Skip to Main content Skip to Navigation
Conference papers

Practical Application Layer Emulation in Industrial Control System Honeypots

Abstract : Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.
Document type :
Conference papers
Complete list of metadata

Cited literature [9 references]  Display  Hide  Download

https://hal.inria.fr/hal-01614865
Contributor : Hal Ifip <>
Submitted on : Wednesday, October 11, 2017 - 2:59:53 PM
Last modification on : Wednesday, October 11, 2017 - 3:01:14 PM
Long-term archiving on: : Friday, January 12, 2018 - 2:17:32 PM

File

434671_1_En_5_Chapter.pdf
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Kyle Girtz, Barry Mullins, Mason Rice, Juan Lopez. Practical Application Layer Emulation in Industrial Control System Honeypots. 10th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2016, Arlington, VA, United States. pp.83-98, ⟨10.1007/978-3-319-48737-3_5⟩. ⟨hal-01614865⟩

Share

Metrics

Record views

89

Files downloads

186