Descriptor: Multi-Regional Cloud Honeypot Dataset (MURHCAD)
Enrique Feito-Casares, Ismael G\'omez-Talal, Jos\'e-Luis Rojo-\'Alvarez

TL;DR
This paper presents a detailed, high-resolution honeynet dataset collected across multiple regions, enabling comprehensive analysis of global cyberattack behaviors with rich metadata and temporal features.
Contribution
It introduces a novel, publicly available multi-regional honeypot dataset with extensive metadata, supporting diverse cybersecurity research and analysis.
Findings
Significant skew in attack sources, with 95 countries represented.
Temporal peaks at 07:00 and 23:00 UTC indicate attack rush hours.
Geospatial analysis reveals platform-specific attack patterns.
Abstract
This data article introduces a comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors. Collected over a continuous 72-hour window (June 9 to 11, 2025) on Microsoft Azure, the dataset comprises 132,425 individual attack events captured by three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. Each event record includes enriched metadata (UTC timestamps, source/destination IPs, autonomous system and organizational mappings, geolocation coordinates, targeted ports, and honeypot identifiers alongside derived temporal features and standardized protocol classifications). We provide actionable guidance for researchers seeking to leverage this dataset in anomaly detection, protocol-misuse studies, threat intelligence, and defensive policy design. Descriptive statistics…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
