A Novel and Interactive Industrial Control System Honeypot for Critical Smart Grid Infrastructure

Pliatsios, Dimitrios; Sarigiannidis, Panagiotis; Liatifis, Athanasios; Rompolos, Konstantinos; Siniosoglou, Ilias

doi:10.1109/camad.2019.8858431

Cited by 29 publications

(12 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As in the previous cases, the evaluation of the particular models is detailed in section 4. [55] and [36,37]. In particular, the honeypots' logs are collected by the Honeypot Manager that forwards them to the Honeypots-Based Detection Model.…”

Section: Operational Data Based Anomaly Detection Modelsmentioning

confidence: 99%

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

Self Cite

View full text Add to dashboard Cite

The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home.

show abstract

Section: Operational Data Based Anomaly Detection Modelsmentioning

confidence: 99%

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…In the context of SPEAR, AMI Honeypots are based on the various SG protocols, including IEC 60870-5-101, IEC 60870-5-103, IEC 60870-5-104, DNP3, Modbus, MMS, Goose, SSH, FTP, Telnet, Bacnet, HTTP and HTTPS. Existing honeypot implementations such as Conpot [35] and Cowrie [36] are used for this scope. Moreover, AMI Honeypots emulate the behaviour of the real assets by transmitting similar network traffic data via efficient Generative Adversarial Networks (GANs) that are trained with the network traffic data of the real assets.…”

Section: ) Spear Forensic Repositorymentioning

confidence: 99%

Secure and Private Smart Grid: The SPEAR Architecture

Radoglou-Grammatikis

Sarigiannidis

Iturbe

et al. 2020

2020 6th IEEE Conference on Network Softwarization (NetSoft)

Self Cite

View full text Add to dashboard Cite

Information and Communication Technology (ICT) is an integral part of Critical Infrastructures (CIs), bringing both significant pros and cons. Focusing our attention on the energy sector, ICT converts the conventional electrical grid into a new paradigm called Smart Grid (SG), providing crucial benefits such as pervasive control, better utilisation of the existing resources, self-healing, etc. However, in parallel, ICT increases the attack surface of this domain, generating new potential cyberthreats. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) architecture which constitutes an overall solution aiming at protecting SG, by enhancing situational awareness, detecting timely cyberattacks, collecting appropriate forensic evidence and providing an anonymous cybersecurity information-sharing mechanism. Operational characteristics and technical specifications details are analysed for each component, while also the communication interfaces among them are described in detail.

show abstract

“…The authors in [16] designed and implemented an interactive ICS honeypot that emulates a physical ICS device by replicating realistic traffic from a real device. The implemented ICS honeypot is based on Conpot, while the Modbus ICS communication protocol is used for the communication between the ICS devices.…”

Section: Related Workmentioning

confidence: 99%

NeuralPot: An Industrial Honeypot Implementation Based On Deep Neural Networks

Siniosoglou

Efstathopoulos²,

Pliatsios

et al. 2020

2020 IEEE Symposium on Computers and Communications (ISCC)

Self Cite

View full text Add to dashboard Cite

Honeypots are powerful security tools, which are developed to shield commercial and industrial networks from malicious activity. Honeypots act as passive and interactive decoys in a network by attracting malicious activity away from critical network devices. Given that the security incidents against industrial and critical infrastructure are getting sophisticated and persistent, advanced security systems are needed. In this paper, a novel industrial honeypot implementation is presented, which is based on the Modbus protocol, entitled NeuralPot. The presented NeuralPot honeypot is able to emulate industrial Modbus entities in order to actively confuse the intruders. It achieves this by introducing two distinct deep neural networks, a Generative Adversarial Network and an Autoencoder Network, which learn Modbus device behavior and generate realistic-looking traffic behavior. Based on the evaluation results, the proposed industrial honeypot performs well in terms of accuracy, similarity, and elapsed time of data generation.

show abstract

A Novel and Interactive Industrial Control System Honeypot for Critical Smart Grid Infrastructure

Cited by 29 publications

References 15 publications

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

Secure and Private Smart Grid: The SPEAR Architecture

NeuralPot: An Industrial Honeypot Implementation Based On Deep Neural Networks

Contact Info

Product

Resources

About