MIRAGE: A Labeled SSH Honeypot Dataset
Aditya Sinha, Vinayak Tyagi · 2026
MIRAGE is a labeled dataset of 154,806 SSH honeypot sessions and 156,551 authentication attempts collected from 1,844 unique source IP addresses over 43 days on a publicly reachable host. Key Features Session-level corpus of SSH scanning, credential stuffing, and post-authentication shell interaction. Includes per-session MITRE ATT&CK technique mappings. Includes rule-based weak-supervision attacker-class labels. Supports STIX 2.1 bundle export. Critical Data Validity Notice A latent defect in the authentication callback unconditionally accepted every credential for the first 25 days of collection. Affected Window: 2026-06-16 04:04:42 UTC to 2026-07-11 15:38:49 UTC. Impact: The success and outcome fields carry no information for the 73,243 attempts in this window. Guidance for Reuse: Any analyses depending on attacker access or outcome must be restricted to the 66,198 sessions beginning after 2026-07-11 15:39:12 UTC. The credentials themselves remain valid signal for the entire 43-day corpus.