Traffic Data from Kyoto University's Honeypots

New version data (Nov. 01, 2006 - Dec. 31, 2015) [with IP addresses (sanitized), with Bro 2.4]

• New data (Nov. 01, 2006 - Dec. 31, 2015)
  • Document which describes data format of New version data.
  • Bro 2.4 based session extraction.
  • Based on new IDS detection result.
  • We recommend you to use this data if you do not have special reason.
• Bro 2.4 based extended old data (Nov. 01, 2006 - Dec. 31, 2013)
  • Bro 2.4 based session extraction.
  • Based on old IDS detection result.

Trial Generation of new version on ICSS(Nov. 2016) [with IP addresses (sanitized), with Bro 2.4]

• Discussion about session data construction method difference between Bro versions and its effect to machine larning NIDS methods.(in Japanese)
• DATA (Nov. 01, 2006 - Dec. 31, 2009)

[With IP addresses (sanitized)]

• Document (ver.5, 2010625) which describes data format.
• DATA (Nov. 01, 2006 - Aug. 31, 2009)

[Without IP addresses (previous version)]

• Document (ver.3, 20090910) which describes data format.
• DATA (Nov. 01, 2006 - Aug. 31, 2009)

Deployed systems

• Honeypots

  Solaris 8 for Intel

  Windows XP (no patch, SP2, fully patched)

  Nepenthes

  Others

• Darknet

  Darknet sensors

• Other systems

Mail server (to collect various types of mails)

Web crawler (developed by NTT Information Sharing Platform Laboratories)

Windows XP (to evaluate malware activities)