pyToshka/cyber-security-events-full

cyber-security-events-full

Dataset Description

This dataset contains cybersecurity events collected from honeypot infrastructure.

The data has been processed and feature-engineered for machine learning applications in threat detection and security analytics.

Feature Categories

Network Features

• —Connection flow statistics (bytes, packets, duration)
• —Protocol-specific metrics
• —Geographic information
• —IP reputation data

Behavioral Features

• —Session patterns and command sequences
• —User-agent analysis
• —Attack pattern identification
• —Protocol fingerprinting

Temporal Features

• —Time-based aggregations
• —Frequency analysis
• —Campaign detection indicators
• —Attack timing patterns

Security Labels

• —MITRE ATT&CK technique mappings
• —Alert severity classifications
• —Automatic threat categorization
• —Binary maliciousness indicators

Usage Example

from datasets import load_dataset

# Load the dataset
dataset = load_dataset("pyToshka/cyber-security-events-full")
train_data = dataset["train"]

# Basic exploration
print("Dataset features:", list(train_data.features.keys()))
print("Total samples:", len(train_data))

from collections import Counter

# Example: Filter RDP attacks
rdp_events = train_data.filter(lambda x: x['app_proto'] == 'rdp')
print("RDP events:", len(rdp_events))

# Example: Analyze attack vectors
if len(rdp_events) > 0:
    attack_vectors = Counter([event['attack_vectors'] for event in rdp_events if event['attack_vectors']])
    print("RDP Attack vectors:")
    for vector, count in attack_vectors.most_common():
        print(f"  {vector}: {count}")

# Example: Analyze protocol distribution
protocols = Counter([event['app_proto'] for event in train_data if event['app_proto']])
print("Protocol distribution:")
for proto, count in protocols.most_common():
    print(f"  {proto if proto else '(empty)'}: {count}")

# Example: Malicious events analysis
malicious_count = sum(1 for event in train_data if event['is_malicious'])
print(f"Malicious events: {malicious_count}/{len(train_data)} ({malicious_count/len(train_data)*100:.1f}%)")

Data Fields

The dataset contains 187 features across several categories:

Network Features

• —dest_ip: Network-related information
• —src_ip: Network-related information
• —dest_port: Network-related information
• —geoip_ext: Network-related information
• —honeypot_ip_int: Network-related information
• —... and 14 more network features

Behavioral Features

• —username: Behavioral analysis data
• —session: Behavioral analysis data
• —session_duration: Behavioral analysis data
• —request.userAgent: Behavioral analysis data
• —request.headers.User-Agent: Behavioral analysis data
• —... and 12 more behavioral features

Temporal Features

• —@timestamp: Time-based information
• —timestamp: Time-based information
• —start_time: Time-based information
• —end_time: Time-based information
• —uptime: Time-based information
• —... and 4 more temporal features

Security Features

• —alert: Security and threat intelligence
• —mitre_techniques: Security and threat intelligence
• —attack_vectors: Security and threat intelligence
• —mitre_tactic: Security and threat intelligence
• —mitre_technique: Security and threat intelligence
• —... and 2 more security features

Data Splits

Dataset Statistics

• —Total size: ~7558.3 MB
• —Average record size: ~10267 bytes
• —Feature completeness: 100.0%

Ethical Considerations

This dataset contains real honeypot data representing actual attack attempts. Users should:

• —Privacy: Respect anonymization measures implemented in the dataset
• —Research Use: Use data only for legitimate cybersecurity research and education
• —Responsible Disclosure: Follow responsible disclosure practices for any findings
• —Legal Compliance: Comply with applicable laws and regulations in your jurisdiction
• —No Reidentification: Do not attempt to identify or contact attackers
• —Defensive Purpose: Use insights for defensive security improvements only