Skip to main Communities My dashboard Log in Sign up There is a newer version of the record available. Published April 17, 2026 | Version v1 Dataset Open A 6-Month Dataset of SSH Botnet Interactions and Command Payloads Authors/Creators Boiko, Viktor (Project leader) 1 Niiakyi, Oleksandr (Researcher) 1 Show affiliations 1. National University Odesa Law Academy Description Overview This dataset contains 145,499 records of granular interactive logs collected by a specialized asynchronous SSH Honeypot. The data was captured over a six-month period (May 11, 2025 – November 14, 2025) and reflects real-world automated and manual attack patterns against Linux-based systems. Research Context The collection was conducted as part of the study "Adaptive Decoy Systems for Preemptive Detection of Cyber Threats in Web Environments" at the National University "Odesa Law Academy" . The project focuses on improving the cyber resilience of critical web systems through dynamic management of resource-intensive traps (Tarpits). Authors and Contributions Viktor Boiko (ORCID: 0000-0001-5929-657X) — Scientific Supervisor & Lead Researcher. Associate Professor at the Department of Cybersecurity. Oleksandr Niiakyi (ORCID: 0009-0005-1025-1617) — Software Developer & Researcher. Affiliation Faculty of Cybersecurity and Information Technologies, National University "Odesa Law Academy" . Technical Specifications Architecture: Asynchronous Python-based SSH server. Log Fidelity: Full reconstruction of the attacker's "kill chain" via unique session tracking (UUID). Payload Capture: Comprehensive shell command logging, including malware droppers and fileless execution attempts (via /dev/tcp ). Key Research Findings Interactive Payloads: Capture of post-login behavior and complex automated scripts. Brute Force Intelligence: Analysis of over 1,500 unique credential pairs, including default IoT passwords and botnet-specific identifiers. Temporal Dynamics: Identification of daily attack cycles with significant spikes around 13:00 UTC. Data Structure Fields include: timestamp , session_id , ip , port , event_type , command , message , and level . Usage and Licensing Intended for academic research in Cybersecurity, IDS Machine Learning, and Threat Intelligence. License: Creative Commons Attribution 4.0 International (CC BY 4.0). Files README.md Files (15.1 MB) Name Size Download all honey.db.tar.gz md5:9e90fb66f1097b3f0aa1256210b1dc88 7.9 MB Download README.md md5:a99e970a2715a48e3cbd5f235e22d503 3.0 kB Preview Download ssh_attack_dataset_2025.csv.tar.gz md5:0767d2a4dc151adac38b1f3849f57467 7.3 MB Download 456 Views 373 Downloads Show more details All versions This version Views Total views 456 49 Downloads Total downloads 373 43 Data volume Total data volume 2.1 GB 224.5 MB More info on how stats are collected.... Versions External resources Indexed in OpenAIRE Communities Keywords and subjects Keywords Cybersecurity SSH Honeypot Botnet Analysis Threat Intelligence Intrusion Detection Open Data Details DOI DOI Badge DOI 10.5281/zenodo.19629701 Markdown [](https://doi.org/10.5281/zenodo.19629701) reStructuredText .. image:: https://zenodo.org/badge/DOI/10.5281/zenodo.19629701.svg :target: https://doi.org/10.5281/zenodo.19629701 HTML <a href="https://doi.org/10.5281/zenodo.19629701"><img src="https://zenodo.org/badge/DOI/10.5281/zenodo.19629701.svg" alt="DOI"></a> Image URL https://zenodo.org/badge/DOI/10.5281/zenodo.19629701.svg Target URL https://doi.org/10.5281/zenodo.19629701 Resource type Dataset Publisher Zenodo Rights License Creative Commons Attribution 4.0 International The Creative Commons Attribution license allows re-distribution and re-use of a licensed work on the condition that the creator is appropriately credited. Read more Citation Export Technical metadata Created April 17, 2026 Modified April 17, 2026 Jump up About About Policies Infrastructure Principles Projects Roadmap Contact Blog Blog Support Help FAQ Developers REST API OAI-PMH Contribute GitHub Donate Funded by Powered by CERN Data Centre & InvenioRDM Status Privacy policy Cookie policy Terms of Use This site uses cookies. Find out more on how we use cookies Accept all cookies Accept only essential cookies