A research for high interactive honepot based on industrial service

Abstract

In recent years, more and more researchers were contributed to the research for the security of ICS (Industrial Control System) with the emphasis on the safety of ICS. As a lure for attackers, honeypots provide the researchers with great assistance of industrial security research, and also plays a certain role in the protection of industrial system security. Honeypot is designed to a vulnerable system with the purpose of luring attackers to compromise it. Simultaneously, it also collects valuable data from attackers under the ground, then researchers will extract useful information from the data and then convert it to threat intelligence, which can be used to found attackers' behaviors or strategies and protect realistic systems. The honeypot for ICS need not only meet the needs of traditional information control technology, such as cost and maintainability, but also meet the needs of ICSs, such as timing and decision strategies. The research focuses on the design and implementation of high interactive honeypot for ICSs. It puts forward a method, which improves the interaction of the ICSs' honeypot from two aspects-HMI (Human Machine Interface) and industrial protocols' simulation. At the same time, we designed and implemented a virtual and high interactive honeypot and deployed it which is based on the improved conpot project to simulate SIEMENS S7-400 series' PLCs (Programmable Logic Controllers).