Willing-vs-Unwitting Proxy-Jacking Detection Dataset
Description
Supporting dataset for: Jaehyeok Yoo and Young-Gab Kim, "Willing or Unwitting: A Lightweight, Payload-Independent Detector for Proxy-Jacking Botnets," manuscript in preparation for submission to the Journal of Network and Computer Applications, 2026. This dataset accompanies the paper's benign / willing / unwitting residential-proxy traffic classification study. It contains connection-level metadata only; no packet payloads are included at any stage, consistent with the payload-independent design of the detection method described in the paper. The dataset includes: (1) raw_logs — Zeek connection-log records (21 fields per flow) for all three classes, with source and destination IP addresses anonymized via SHA-256 hashing; and (2) processed — the six-feature dataset and model evaluation outputs used to produce the paper's results. Raw packet captures are not included, as they contain identifiable browsing activity collected during data generation.
Files
Steps to reproduce
Steps 1, 2, 4, and 5 correspond to the data collection and feature engineering methodology described in Sections 3 and 4 of the associated manuscript. Step 3 (IP anonymization) applies only to this public data release and is not part of the original research pipeline. 1. Network traffic was captured on a Windows 10 virtual machine using Wireshark under three separate conditions: (a) ordinary browsing with no proxy client active (benign), (b) the same browsing activity with a commercial residential-proxy client (Honeygain) actively running and relaying traffic (willing), and (c) the same relay configuration as (b) with additional Nmap-based reconnaissance and scanning traffic layered on top (unwitting). 2. Each packet capture was processed using Zeek to produce connection-level logs (conn.log), summarizing every network flow into 21 metadata fields (timestamp, connection identifiers, protocol, service, duration, byte/packet counts, connection-state history, etc.) without retaining any payload content. 3. Source and destination IP addresses in the resulting logs were anonymized by replacing each address with a 12-character SHA-256 hash, computed consistently within each file so that repeated connections from the same host remain identifiable as such. 4. From the 21 raw fields, six identifying fields (timestamp, connection UID, source/destination IP addresses, source/destination ports) and four fields with greater than 90% missing values (local-origination/local-response flags, tunnel-parent identifiers, missed-byte counts) were removed, reducing the field set to 11. 5. From the remaining 11 fields, six behavioral features (originator IP bytes, originator payload bytes, originator packet count, responder packet count, connection duration, and connection-state history) were selected using SHAP-based feature attribution (Lundberg and Lee, 2017). Re-running steps 2-5 on the raw_logs files included in this dataset will reproduce the six-feature dataset in processed/six_feature_anonymized.csv exactly.
Institutions
- Sejong UniversitySeoul, Seoul