Hornet 40: Network dataset of geographically placed honeypots

Deception technologies, and honeypots in particular, have been used for decades to understand how cyber attacks and attackers work. A myriad of factors impact the effectiveness of a honeypot. However, very few is known about the impact of the geographical location of honeypots on the amount and type of attacks. Hornet 40 is the first dataset designed to help understand how the geolocation of honeypots may impact the inflow of network attacks. The data consists of network flows in binary and text format, with up to 118 features, including 480 bytes of the content of each flow. They were created using the Argus flow collector. The passive honeypots are IP addresses connected to the Internet and do not have any honeypot software running, so attacks are not interactive. The data was collected from identically configured honeypot servers in eight locations: Amsterdam, Bangalore, Frankfurt, London, New York, San Francisco, Singapore, and Toronto. The dataset contains over 4.7 million network flows collected during forty days throughout April, May, and June 2021.

© 2022 The Authors. Published by Elsevier Inc. This is an open access article under the CC BY-NC-ND license ( http://creativecommons.org/licenses/by-nc-nd/4.0/ ) Table   Subject Computer Science Specific subject area Honeypots network cybersecurity attacks Type of data Binary Table  Figure How the data were acquired

Specifications
The network flows were collected by running Argus network flow collectors [1] on the network interfaces of geographically distributed cloud servers. Data format Raw Filtered Parameters for data collection Argus network traffic flow collectors run directly on the network interface of each honeypot and store all the received traffic into files. Administration connections were filtered out by deleting the traffic with the IP addresses used for administration. Description of data collection The network flow data was collected for forty days, from April 23rd, 2021 to June 1st, 2021, using the Argus network traffic flow collector previously installed in each honeypot. Argus captures all the packets on the network interfaces of the honeypots to generate the flows. During this time, approximately 4.7 million flows were captured in total. The network connections used to administer the honeypots were filtered out from the dataset. Data source location The data was collected from eight cloud servers used exclusively as honeypots from the Digital Ocean [2]  Value of the Data • The Hornet 40 dataset contains a unique collection of network flows, considered attacks from geographically distributed honeypots. It is useful for statistical and behavioral analysis of identically configured honeypots located in different geographical locations and regions. • The data can benefit security practitioners, machine learning researchers, and statisticians working on network analysis, cyber security, or threat intelligence. It may also benefit network providers and antivirus companies. Data can be used to track attackers, to understand their origin, to understand changes in attacks patterns. • The large amount of network flows can be used to evaluate and develop better attack detection mechanisms. • The geography factor can be further used to evaluate better location placement of servers to reduce the number of attacks received by production servers.

Data Description
The Hornet 40 [3] dataset contains forty days of raw flow data, captured from eight cloud Linux passive honeypot servers. In this paper 'raw flow data' refers to network flows generated by a network flow collector from raw network data. Raw network data are the packets in the network.
Each honeypot was located in a different city in the regions of North America, Asia, and Europe. The cities were chosen from the available locations by the cloud provider Digital Ocean [2] . No honeypot software was running on the Linux servers, but each IP address received connections from the Internet.
The raw flow data was captured using the Argus network flow collector from April 23rd, 2021 to June 1st, 2021. The dataset contains a total of 4,758,657 bidirectional flows, generated by a total of 266,678 unique source IP addresses. A bidirectional network flow is an aggregation of features of all the packets in a network connection. It aggregates packets from both directions: from source IP to destination IP, and from destination IP to source IP.
The Argus flows have 118 features including 480 bytes of the content of the connection in both directions. Argus generates one binary flow file per day per honeypot. These binary files contain all the flows for that day. From this binary flow file, two more ASCII files were exported in CSV format, one with NetFlow v5 features, and other with up to 118 Argus features.
The Hornet 40 dataset consists of three main groups of files: one for the binary bidirectional Argus files (biargus), one for the ASCII files with NetFlow v5 features, and one for the ASCII files extended with up to 118 Argus features. Each of these groups is separated per honeypot, each separation per honeypot containing 40 files, one per day. The folders and file structure of the Hornet 40 dataset is as follows: All source IP addresses (from now on Src IPs) communicating with the honeypots are considered attacking IPs, due to one of the definitions of honeypots: since a honeypot is not an authorized production service, nobody should connect to it, and therefore all connections are considered attacks [4] . The main difficulty of this definition is how to consider the scanning activities of companies and organizations mapping the Internet for probable benign purposes. In this paper we still consider these benign scans as attacks, since (i) they are unsolicited, or (ii) the data collected may be sold, or (iii) used by attackers later, or (iv) use in marketing campaigns and advertising. Moreover, it is not technically feasible to filter out some of these scans based on organizations names or IP ranges, especially since many scans may be done from shared cloud providers.  The Hornet 40 dataset contains a total of 4,758,657 network flows, containing 11,794,754 packets and 1,254,838,795 bytes, originating from 266,678 unique Src IPs. Table 1 provides a general overview of the Hornet 40 dataset per honeypot, including its location, the total unique source IPs, the total flows, the total bytes, and the total packets. Table 2 compares the number of connections per network protocol per honeypot.
To understand how the raw flow data is distributed in time, Fig. 1 shows the hourly traffic distribution per honeypot during the duration of the capture. The number of flows is displayed in logarithmic scale.

Argus binary network flows
The raw flow data capture on the network interface of each honeypot was performed using the Argus network flow system [1] version 3.0.8.2. Argus stores raw flow data in a binary format that includes 118 features (e.g., total amount of bytes), and the first 480 bytes of the application content in each direction in the connection (to the honeypot, and from the honeypot). The number of features included in the binary Argus will change depending on the Argus version. These application content bytes are gathered by concatenating the content of the packets on each direction of each connection, until reaching 480 bytes. The full list of features is described in Table 3 . The binary format is highly convenient due to its high compression and thus low final size. The binary files can be read and processed using Argus client tools to generate any desired output. The

ASCII flows using NetFlow v5 features
The Argus binary flow files were processed to generate flow files compatible with the Net-Flow v5 standard [5] . This format is widely used, allowing to easily use and analyze data in CSV format. The NetFlow file is a format transformation from the original Argus file.

ASCII flows using Argus features
The Argus binary flow files were processed to generate files compatible with the NetFlow standard but with an extended number of features. These ASCII extended file are a format transformation from the original Argus file.
The Hornet 40 dataset contains one file for the extended flows, called hornet40-netflow-extended.tar.gz , that includes all the flows in the eight scenarios, and for each flow, it has all the 118 features described in Table 3 .

Network features
The complete list of the 118 features in the biargus and flow extended files of the Hornet 40 dataset is shown in Table 3 .

Experimental design, materials and methods
The dataset was collected from cloud server instances. The cloud server provider chosen for this dataset was Digital Ocean [2] . All cloud servers, have the same technical specifications: • Operating System: Ubuntu 20.04LTS • Capacity: 1GB / 1 Intel CPU • Storage: 25 GB NVMe SSDs • Transfer capacity: 10 0 0 GB transfer  The honeypots were created within the same hour of the same day. Once created, the servers were configured simultaneously using the open-source tools parallel-ssh and parallel-scp . Each honeypot has its own public IP address assigned, which has not changed during the data capture. The steps to create and configure the honeypots were as follows: • Create one honeypot per available region in Digital Ocean with the technical specifications listed above.
• Store the list of public IPs from the honeypots in a text file named hosts .
• Update the software repository of all honeypots simultaneously using parallel-ssh: pssh -h hosts -l root -o output/ "apt update'', where hosts contains the list of IP addresses of the honeypots, -l root specifies the SSH user name, -o output/ the folder where to store the results, and "apt update '' is the command that will be executed in parallel in the honeypots.
• Install the Argus network collector tool: pssh -h hosts -l root -o output/ "apt install -yq argus-client argus-server ''. The Argus version 3.0.8.2 was used. The Argus and rasplit tools produce raw flow data files from each honeypot. The binary raw flow data can be read using the ra tool provided in the Argus-clients suite. The command to read the files is: ra -F /etc/ra.conf -n -Z b -r 2021-04-23_honeypot-cloud-digitaloceangeo-1.biarguswhere -F specifies the configuration file to use (see Subsection Ra Configuration ), -n avoids resolving port numbers to service names, -Z modifies the status field to show TCP flag values, -r specifies which file to read from, and -sends the output to the standard output in the terminal.

SSH configuration for administration of the honeypots
The honeypots are configured to be remotely administered using the SSH protocol.

Ethics Statements
The work did not involve any human subject or animal experiments. The Hornet 40 dataset files were analyzed by more than 50 Antivirus systems in VirusTotal and as of January 2021 it does not trigger any detection.

Declaration of Competing Interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.