1

A friend of mine asked me this recently, and besides the obvious "try with antivirus vendors" I didn't know what to answer.

He's been building a pretty large collection of data from a honeynet consisting of multiple nodes running Cowrie, Dionaea, Glastopf, Honeytrap and others, spread over multiple IPs in different geographical areas.

He's been gathering this data for the past year, while researching neural nets and a way to "learn" from what he gathers, but he realized that this project is taking longer than expected, and wants to possibly off-load some of the data to help pay for the research.

Besides the obvious antivirus companies, where could he look for entities interested in this type of data? Are there any broker-type entities out there? Where would you go looking?

  • 3
    I'm not certain this is on topic for this site, but I'd doubt it would be worth anything to any one in any case. It's so cheap and easy to set up honeypots that the data just isn't worth much in the first place, and it's more valuable in any case when you own the honeypots and control the environments and context around the data as well. So, I'd be surprised if anyone wanted it at any price. – Xander Jun 6 '18 at 0:34
  • 1
    I don't think any researchers would be interested in buying data simply because they want to collect the data themselves and analyze it. It's simply more trustworthy when you've collected your own data using your own procedures on what you want to study. Your friend would likely be smarter just giving away the data for free, with the condition any published research from it should reference him as the source. He'd likely gain more by sharing it than a fruitless attempt to sell it. – Steve Sether Jun 6 '18 at 3:50
2

Short answer: No. For 3 reasons.

First, there is little value in an amateur's personally collected data. One cannot know the errors, flaws, inconsistencies, etc. So, one would be buying very "dirty" data. Unless the source, subject, or nature of the data was so unique as to be able to say that purchasers could not have obtained the valuable data themselves, you are just selling random logs. The market value of the data is likely very low.

Second, people and organisations that run honeypots share their data to researchers for free. There used to be places where you could upload and download logs freely, but those repositories, themselves, cost money to maintain, so they rise and fall over time. The market for the data is non-existent.

Third, in many jurisdictions, there are legal issues with sharing honeypot logs because of privacy implications. I run honeypots and the amount of personal data that I collect on attackers is surprising (for a number of reasons). In some cases, attackers reveal everything about themselves (this is one reason why I run honeypots, to report them). The market for the data comes with major liabilities.

Instead of selling the logs, consider looking for sponsors for the research.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.