Skip to Main content Skip to Navigation
Conference papers

Practical Application Layer Emulation in Industrial Control System Honeypots

Abstract : Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.
Document type :
Conference papers
Complete list of metadata

Cited literature [9 references]  Display  Hide  Download
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Wednesday, October 11, 2017 - 2:59:53 PM
Last modification on : Wednesday, October 11, 2017 - 3:01:14 PM
Long-term archiving on: : Friday, January 12, 2018 - 2:17:32 PM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Kyle Girtz, Barry Mullins, Mason Rice, Juan Lopez. Practical Application Layer Emulation in Industrial Control System Honeypots. 10th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2016, Arlington, VA, United States. pp.83-98, ⟨10.1007/978-3-319-48737-3_5⟩. ⟨hal-01614865⟩



Record views


Files downloads