Identifying Honeypots from ICS Devices Using Lightweight Fuzzy Testing

Abstract

The security issues of industrial control systems (ICSs) have become increasingly prevalent. As an important part of ICS security, honeypots and antihoneypots have become the focus of offensive and defensive confrontation. However, research on ICS honeypots still lacks breakthroughs, and it is difficult to simulate real ICS devices perfectly. In this paper, we studied ICS honeypots to identify and address their weaknesses. First, an intelligent honeypot identification framework is proposed, based on which feature data type requirements and feature data acquisition for honeypot identification is studied. Inspired by vulnerability mining, we propose a feature acquisition approach based on lightweight fuzz testing, which utilizes the differences in error handling between the ICS device and the ICS honeypot. By combining the proposed method with common feature acquisition approaches, the integrated feature data can be obtained. The experimental results show that the feature data acquired is effective for honeypot identification.