Datasets on Laboratoire de Haute Sécurité

Blacklist Aggregator

frederic.beck@inria.fr (Frederic Beck) — Thu, 06 Jun 2024 00:00:00 +0000

Blacklist IP URL

Blacklists Aggregator

Blacklists and blocklists are widely used in firewalls, proxies and other security components to filter traffic towards or from malicious entities. This includes IPs, domains, and URLs.

Other sources use probes to gather attack and malicious behaviors from sources to compute trust scores for IPs or domain, also named reputation scores, that are used in the same way.

Darknet

frederic.beck@inria.fr (Frederic Beck) — Thu, 06 Jun 2024 00:00:00 +0000

Internet Monitoring Passive listening PCAP CSV

Darknet

Monitoring unused address space, or Darknet, consist in capturing all traffic towards a set of ip adresses directly connected to Internet, without any active computer connected. All inbound traffic is unsolicited.

Thanks to our Darknet using 4096 contiguous public IP addresses, we can mesure networks attack on internet in real time, and especially large scale phenomena such as Internet wide port scanning, DDoS backscatter or DNS amplification attempts.

Honeypot Binaries

frederic.beck@inria.fr (Frederic Beck) — Thu, 06 Jun 2024 00:00:00 +0000

Internet Honeypots Low Interaction Malware Binary

Honeypot Binaries

Our distributed honeypot platform based on TPot allows us to operate various sensors running up to 20+ honeypots each, centralizing the collect traces, logs and binaries in the LHS. The collected data is indexed in realtime in an Elasticsearch cluster.

Probes are placed on various dedicated network connections in the LHS, in the cloud or in our partners networks, thanks to the CyberGenAI joint project with DFKI (Germany) and OMU (Japan).

Honeypot Logs

frederic.beck@inria.fr (Frederic Beck) — Thu, 06 Jun 2024 00:00:00 +0000

Internet Honeypots Low Interaction Logs JSON

Honeypot logs

Probes are placed on various dedicated network connections in the LHS, in the cloud or in our partners networks, thanks to the CyberGenAI joint project with DFKI (Germany) and OMU (Japan).

Honeypot Traces

frederic.beck@inria.fr (Frederic Beck) — Thu, 06 Jun 2024 00:00:00 +0000

Internet Honeypots Low Interaction PCAP Traces

Honeypot traces

Probes are placed on various dedicated network connections in the LHS, in the cloud or in our partners networks, thanks to the CyberGenAI joint project with DFKI (Germany) and OMU (Japan).

Malwares

frederic.beck@inria.fr (Frederic Beck) — Thu, 06 Jun 2024 00:00:00 +0000

Malware Binary

Malwares

Over the year, the researchers of the Carbone team have gathered more than 50M of malicious binaries.

These binaries have been collected via different methods (honeypots, blacklists crawling, exchange), and are currently being packaged and annotated to prepare them for sharing with partners.

Metadata

Dataset name	Malwares
Authors	LHS Nancy, Carbone
Format	Binaries
Licence	Under NDA, ask us
Experimentation Platform	malware
Production Location	LHS Nancy
Production Date	Since 2008
Update Frequency	Daily
URL	Coming soon

Contact

Fabrice Sabatier

fabrice.sdabatier@loria.fr

Datasets on Laboratoire de Haute Sécurité

Blacklist Aggregator

Blacklists Aggregator

Darknet

Darknet

Honeypot Binaries

Honeypot Binaries

Honeypot Logs

Honeypot logs

Honeypot Traces

Honeypot traces

Malwares

Malwares

Metadata

Links

Contact