protocol-misuse studies, threat intelligence, and defensive policy design. Descriptive statistics highlight significant skew: 2,438 unique source IPs span 95 countries, yet the top 1% of IPs account for 1% of all events, and three protocols dominate: Session Initiation Protocol (SIP), Telnet, Server Message Block (SMB). Temporal analysis uncovers pronounced rush-hour peaks at 07:00 and 23:00 UTC, interspersed with maintenance-induced gaps that reveal operational blind spots. Geospatial mapping further underscores platform-specific biases: SentryPeer captures concentrated SIP floods in North America and Southeast Asia, Cowrie logs Telnet/SSH scans predominantly from Western Europe and the U.S., and Dionaea records SMB exploits around European nodes. By combining fine-grained temporal resolution with rich, contextual geolocation and protocol metadata, this standalone dataset aims to empower reproducible, cloud-scale investigations into evolving cyber threats. Accompanying analysis code and data access details are provided.

Descriptor: Multi-Regional Cloud Honeypot Dataset (MURHCAD)

TL;DR

This data article introduces a comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors and provides actionable guidance for researchers seeking to leverage this dataset in anomaly detection, protocol-misuse studies, threat intelligence, and defensive policy design.

Abstract

This data article introduces a comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors. Collected over a continuous 72-hour window (June 9 to 11, 2025) on Microsoft Azure, the dataset comprises 132,425 individual attack events captured by three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. Each event record includes enriched metadata (UTC timestamps, source/destination IPs, autonomous system and organizational mappings, geolocation coordinates, targeted ports, and honeypot identifiers alongside derived temporal features and standardized protocol classifications). We provide actionable guidance for researchers seeking to leverage this dataset in anomaly detection, protocol-misuse studies, threat intelligence, and defensive policy design. Descriptive statistics highlight significant skew: 2,438 unique source IPs span 95 countries, yet the top 1% of IPs account for 1% of all events, and three protocols dominate: Session Initiation Protocol (SIP), Telnet, Server Message Block (SMB). Temporal analysis uncovers pronounced rush-hour peaks at 07:00 and 23:00 UTC, interspersed with maintenance-induced gaps that reveal operational blind spots. Geospatial mapping further underscores platform-specific biases: SentryPeer captures concentrated SIP floods in North America and Southeast Asia, Cowrie logs Telnet/SSH scans predominantly from Western Europe and the U.S., and Dionaea records SMB exploits around European nodes. By combining fine-grained temporal resolution with rich, contextual geolocation and protocol metadata, this standalone dataset aims to empower reproducible, cloud-scale investigations into evolving cyber threats. Accompanying analysis code and data access details are provided.
Paper Structure (13 sections, 5 figures, 5 tables)

This paper contains 13 sections, 5 figures, 5 tables.

Table of Contents

  1. BACKGROUND
  2. COLLECTION METHODS AND DESIGN
  3. VALIDATION AND QUALITY
  4. RECORDS AND STORAGE
  5. INSIGHTS AND NOTES
  6. SOURCE CODE AND SCRIPTS
  7. ACKNOWLEDGEMENTS AND INTERESTS

Figures (5)

  • Figure 1: Global Azure-based hub-and-spoke honeynet architecture containing four exposed sensor virtual machines, each within its virtual network, all peered to a central honeynet hub virtual network hosting the hive virtual machine and a VPN Gateway.
  • Figure 2: Temporal patterns of cyberattacks. (a) Evolution of attack types over time, highlighting peaks for Dionaea and SentryPeer. (b) Attack intensity across virtual machines, with vm-centralus being notably targeted.
  • Figure 3: Visualizations of attack patterns. (a) Diurnal trends show peaks at 07:00 and 23:00 UTC. (b) Protocols abused by each honeypot type, with SIP notably exploited by SentryPeer.
  • Figure 4: Heatmap showing number of attacks by hour and attack type. Peak for Dionaea observed at 07:00 UTC.
  • Figure 5: Global distribution of cyberattacks by honeypot platform and country of origin. Circle size is proportional to the total number of attacks from each country, and color indicates the honeypot type: green (SentryPeer), red (Cowrie), and blue (Dionaea).