Practical Application Layer Emulation in Industrial Control System Honeypots - Critical Infrastructure Protection X Access content directly
Conference Papers Year : 2016

Practical Application Layer Emulation in Industrial Control System Honeypots

Abstract

Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.
Fichier principal
Vignette du fichier
434671_1_En_5_Chapter.pdf (665.3 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01614865 , version 1 (11-10-2017)

Licence

Attribution

Identifiers

Cite

Kyle Girtz, Barry Mullins, Mason Rice, Juan Lopez. Practical Application Layer Emulation in Industrial Control System Honeypots. 10th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2016, Arlington, VA, United States. pp.83-98, ⟨10.1007/978-3-319-48737-3_5⟩. ⟨hal-01614865⟩
54 View
139 Download

Altmetric

Share

Gmail Facebook X LinkedIn More