工业互联网蜜网技术综述

陈曦; 姜亚光; 林昕; 周文

doi:10.11959/j.issn2096-109x.2024064

您当前的位置：

首页 >

文章列表页 >

工业互联网蜜网技术综述

综述 | 更新时间：2024-12-20

- 工业互联网蜜网技术综述
- Overview on industrial Internet honeynet technology
- 网络与信息安全学报 2024年10卷第5期页码：23-38
- 作者机构：
  
  1.北京大学软件与微电子学院，北京 100871
  2.中国电子信息产业发展研究院，北京 100048
  3.中国软件评测中心（工业和信息化部软件与集成电路促进中心），北京 100048
  4.中国民用航空局民航智慧能源工程技术研究中心，北京 100088
- 作者简介：
  
  [ "陈曦（1987- ），男，山东淄博人，北京大学博士生、中国电子信息产业发展研究院高级工程师，主要研究方向为工业控制系统软硬件质量、安全测评。" ]
  [ "姜亚光（1985- ），女，内蒙古呼伦贝尔人，中国软件评测中心（工业和信息化部软件与集成电路促进中心）高级工程师，主要研究方向为工业控制系统软硬件质量与安全测评。" ]
  [ "林昕（1988- ），男，天津人，中国软件评测中心（工业和信息化部软件与集成电路促进中心）高级工程师，主要研究方向为工业控制系统软硬件质量与安全测评。" ]
  [ "周文（1974- ），男，四川宣汉人，中国民用航空局高级工程师，主要研究方向为网络安全与数字化。" ]
- 基金信息：
- DOI：10.11959/j.issn2096-109x.2024064
  中图分类号： TP309.2
- 收稿：2023-12-14，
  
  修回：2024-04-14，
  
  纸质出版：2024-10-25
- 稿件说明：
移动端阅览
陈曦, 姜亚光, 林昕, 等. 工业互联网蜜网技术综述[J]. 网络与信息安全学报, 2024, 10(5): 23-38.

Format: CHEN X, JIANG Y G, LIN X, et al. Overview on industrial Internet honeynet technology[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 23-38.
陈曦, 姜亚光, 林昕, 等. 工业互联网蜜网技术综述[J]. 网络与信息安全学报, 2024, 10(5): 23-38. DOI： 10.11959/j.issn2096-109x.2024064.

Format: CHEN X, JIANG Y G, LIN X, et al. Overview on industrial Internet honeynet technology[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 23-38. DOI： 10.11959/j.issn2096-109x.2024064.

摘要

工业互联网将互联网和物联网技术应用于传统工业领域，通过连接、监控和优化工业系统中的设备、机器和流程，实现生产效率的提升、资源利用的优化以及产品和服务的创新。然而，工业互联网中的复杂设备和协议容易存在安全漏洞，导致潜在诸多的安全威胁。蜜网是功能强大的网络安全手段，通过虚拟或模拟的系统、服务或资源，诱导攻击者进行攻击。一旦攻击者与蜜网互动，即可监控并记录攻击活动，有助于提前发现新型网络安全威胁，改进网络安全防御，并为安全研究提供数据。通过汇总大量工业互联网蜜网的相关文献和资料，总结了工业互联网蜜网的基本概念和发展过程，并介绍了工业互联网蜜网的关键技术，对设备仿真、协议模拟和部署分析进行了详细的技术介绍。此外，还针对工业互联网蜜网的功能和结构，提出了基于ATT&CK（adversarial tactics，techniques & common knowledge）的企业矩阵模型的蜜网评估体系，对几种工业互联网蜜网进行了评估，并对工业互联网未来的研究进行了展望。

Abstract

The industrial Internet was integrated with Internet and IoT technologies into traditional industrial sectors

with the aim of enhancing production efficiency

optimizing resource utilization

and fostering innovation in products and services. However

the complexity of industrial Internet devices and protocols posed security vulnerabilities

resulting in numerous security threats. Honeynets emerged as a powerful cybersecurity measure

employing virtual or simulated systems

services

or resources to lure attackers. Upon interaction with the honeynet

monitoring and recording of attack activities were conducted

which aided in the early detection of novel cybersecurity threats

enhanced network security defenses

and contributed valuable data for security research. A substantial body of literature and resources on industrial Internet honeynets were synthesized

outlining their fundamental concepts and developmental processes. Key technologies of industrial Internet honeynets

including device simulation

protocol emulation

and deployment analysis

were comprehensively discussed. Additionally

a honeynet assessment system based on the Adversarial Tactics

Techniques & Common Knowledge (ATT&CK) framework was proposed

tailored to the functionalities and structures of industrial Internet honeynets. Several industrial Internet honeynets were evaluated using this model

and the conclusion was addressed with prospects for future research in industrial Internet honeynets.

关键词

Keywords

references

MASOOD R , UM-E-GHAZIA , ANWAR Z . SWAM: stuxnet worm analysis in metasploit [C ] // Proceedings of the 2011 Frontiers of Information Technology . Piscataway : IEEE Press , 2011 : 142 - 147 .

TAKAGI H , MORITA T , MATTA M , et al . Strategic security protection for industrial control systems [C ] // Proceedings of the 2015 54th Annual Conference of the Society of Instrument and Control Engineers of Japan (SICE) . Piscataway : IEEE Press , 2015 : 986 - 992 .

BINNAR P , DALVI A , BHIRUD S , et al . Cyber forensic case study of waste water treatment plant [C ] // Proceedings of the 2021 IEEE Bombay Section Signature Conference (IBSSC) . Piscataway : IEEE Press , 2021 : 1 - 5 .

SHENG C , YAO Y , FU Q , et al . Study on the intelligent honeynet model for containing the spread of industrial viruses [J ] . Computers & Security , 2021 , 111 : 102460 .

LÓPEZ-MORALES E , RUBIO-MEDRANO C , DOUPÉ A , et al . HoneyPLC: a next-generation honeypot for industrial control systems [C ] // Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2020 : 279 - 291 .

ILG N , DUPLYS P , SISEJKOVIC D , et al . A survey of contemporary open-source honeypots, frameworks, and tools [J ] . Journal of Network and Computer Applications , 2023 , 220 : 103737 .

游建舟 , 吕世超 , 孙玉砚 , 等 . 物联网蜜罐综述 [J ] . 信息安全学报 , 2020 , 5 ( 4 ): 138 - 156 .

YOU J Z , LYU S C , SUN Y Y , et al . A survey on honeypots of Internet of things [J ] . Journal of Cyber Security , 2020 , 5 ( 4 ): 138 - 156 .

KONG T , WANG L M , MA D H , et al . Automated honeynet deployment strategy for active defense in container-based cloud [C ] // Proceedings of the 2020 IEEE 22nd International Conference on High Performance Computing and Communications, IEEE 18th International Conference on Smart City, IEEE 6th International Conference on Data Science and Systems (HPCC/SmartCity/DSS) . Piscataway : IEEE Press , 2020 : 483 - 490 .

WANG Z Q , LI G F , CHI Y P , et al . Honeynet construction based on intrusion detection [C ] // Proceedings of the 3rd International Conference on Computer Science and Application Engineering . New York : ACM , 2019 : 1 - 5 .

ZUZČÁK M , BUJOK P . Using honeynet data and a time series to predict the number of cyber attacks [J ] . Computer Science and Information Systems , 2021 , 18 ( 4 ): 1197 - 1217 .

KALININ M , ZEGZHDA D , ZAVADSKII E . Protection of energy network infrastructures applying a dynamic topology virtualization [J ] . Energies , 2022 , 15 ( 11 ): 4123 .

BAKER B , KELSEY Q , JASON P . Machine learning classifiers in honeynets: a critical review [J ] . International Research Journal of Engineering and Technology , 2020 ( 7 ): 6850 - 6853 .

LUCCHESE M , MERRO M , PACI F , et al . Towards a high-interaction physics-aware honeynet for industrial control systems [C ] // Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing . New York : ACM , 2023 : 76 - 79 .

MARYDAS M , PRIYAH J N V . A cloud based honeynet system for attack detection using machine learning techniques [J ] . International Research Journal of Engineering and Technology (IRJET) , 2019 , 6 ( 7 ): 330 - 335 .

DU X Y , ZHOU G Y , WANG Y J , et al . A lightweight honeynet design in the Internet of things [C ] // Proceedings of the 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) . Piscataway : IEEE Press , 2022 : 83 - 88 .

SILVA D V , RAFAEL G R . Ontology for data integration in honeynet [J ] . Journal of Positive School Psychology , 2022 , 6 ( 8 ): 10625 - 10637 .

PITTMAN J M , ALAEE S . A green scheduling algorithm for cloud-based honeynets [J ] . Frontiers in Sustainability , 2023 ( 3 ): 1048606 .

TAO J , CHEN A , LIU K , et al . Recommendation method of honeynet trapping component based on LSTM [C ] // Proceedings of the 2021 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) . Piscataway : IEEE Press , 2021 : 952 - 957 .

SHENG C , YAO Y , LI D B , et al . Honeyeye: a network traffic collection framework for distributed ICS honeynets [C ] // Proceedings of the 2020 IEEE Intl Conf on Parallel & Distributed Processing with Applications , Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom) . Piscataway : IEEE Press , 2020 : 466 - 473 .

HOFFMAN F . Industrial Internet of things vulnerabilities and threats: what stakeholders need to consider [J ] . Issues in Information Systems , 2019 , 20 ( 1 ): 119 - 133 .

YU T X , ZHANG C Y , XIN Y . Game-theoretical cyber deception strategy generation based on honeynet and intrusion prediction [C ] // Proc SPIE 12609 , International Conference on Computer Application and Information Security (ICCAIS 2022) , 2023 , 12609 : 308 - 316 .

PETRE C A , KORODI A . Honeypot inside an OPC UA wrapper for water pumping stations [C ] // Proceedings of the 2019 22nd International Conference on Control Systems and Computer Science (CSCS) . Piscataway : IEEE Press , 2019 : 72 - 77 .

ZHANG W , ZHANG B , ZHOU Y , et al . An IoT honeynet based on multiport honeypots for capturing IoT attacks [J ] . IEEE Internet of Things Journal , 2020 ( 5 ).

CAMPOS M , GOMES E , MACHADO R . Sensors for detection of cyber threats on industrial environment using a high interaction ICS/SCADA honeynet [C ] // Proceedings of the 2022 IEEE International Workshop on Metrology for Industry 4.0 & IoT (MetroInd4.0&IoT) . Piscataway : IEEE Press , 2022 : 1 - 5 .

TAN L , YU K P , MING F P , et al . Secure and resilient artificial intelligence of things: a honeynet approach for threat detection and situational awareness [J ] . IEEE Consumer Electronics Magazine , 2022 , 11 ( 3 ): 69 - 78 .

SHAN Y , YAO Y , ZHAO T , et al . NeuPot: a neural network-based honeypot for detecting cyber threats in industrial control systems [J ] . IEEE Transactions on Industrial Informatics , 2023 , 19 ( 10 ): 10512 - 10522 .

LUCCHESE M , LUPIA F , MERRO M , et al . HoneyICS: a high-interaction physics-aware honeynet for industrial control systems [C ] // Proceedings of the 18th International Conference on Availability, Reliability and Security . New York : ACM , 2023 : 1 - 10 .

JAVADPOUR A , JA'FARI F , TALEB T , et al . A mathematical model for analyzing honeynets and their cyber deception techniques [C ] // Proceedings of the 2023 27th International Conference on Engineering of Complex Computer Systems (ICECCS) . Piscataway : IEEE Press , 2023 : 81 - 88 .

SIBI CHAKKARAVARTHY S , SANGEETHA D , CRUZ M V , et al . Design of intrusion detection honeypot using social leopard algorithm to detect IoT ransomware attacks [J ] . IEEE Access , 2020 , 8 : 169944 - 169956 .

JAVADPOUR A , JA'FARI F , TALEB T , et al . A comprehensive survey on cyber deception techniques to improve honeypot performance [J ] . Computers & Security , 2024 : 103792 - 103831 .

ZHANG W Z , ZHANG B , ZHOU Y , et al . An IoT honeynet based on multiport honeypots for capturing IoT attacks [J ] . IEEE Internet of Things Journal , 2020 , 7 ( 5 ): 3991 - 3999 .

FRANCO J , ARIS A , CANBERK B , et al . A survey of honeypots and honeynets for Internet of things, industrial Internet of things, and cyber-physical systems [J ] . IEEE Communications Surveys & Tutorials , 2021 , 23 ( 4 ): 2351 - 2383 .

FU Q , YAO Y , SHENG C , et al . Interplay between malware epidemics and honeynet potency in industrial control system network [J ] . IEEE Access , 2020 , 8 : 81582 - 81593 .

CHEN H S , CHO J H , XU S H . Quantifying the security effectiveness of firewalls and DMZs [C ] // Proceedings of the 5th Annual Symposium and Bootcamp on Hot Topics in the Science of Security . New York : ACM , 2018 : 1 - 11 .

BEHAM M , VLAD M , REISER H P . Intrusion detection and honeypots in nested virtualization environments [C ] // Proceedings of the 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2013 : 1 - 6 .

KYRIAKOU A , SKLAVOS N . Container-based honeypot deployment for the analysis of malicious activity [C ] // Proceedings of the 2018 Global Information Infrastructure and Networking Symposium (GIIS) . Piscataway : IEEE Press , 2018 : 1 - 4 .

MASHIMA D , KOK D , LIN W , et al . On design and enhancement of smart grid honeypot system for practical collection of threat intelligence [C ] // 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET 20). 2020 : 1 - 9 .

MAESSCHALCK S , GIOTSAS V , RACE N . World wide ics honeypots: a study into the deployment of conpot honeypots [C ] // Industrial Control System Security Workshop . 2021 : 1 - 10 .

CHOWDHURY S Y , DUDLEY B , SUN R M . The case for virtual PLC-enabled honeypot design [C ] // Proceedings of the 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) . Piscataway : IEEE Press , 2023 : 351 - 357 .

YANG X Y , YUAN J , YANG H , et al . A highly interactive honeypot-based approach to network threat management [J ] . Future Internet , 2023 , 15 ( 4 ): 127 .

POTHAMSETTY V , FRANZ M . Scada honeynet project: building honeypots for industrial networks [J ] . SCADA Honeynet Project , 2005 , 15 .

HANEY M , PAPA M . A framework for the design and deployment of a SCADA honeynet [C ] // Proceedings of the 9th Annual Cyber and Information Security Research Conference on-CISR '14 . New York : ACM , 2014 : 121 - 124 .

VASILOMANOLAKIS E , SRINIVASA S , CORDERO C G , et al . Multi-stage attack detection and signature generation with ICS honeypots [C ] // Proceedings of the NOMS 2016-2016 IEEE/IFIP Network Operations and Management Symposium . Piscataway : IEEE Press , 2016 : 1227 - 1232 .

SINIOSOGLOU I , EFSTATHOPOULOS G , PLIATSIOS D , et al . NeuralPot: an industrial honeypot implementation based on deep neural networks [C ] // Proceedings of the 2020 IEEE Symposium on Computers and Communications (ISCC) . Piscataway : IEEE Press , 2020 : 1 - 7 .

LAU S , KLICK J , ARNDT S , et al . POSTER: towards highly interactive honeypots for industrial control systems [C ] // Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2016 : 1823 - 1825 .

XIAO F , CHEN E H , XU Q . S7commTrace: a high interactive honeypot for industrial control system based on S7 protocol [C ] // Proceedings of International Conference on Information and Communications Security . Cham : Springer , 2018 : 412 - 423 .

DING C P , ZHAI J T , DAI Y W . An improved ICS honeypot based on SNAP7 and IMUNES [C ] // Proceedings of International Conference on Cloud Computing and Security . Cham : Springer , 2018 : 303 - 313 .

REDWOOD O , LAWRENCE J , BURMESTER M . A symbolic honeynet framework for SCADA system threat intelligence [C ] // Proceedings of International Conference on Critical Infrastructure Protection . Cham : Springer , 2015 : 103 - 118 .

GRAMMATIKIS P R , SARIGIANNIDIS P , DALAMAGKAS C , et al . SDN-based resilient smart grid: the SDN-microSENSE architecture [J ] . Digital , 2021 , 1 ( 4 ): 173 - 187 .

FERRETTI P , POGLIANI M , ZANERO S . Characterizing background noise in ICS traffic through a set of low interaction honeypots [C ] // Proceedings of the ACM Workshop on Cyber-Physical Systems Security & Privacy-CPS-SPC'19 . New York : ACM , 2019 : 51 - 61 .

BERNIERI G , CONTI M , PASCUCCI F . MimePot: a model-based honeypot for industrial control networks [C ] // Proceedings of the 2019 IEEE International Conference on Systems, Man and Cybernetics (SMC) . Piscataway : IEEE Press , 2019 : 433 - 438 .

DU M , WANG K . An SDN-enabled pseudo-honeypot strategy for distributed denial of service attacks in industrial Internet of things [J ] . IEEE Transactions on Industrial Informatics , 2020 , 16 ( 1 ): 648 - 657 .

ZARCA A M , BERNABE J B , SKARMETA A , et al . Virtual IoT honeynets to mitigate cyberattacks in SDN/NFV-enabled IoT networks [J ] . IEEE Journal on Selected Areas in Communications , 2020 , 38 ( 6 ): 1262 - 1277 .

ZHENG M J , MA Y F , WU B , et al . A dynamic deceptive honeynet system with a hybrid of virtual and real devices [C ] // Proceedings of the 2022 5th International Conference on Computing and Big Data (ICCBD) . Piscataway : IEEE Press , 2022 : 113 - 117 .

TRIANTOPOULOU S , PAPANIKAS D , KOTZANIKOLAOU P . An experimental analysis of current DDoS attacks based on a provider edge router honeynet [C ] // Proceedings of the 2019 10th International Conference on Information, Intelligence, Systems and Applications (IISA) . Piscataway : IEEE Press , 2019 : 1 - 5 .

BOUKELA L , ZHANG G X , BOUZEFRANE S , et al . An outlier ensemble for unsupervised anomaly detection in honeypots data [J ] . Intelligent Data Analysis , 2020 , 24 ( 4 ): 743 - 758 .

TOK M S , DENER M , DEMIRCI M . Processing honeypot logs with big data and data visualization via hadoop- power BI integration [C ] // Proceedings of the 2022 15th International Conference on Information Security and Cryptography (ISCTURKEY) . Piscataway : IEEE Press , 2022 : 49 - 54 .

MUDGAL A , BHATIA S . Big data enabled intrusion detection with honeypot intelligence system on apache flink (BDE-IDHIS) [C ] // Proceedings of the 2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT) . Piscataway : IEEE Press , 2023 : 1 - 6 .

QI Y L , JIANG R , JIA Y , et al . Attack analysis framework for cyber-attack and defense test platform [J ] . Electronics , 2020 , 9 ( 9 ): 1413 .

HOBERT K , LIM C , BUDIARTO E . Enhancing cyber attribution through behavior similarity detection on linux shell honeypots with ATT&CK framework [C ] // Proceedings of the 2023 IEEE International Conference on Cryptography, Informatics, and Cybersecurity (ICoCICs) . Piscataway : IEEE Press , 2023 : 139 - 144 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向时延敏感的TRDP安全防护机制

面向软件定义晶上系统的安全多维互连网络

高效安全的软件定义网络拓扑发现协议

基于交易记录特征的自私挖矿检测方案

基于轻量级梯度提升机优化的工业互联网入侵检测方法