ICSpot: A High-Interaction Honeypot for Industrial Control Systems

Mauro Conti, Francesco Trolese, Federico Turrin

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

Abstract

Honeypots represent one of the most common solutions to study the adversaries' movements and develop ad-hoc protection strategies. An effective honeypot can mimic a real system behavior and can be used to deceive the attacker and collect data related to his actions. However, current honeypots for Industrial Control Systems (ICSs) still lack realistic physical process simulation of the industrial network. Simulating an industrial process accurately while also enabling interaction with it is a complicated task. In this paper, we present ICSpot, the first ICS honeypot that addresses the current state-of-the-art limitations by integrating a physical process interaction. We developed our honeypot by leveraging different ad-hoc ICS tools resulting in a more completed and realistic solution. Then, we installed our honeypot on a local Internet Exchange Point and an AWS server, and we collected the interaction for 30 days. Finally, we report the finding related to the interaction collection and compare the results on the two installation points. Our results show that the physical process port we implemented is highly attractive to attackers.

Original languageEnglish
Title of host publication2022 International Symposium on Networks, Computers and Communications, ISNCC 2022
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
ISBN (Electronic)9781665485449
DOIs
Publication statusPublished - 2022
Externally publishedYes
Event2022 International Symposium on Networks, Computers and Communications, ISNCC 2022 - Shenzhen, China
Duration: 19 Jul 202221 Jul 2022

Publication series

Name2022 International Symposium on Networks, Computers and Communications, ISNCC 2022

Conference

Conference2022 International Symposium on Networks, Computers and Communications, ISNCC 2022
Country/TerritoryChina
CityShenzhen
Period19/07/2221/07/22

Keywords

  • CPS
  • Honeypot
  • ICS
  • Measurement

Fingerprint

Dive into the research topics of 'ICSpot: A High-Interaction Honeypot for Industrial Control Systems'. Together they form a unique fingerprint.

Cite this