logo Netzschleuder network catalog, repository, and centrifuge

cisco_hosts — Communication networks of computing hosts (Cisco Secure Workload, 2019-2022)

Description

Networks of communications among computing hosts running distributed applications in various enterprises, provided by the Cisco Secure Workload group (O. Madani, S. A. Averineni and S. Gandham) and distributed by SNAP, for research on the clustering of hosts by their function. Software sensors on the hosts recorded, in samples of one hour, the connections between hosts with the (service) port and protocol used and the number of packets exchanged. Nodes are hosts (IP addresses), and an edge points from the client (consumer) of a connection to its server (provider). The hosts and ports are anonymized as integers (separately for each network); the protocols are given by their numbers (6 for TCP, 17 for UDP). There are 27 networks:

  • g1 to g20: 20 disjoint networks of different applications (from 86 to 278,739 hosts), recorded in 27 hourly samples on four days, one in January and three in March 2019 (6 or 7 samples per day).
  • g21: a small network (317 hosts), recorded in 96 hourly samples from 10 to 13 February 2022. For 59 of the hosts, which had a sensor and a host name, the data give a ground-truth grouping of the hosts by function (based on their host names, which are not given).
  • g21_4days, g21_2days, g21_12hrs: the connections of g21 among the hosts with a ground-truth group, aggregated over 4 days, 2 days and 12 hours from 10 February 2022 (without the numbers of packets).
  • g21_few_sensors_6days, g21_few_sensors_1day: the same application observed with fewer than 10 sensors (instead of about 50), aggregated over 6 days and 1 day until 9 February 2022 (without the numbers of packets), so that only part of the network is observed.
  • e1 (also called g22): a network of machines doing software builds and regression tests (33,241 hosts), recorded in 99 hourly samples between January 2021 and October 2022, with a candidate ground-truth grouping of 486 hosts (based on their host names).

In the networks recorded in hourly samples (g1 to g21 and e1), each edge is a connection observed in one sample, so that repeated connections between the same hosts in different samples are separate edges (a multigraph). In the aggregated networks, each pair of hosts appears once. The dates and hours of the samples are not given exactly: the samples are identified by the names of their files (see snapshots below).

The networks have the following properties:

  • host_id: the anonymized identifier of the host.
  • g21 networks and e1: group, the index of the host's ground-truth group (starting from 1; -1 if none); prefix_code, the prefix code of the host name, which encodes the position of the host name in the prefix tree of all host names (e.g. "b1l8c2_b1l1c1": first branch, prefix of length 8, 2 hosts below, and so on; empty if none). g21 networks: group_prefix5, the index of the host's group according to the grouping of the host names with a common prefix of at least 5 characters (-1 if none).
  • Edge ports: the ports and protocols of the connection, with the numbers of packets, as given, e.g. "1p6-22,1p17-4" (port 1 on protocol 6 with 22 packets, and port 1 on protocol 17 with 4 packets); for the aggregated networks, the numbers of packets are omitted.
  • Edge packets (sampled networks): the total number of packets of the connection.
  • Edge snapshot (sampled networks): the index (starting from 0) of the hourly sample in the graph property snapshots, which lists the names of the sample files (e.g. "out1_4" for the 4th sample of day 1, "202202130300" for 13 February 2022 at 03:00, "out2022_7_5" for the 5th sample of July 2022).
Tags
Technological Communication Multigraph Timestamps Unweighted Metadata
Citation
  • O. Madani, S. A. Averineni, and S. Gandham, "A Dataset of Networks of Computing Hosts." Proceedings of the 2022 ACM International Workshop on Security and Privacy Analytics (IWSPA), 100-104 (2022). 10.1145/3510548.3519368 Sci-Hub
Upstream URL OK
https://snap.stanford.edu/data/cisco-networks.html
Networks
Tip: click on a column header to sort the list, or hover over it for a description.
Column legend
$\left<k\right>$
Mean degree
$\sigma_k$
Standard deviation of the degrees
$\lambda_h$
Largest eigenvalue of the Hashimoto (non-backtracking) matrix
$\tau$
Random walk mixing time
$r$
Degree assortativity
$c$
Global clustering coefficient
$\oslash$
(Pseudo-) diameter
$S$
Relative size of the largest component
NPs
Node properties
EPs
Edge properties
Name Nodes Edges $\left<k\right>$ $\sigma_k$ $\lambda_h$ $\tau$ $r$ $c$ $\oslash$ $S$ Kind Mode NPs EPs gt GraphML GML csv
g1 1,447 2,399,659 1658.37 4802.13 387.39 14.04 -0.15 0.73 7 0.89 Directed Unipartite host_id ports packets snapshot 6.6 MiB 15.7 MiB 14.4 MiB 11.1 MiB
g2 157,489 7,951,827 50.49 2030.80 612.53 291.49 -0.29 0.00 11 1.00 Directed Unipartite host_id ports packets snapshot 25.6 MiB 53.2 MiB 49.9 MiB 38.8 MiB
g3 11,555 323,306 27.98 821.94 136.05 54.61 -0.39 0.02 5 0.98 Directed Unipartite host_id ports packets snapshot 877 KiB 1.9 MiB 1.7 MiB 1.3 MiB
g4 278,739 533,240 1.91 774.81 128.08 45.45 -0.71 0.00 6 1.00 Directed Unipartite host_id ports packets snapshot 1.0 MiB 2.9 MiB 2.6 MiB 3.2 MiB
g5 46,298 307,607 6.64 841.92 65.56 20.08 -0.48 0.00 6 1.00 Directed Unipartite host_id ports packets snapshot 664 KiB 1.5 MiB 1.4 MiB 1.2 MiB
g6 28,329 1,456,853 51.43 3153.72 241.60 4.70 -0.71 0.00 5 1.00 Directed Unipartite host_id ports packets snapshot 2.7 MiB 8.1 MiB 7.3 MiB 5.5 MiB
g7 290 12,396 42.74 234.59 13.88 42.78 -0.55 0.01 7 1.00 Directed Unipartite host_id ports packets snapshot 23 KiB 61 KiB 55 KiB 43 KiB
g8 3,389 213,544 63.01 1493.33 93.05 3.04 -0.76 0.01 5 0.96 Directed Unipartite host_id ports packets snapshot 453 KiB 1.2 MiB 1.1 MiB 835 KiB
g9 13,717 163,521 11.92 387.18 90.74 140.84 -0.53 0.03 5 1.00 Directed Unipartite host_id ports packets snapshot 438 KiB 977 KiB 896 KiB 682 KiB
g10 18,414 213,989 11.62 382.94 87.93 86.76 -0.49 0.04 7 1.00 Directed Unipartite host_id ports packets snapshot 535 KiB 1.2 MiB 1.1 MiB 887 KiB
g11 207 29,551 142.76 392.60 30.37 3.61 -0.66 0.14 4 0.96 Directed Unipartite host_id ports packets snapshot 80 KiB 182 KiB 169 KiB 127 KiB
g12 2,454 55,451 22.60 363.21 30.69 39.44 -0.49 0.00 6 1.00 Directed Unipartite host_id ports packets snapshot 116 KiB 297 KiB 276 KiB 211 KiB
g13 5,290 267,885 50.64 1087.67 87.16 11.47 -0.37 0.02 6 0.93 Directed Unipartite host_id ports packets snapshot 637 KiB 1.6 MiB 1.4 MiB 1.1 MiB
g14 575 12,642 21.99 93.40 11.69 241.16 -0.51 0.04 13 0.77 Directed Unipartite host_id ports packets snapshot 30 KiB 69 KiB 64 KiB 50 KiB
g15 70,172 704,288 10.04 1246.57 176.31 351.94 -0.57 0.00 6 0.91 Directed Unipartite host_id ports packets snapshot 1.0 MiB 3.3 MiB 3.1 MiB 2.5 MiB
g16 238 4,662 19.59 160.26 8.38 29.39 -0.59 0.02 6 0.96 Directed Unipartite host_id ports packets snapshot 13 KiB 27 KiB 25 KiB 20 KiB
g17 596 14,880 24.97 232.84 12.21 44.80 -0.50 0.01 6 0.99 Directed Unipartite host_id ports packets snapshot 29 KiB 76 KiB 70 KiB 55 KiB
g18 289 10,051 34.78 378.62 13.92 39.62 -0.73 0.00 5 0.98 Directed Unipartite host_id ports packets snapshot 9 KiB 39 KiB 36 KiB 29 KiB
g19 86 1,797 20.90 86.56 7.35 3.14 -0.63 0.00 4 0.91 Directed Bipartite host_id ports packets snapshot 6 KiB 13 KiB 11 KiB 9 KiB
g20 1,487 18,574 12.49 127.10 19.30 115.64 -0.51 0.13 7 1.00 Directed Unipartite host_id ports packets snapshot 39 KiB 98 KiB 90 KiB 69 KiB
g21 317 248,011 782.37 3291.79 51.28 33.78 0.79 0.97 7 0.50 Directed Unipartite host_id group prefix_code group_prefix5 ports packets snapshot 402 KiB 1.2 MiB 1.1 MiB 933 KiB
g21_4days 52 2,507 48.21 15.06 49.25 0.41 -0.01 0.99 2 1.00 Directed Unipartite host_id group prefix_code group_prefix5 ports 5 KiB 11 KiB 10 KiB 8 KiB
g21_2days 52 2,507 48.21 15.06 49.25 0.41 -0.01 0.99 2 1.00 Directed Unipartite host_id group prefix_code group_prefix5 ports 5 KiB 11 KiB 10 KiB 8 KiB
g21_12hrs 49 2,213 45.16 14.53 46.13 0.42 -0.01 0.99 2 1.00 Directed Unipartite host_id group prefix_code group_prefix5 ports 4 KiB 9 KiB 9 KiB 7 KiB
g21_few_sensors_6days 31 694 22.39 14.29 23.61 0.52 -0.41 0.82 2 1.00 Directed Unipartite host_id group prefix_code group_prefix5 ports 3 KiB 4 KiB 4 KiB 4 KiB
g21_few_sensors_1day 31 690 22.26 14.46 23.45 0.53 -0.42 0.81 2 1.00 Directed Unipartite host_id group prefix_code group_prefix5 ports 3 KiB 4 KiB 4 KiB 3 KiB
e1 33,241 5,179,355 155.81 1419.64 269.78 1614.34 -0.17 0.00 11 0.94 Directed Unipartite host_id group prefix_code ports packets snapshot 8.3 MiB 25.4 MiB 23.6 MiB 19.9 MiB