A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads
Viktor Boiko, Oleksandr Niiakyi · Data in Brief · 2026
This article describes a longitudinal dataset of high-interaction SSH honeypot logs collected over a four-month period from July to November 2025. The data was captured using a custom modular multi-threaded honeypot developed in Python 3.10, utilizing the Paramiko library to simulate an interactive SSHv2 environment. Unlike low-interaction systems, this dataset records the full spectrum of adversary activity, including initial connection attempts, authentication brute-forcing, and post-authentication command execution. The resulting dataset contains 145,425 security events, structured to support session reconstruction via unique identifiers. The telemetry includes source IPv4 addresses, credential pairs, and granular command-line payloads, featuring rare instances of file-less exploitation via bash sockets. This data provides a ground-truth source for training machine learning models for anomaly detection, enhancing SIEM rule-sets, and conducting empirical research into botnet orchestration and manual intrusion tactics in cloud infrastructures. Data and Preprint Synchronization Note This repository and the associated preprint files have been fully synchronized to match the final, peer-reviewed version of the manuscript accepted for publication in Data in Brief (Elsevier). All statistics, including the total event count of 145,425 and the updated geographic visualizations, are now completely consistent across the raw SQLite database, the processed geospatial distribution files, and the preprint text. For research and citation purposes, please refer to the official published paper. Official Publication: Boiko, V., & Niiakyi, O. (2026). A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads. Data in Brief. DOI: https://doi.org/10.1016/j.dib.2026.112860 Associated Resources: - Dataset: DOI: https://doi.org/10.5281/zenodo.19629700- Software Framework: DOI: https://doi.org/10.5281/zenodo.19763025