Datasetpublic

hookprobe/edge-ids-threats

HookProbe Edge IDS Threat Telemetry Real-world, anonymised threat verdicts from the HookProbe production edge intrusion-detection system. Unlike synthetic lab datasets (CICIDS2017, UNSW-NB15, Kitsune) this is what an actual edge sensor mesh observes on the open internet, labelled by the SENTINEL ensemble (isolation forest + calibrated naive-Bayes) that ships with HookProbe. Sensor: Raspberry Pi edge node + NAPSE AI-native flow classifier Enrichment: RDAP country + ASN lookups… See the full description on the dataset page: https://huggingface.co/datasets/hookprobe/edge-ids-threats.

sourceHugging Facecc-by-4.0updated 26d agoView on Hugging Face

0likes99downloads

Dataset Card

HookProbe Edge IDS Threat Telemetry

Real-world, anonymised threat verdicts from the HookProbe production edge intrusion-detection system. Unlike synthetic lab datasets (CICIDS2017, UNSW-NB15, Kitsune) this is what an actual edge sensor mesh observes on the open internet, labelled by the SENTINEL ensemble (isolation forest + calibrated naive-Bayes) that ships with HookProbe.

—Sensor: Raspberry Pi edge node + NAPSE AI-native flow classifier
—Enrichment: RDAP country + ASN lookups
—Labels: malicious / suspicious / benign with anomaly score 0–1
—Actions: block / throttle / cognitive_block / cognitive_throttle / escalate / alert / monitor / cognitive_none / none — emitted by the CNO cognitive-defense layer. cognitive_* variants indicate the decision came from the CNO synaptic controller rather than the static HYDRA rule path.
—License: CC-BY-4.0 — free for commercial or academic use with attribution
—Canonical URL: https://hookprobe.com/threats/

Schema

`verdicts` (primary)

column	type	description
timestamp_hour	timestamp[s]	UTC, truncated to the hour
srciphash	string(16)	SHA-256(salt ∥ src_ip)[:16]. Pseudonymous.
country	string	ISO-3166-1 alpha-2
asn	uint32	Autonomous-system number (0 if unknown)
asn_name	string	ASN organisation name
anomaly_score	float32	Ensemble output, 0.0 benign – 1.0 malicious
verdict	enum	`malicious` \	`suspicious` \	`benign`
action_taken	enum	see Actions above — 9 possible values

`aggregated` (derived)

column	type	description
date	date32	UTC day
country, asn, asn_name	...	same semantics as primary
threat_count	uint32	total verdicts for that country/asn/day
malicious, suspicious, benign	uint32	per-class counts
avganomalyscore	float32	mean ensemble score

Privacy model

—IPs are hashed with a project salt that is not published. The hash is deterministic across releases so longitudinal analysis of attacker behaviour is preserved, but the mapping is one-way.
—Timestamps are truncated to the hour to prevent correlation against third-party logs with second-precision timestamps.
—No payload data is exposed — only verdicts and enrichment.

Data caveats

—The SENTINEL calibration window (2026-02-22 → 2026-03-09) is excluded by default. During that period the ensemble produced a ~98% false-positive rate, which was fixed in the 9-point SENTINEL release on 2026-03-09. Training on that window would mis-lead downstream models.
—Because the sensor is a single edge node, geographic and ASN distributions reflect what targets that specific deployment — not a global baseline. Treat skew accordingly.

Citation

bibtex

@dataset{hookprobe_edge_ids_threats_2026,
  author  = { {HookProbe Security Research} },
  title   = { {HookProbe Edge IDS Threat Telemetry} },
  year    = { 2026 },
  url     = { https://huggingface.co/datasets/hookprobe/edge-ids-threats },
  note    = { 65,000 verdicts; temporal coverage 2026-08 → 2026-08 },
}

Example usage

python

from datasets import load_dataset

# Full verdict stream — ML-grade labelled data
ds = load_dataset("hookprobe/edge-ids-threats", name="verdicts", split="all")
print(ds[0])

# Pre-aggregated daily country/ASN counts — analyst-grade
agg = load_dataset("hookprobe/edge-ids-threats", name="aggregated", split="daily")

Updates

—Cadence: new month appended at 02:00 UTC on the 1st of each month
—Major releases: quarterly, with a companion report at https://hookprobe.com/blog/threat-landscape-<year>-q<n>/

Contact

—Website: https://hookprobe.com
—Security research: qsecbit@hookprobe.com
—Issues: open a discussion on this dataset's HF page