LANDER:LightScope IMC 2026 From Predict README version: 15847, last modified: 2026-09-4. This file describes the trace dataset "LightScope_IMC_2026" provided by the LANDER project. LANDER Metadata ┌───────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────┐ │ dataSetName │ LightScope_IMC_2026 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ status │ usc-web-and-predict │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ shortDesc │ Data associated with the LightScope paper at IMC 2026 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ longDesc │ LightScope public dataset — data dictionary │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ datasetClass │ unclassified │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ commercialAllowed │ True │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ requestReviewRequired │ true │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ productReviewRequired │ False │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ ongoingMeasurement │ false │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ submissionMethod │ Upload │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ collectionStartDate │ 2026-02-10 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ collectionStartTime │ 00:00:00 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ collectionEndDate │ 2026-04-10 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ collectionEndTime │ 00:00:00 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ availabilityStartDate │ 2026-09-04 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ availabilityStartTime │ 00:00:00 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ availabilityEndDate │ 2033-03-04 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ availabilityEndTime │ 00:00:00 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ anonymization │ other │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ archivingAllowed │ false │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ keywords │ LightScope,honeypot,telescope │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ format │ other │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ access │ https │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ hostName │ USC-LANDER │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ providerName │ USC │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ groupingId │ │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ groupingSummaryFlag │ false │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ retrievalInstructions │ download │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ byteSize │ 28991029248 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ expirationDays │ 14 │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ uncompressedSize │ │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ impactDoi │ │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ useAgreement │ dua-lightscope │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ irbRequired │ false │ ├───────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤ │ privateAccessInstructions │ See https://ant.isi.edu/datasets/#getting-datasets for information on obtaining this │ │ │ dataset. │ │ │ See │ └───────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────┘ Detailed Information LightScope public dataset — data dictionary Read DISCLAIMER.txt first. Any value here, including every IP address, may be wrong, and nothing in this data attributes traffic to any person or organization. File Rows Contents lightscope_2026-02-10_2026-04-10.parquet 827,289,937 packet records heartbeat_2026-02-10_2026-04-10.parquet 2,348,796 15-min endpoint status cowrie_2026-02-10_2026-04-10.jsonl.zst 170,007,974 honeypot session events endpoint_activity_filter.txt 235 the analysis cohort lightscope_*.parquet Column Description timestamp when our USC-ISI server received the report from the LightScope endpoint. Reports come ingest_epoch in batches, so it's not exact, but is likely more trustworthy than the self reported "ts" field, which comes from the server running the ls endpoint. epoch seconds ts capture time as reported by the remote server when the data was received, may be untrustworthy , epoch microseconds record type: {SCANNER_SYN, this means the LightScope endpoint received a SYN from the reported IP. For non-honeypot ports, this should be the only type of record we have}, {LS_SYN_ACK: This means that the LightScope endpoint was running a honeypot port, and replied to the initial TYPE SCANNER_SYN with a SYN-ACK.}, {HONEYPOT_HANDSHAKE_DONE: This means that the scanner replied to our LS_SYN_ACK and completed the 3 way TCP handshake. Note that some scans like SYN scans will never complete the handshake, so this field lets us identify who had an option to complete the 3-way handshake and didn't}} LS_id endpoint identifier scanner_ip scanner address scanner_port scanner source port ls_randomized_ip endpoint address, anonymized ls_port endpoint destination port ip_version IP version ip_ihl IP header length ip_tos IP type of service ip_len IP total length ip_id IP identification field ip_flags IP flags ip_frag IP fragment offset ip_ttl IP time to live ip_proto IP protocol number ip_chksum IP header checksum ip_options IP options tcp_seq TCP sequence number tcp_ack TCP acknowledgement number tcp_dataofs TCP data offset tcp_reserved TCP reserved bits tcp_window TCP window size tcp_chksum TCP checksum tcp_urgptr TCP urgent pointer tcp_options TCP options payload honeypot service: SSH or TELNET, corresponds to the USC-ISI honeypot service that this connection was forwarded to, either a ssh honeypot or a telnet honeypot ext_dst_ip_country endpoint country type IP network type, IPinfo ASN endpoint autonomous system from IPinfo domain endpoint organisation domain from IPinfo city endpoint city from IPinfo as_type AS network type, IPinfo ip_dst_is_private RFC1918 destination, True/False string external_is_private RFC1918 external, True/False string open_ports port×count list, not just the LightScope honeypot ports, but other TCP ports that server may have running. previously_open_ports port×count list, earlier interface capture interface name internal_ip_randomized internal addresses, anonymized list external_ip_randomized external address, anonymized System_info host operating system Release_info host OS release Version_info host OS version Machine_info host machine type Total_Memory installed memory, text processor host processor architecture host architecture ls_version LightScope client version heartbeat_*.parquet Column Description heartbeat_epoch heartbeat time, epoch seconds LS_id endpoint identifier pkts_last_hb packets since last heartbeat open_honeypot_ports honeypot ports then open ext_dst_ip_country endpoint country type IP network type, IPinfo ASN endpoint autonomous system domain endpoint organisation domain city endpoint city as_type AS network type, IPinfo external_is_private RFC1918 external, True/False string open_ports port×count list previously_open_ports port×count list, earlier interface capture interface name internal_ip_randomized internal addresses, anonymized list external_ip_randomized external address, anonymized System_info host operating system Release_info host OS release Version_info host OS version Machine_info host machine type Total_Memory installed memory, text processor host processor architecture host architecture ls_version LightScope client version cowrie_*.jsonl.zst Field Description eventid Cowrie event type message human-readable event text sensor collector hostname, constant session Cowrie session identifier ts event time, epoch microseconds timestamp_pacific US/Pacific wall clock, not UTC src_ip proxy side; use attacker_ip src_port proxy source port dst_ip proxy destination address dst_port proxy destination port protocol ssh or telnet attacker_ip real scanner address attacker_src_port scanner source port backend_ip honeypot backend address backend_port honeypot backend port match_status how LS_id was resolved dest_port endpoint port targeted LS_id endpoint identifier duration session length, seconds version client version string username login username attempted password login password attempted hassh SSH client fingerprint hasshAlgorithms SSH algorithms, raw kexAlgs SSH key exchange algorithms keyAlgs SSH host key algorithms encCS SSH ciphers offered macCS SSH MACs offered compCS SSH compression offered langCS SSH languages offered input shell command entered shasum transferred file hash duplicate file already seen arch detected client architecture ttylog terminal log path size transferred file size outfile stored file path destfile upload destination path url file download URL filename requested file name data raw event data id Cowrie object identifier width terminal width height terminal height fingerprint SSH public key fingerprint key SSH public key, base64 type SSH public key algorithm name client variable name value client variable value endpoint_activity_filter.txt These are the endpoints that met our activity filter as in the paper 235 endpoints, LS_iddistinct_ports_observed, # lines are comments. User Annotations Currently no annotations. Categories: • Datasets • LANDER • LANDER:Datasets • LANDER:Datasets:viaComunda