EVASION OF HONEYPOT DETECTION MECHANISMS THROUGH IMPROVED INTERACTIVITY OF ICS-BASED SYSTEMS

Abstract

In recent years critical-infrastructure systems, particularly smart electrical grids, have become dependent on computer control systems and thus increasingly vulnerable to cyber attack. Attempts to defend these systems with deceptive decoys (i.e., honeypots) have been hampered by unconvincing feedback to attackers about the state of the physical processes the honeypots supposedly control. We constructed a high-interaction honeypot for a microgrid that used a physics-based electrical-grid simulation to provide realistic responses to intruders. To create a diverse data corpus, we deployed the honeypot in two configurations, one with a supervisory control and data acquisition (SCADA) human-machine interface layer and one without. Both honeypots elicited real attacks and successfully evaded the Shodan search engine's Honeyscore, a widely known automated honeypot detection system. The collected data was analyzed to determine traffic patterns and attackers' behavior, and the results suggest promising avenues for further research. This work contributes to the research and development of intelligent behavior-based intrusion detection systems to better defend national critical infrastructure and DOD systems, both afloat and ashore.