Rethinking the Honeypot for Cyber-Physical Systems

Litchfield, Samuel; Formby, David; Rogers, Jonathan; Meliopoulos, Sakis; Beyah, Raheem

doi:10.1109/mic.2016.103

Cited by 54 publications

(24 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While Conpot presents examples of industrial systems to attackers, a sophisticated attacker can identify the honeypot by observing that the system does not satisfy the traditional physical properties of devices in a typical industrial setting. To further enhance the realism of the simulated system, Litchfield et al present HoneyPhy, a honeypot that models the physics of the devices (e.g., delays) [10].…”

Section: Pymentioning

confidence: 99%

Enhancing the Resiliency of Cyber-Physical Systems with Software-Defined Networks

Salazar

Cárdenas

2019

Proceedings of the ACM Workshop on Cyber-Physical Systems Security &Amp; Privacy - CPS-SPC'19

View full text Add to dashboard Cite

Numerous research efforts have focused on intrusion detection in industrial control networks, however, few of them discuss what to do after an intrusion has been detected. Because the safety of most of these control systems is time-sensitive, we need new research on automatic incident response. In this paper, we extend our work on leveraging Software-Defined Networking (SDN) to automatically reconfigure an industrial control network to mitigate the impact of attacks, and to deceive adversaries. CCS CONCEPTS • Security and privacy → Intrusion detection systems; Network security; Domain-specific security and privacy architectures; • Networks → Programmable networks; • Applied computing → Industry and manufacturing.

show abstract

Section: Pymentioning

confidence: 99%

Enhancing the Resiliency of Cyber-Physical Systems with Software-Defined Networks

Salazar

Cárdenas

2019

Proceedings of the ACM Workshop on Cyber-Physical Systems Security &Amp; Privacy - CPS-SPC'19

View full text Add to dashboard Cite

show abstract

“…Honeypots can simulate a variety of information systems and environments. Litchfield et al (2016) argue that the value of honeypots is directly proportional to their ability to fool attackers into believing they are authentic machines. The authors illustrate the potential of real-time simulation, while protecting the authenticity of the original system.…”

Section: Simulationmentioning

confidence: 99%

Integrating a Proactive Technique Into a Holistic Cyber Risk Management Approach

Marotta¹,

McShane²

2018

Risk Manage Insurance Review

View full text Add to dashboard Cite

Cyber threats are an emerging risk posing a range of challenges to organizations of all sizes. Corporate risk managers need to understand that cyber risk management must not be a silo in the IT department. Cyber threats are the result of intelligent adaptive agents that cannot be managed by traditional risk management techniques only. The article describes the honeypot concept, which is a proactive measure for identifying and gathering information about attackers in order to develop suitable and effective countermeasures. In addition, this article proposes the integration of the honeypot concept into a cyber risk management approach based on the five preparedness mission areas of the Federal Emergency Management Agency (FEMA).

show abstract

“…We summarize our findings in Table 3. Holczer et al [12] Yin et al [22] Conpot [34] Provos et al [25] Litchfield et al [18] Liljenstam et al [17] Design and Implementation of ICS honeypot. In [27], Scott proposes a mapping and configuration of honeypot that is similar to our High-interaction Hybrid honeypot architecture in several ways.…”

Section: Related Workmentioning

confidence: 99%

“…HoneyPhy [18] is physics-aware honeypot framework for Cyber-Physical Systems (CPS). The proposed work has a broader scope (CPS are a superset of ICS), and claims to provide realistic physical process, and devices simulation by means of a hybrid configuration.…”

Section: Honeypot Frameworkmentioning

confidence: 99%

Towards High-Interaction Virtual ICS Honeypots-in-a-Box

Antonioli

Agrawal

Tippenhauer

2016

Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy

View full text Add to dashboard Cite

In this work, we address the problem of designing and implementing honeypots for Industrial Control Systems (ICS). Honeypots are vulnerable systems that are set up with the intent to be probed and compromised by attackers. Analysis of those attacks then allows the defender to learn about novel attacks and general strategy of the attacker. Honeypots for ICS systems need to satisfy both traditional ICT requirements, such as cost and maintainability, and more specific ICS requirements, such as time and determinism.We propose the design of a virtual, high-interaction and serverbased ICS honeypot to satisfy the requirements, and the deployment of a realistic, cost-effective, and maintainable ICS honeypot. An attacker model is introduced to complete the problem statement and requirements.Based on our design and the MiniCPS framework, we implemented a honeypot mimicking a water treatment testbed. To the best of our knowledge, the presented honeypot implementation is the first academic work targeting Ethernet/IP based ICS honeypots, the first ICS virtual honeypot that is high-interactive without the use of full virtualization technologies (such as a network of virtual machines), and the first ICS honeypot that can be managed with a Software-Defined Network (SDN) controller.

show abstract

Rethinking the Honeypot for Cyber-Physical Systems

Cited by 54 publications

References 4 publications

Enhancing the Resiliency of Cyber-Physical Systems with Software-Defined Networks

Enhancing the Resiliency of Cyber-Physical Systems with Software-Defined Networks

Integrating a Proactive Technique Into a Holistic Cyber Risk Management Approach

Towards High-Interaction Virtual ICS Honeypots-in-a-Box

Contact Info

Product

Resources

About