SR-BH 2020

Overview
Environment
Activity
Contained Data
Papers
Links
Data Examples


Network Data Source	Custom network features
Network Data Labeled	Yes
Host Data Source	-
Host Data Labeled	-

Overall Setting	Single OS
OS Types	Undisclosed
Number of Machines	1
Total Runtime	12 days
Year of Collection	2020
Attack Categories	Web-based attacks
User Emulation	Real users

Packed Size	-
Unpacked Size	436 MB
Download Link	goto

Overview

The SR-BH 2020 dataset (SR/BH most likely being the initials of the two primary authors) consists of twelve days of traffic collected from a honeypot machine running a Wordpress webserver. Each individual request is recorded using a small set of fields; the distinguishing feature of the dataset is the inclusion of multi-class labels, where each request is either labeled “normal” or assigned to at least one of twelve MITRE CAPEC attack classifications. This dataset is then used by the authors to showcase several machine learning applications, whereby textual features are translated into numerical ones by taking the mean ASCII-value of all characters.

It should be noted that some features within the dataset are strongly biased towards one side, for example http_status_message, which will always be “Not Found” for all attacks (although some benign requests have this value as well). This is not addressed by the authors, though I do assume that their main focus was on correctly assigning different attack labels, where this is less of a factor compared to pure attack detection (as the model still has to figure out the correct set of attack labels).

Environment

The honeypot consists of a Wordpress webserver running on a virtual machine that is exposed to the Internet. A separate router is configured between VM and internet, which causes all requests received by the webserver to originate from the local IP of this router (for the sake of anonymization).

The Web Application Firewall (WAF) ModSecurity, which analyzes traffic at the application layer using a set of rules (Core Rule Set 3.3.0), is installed in “Detection Mode”, meaning it does not block any requests and instead only generates logs. These logs, which inform about individual request and already contain CAPEC labels assigned by ModSecurity, are collected, and the virtual machine is reset every day.

Activity

As this is a honeypot, there is no pre-planned malicious activity. Benign behavior is also not detailed in any fashion, even though it makes up a notable portion of requests (~58%). This is unusually high for a “pure” honeypot, leading me to believe it was also used by instructed users, though I have no way to confirm this.

The following CAPEC attack classifications are considered, with statistics regarding their distribution being available in Table 1 of the paper:

272 - Protocol Manipulation
242 - Code Injection
88 - OS Command Injection
126 - Path Traversal
66 - SQL Injection (these are the majority of attacks)
16 - Dictionary-based Password Attack
310 - Scanning for Vulnerable Software
153 - Input Data Manipulation
274 - HTTP Verb Tampering
194 - Fake the Source of Data
34 - HTTP Response Splitting
33 - HTTP Request Smuggling

Contained Data

As mentioned, request origins are obfuscated via the interposed router. Each request is described with 24 features (like request_origin or response_http_protocol) for a total of 907,814 requests (525,195 normal, 382,619 malicious). Additionally, every request is labeled as either “normal” or assigned to at least one of the aforementioned CAPEC attack classifications (as one request can fit into multiple attack categories). For this purpose, the labels assigned by ModSecurity are used, with the authors stating to have verified these labels using manual and semi-manual analysis, though this is not further detailed. This information is made available as a single CSV file.

Papers

A new multi-label dataset for Web attacks CAPEC classification using machine learning techniques (2022)

Data Examples

Snippet of logged requests taken from data_capec_multilabel.csv