Practical application layer emulation in industrial control system honeypots

Kyle Girtz; Barry Mullins; Mason Rice; Juan Lopez

doi:10.1007/978-3-319-48737-3_5

Practical application layer emulation in industrial control system honeypots

Kyle Girtz, Barry Mullins, Mason Rice, Juan Lopez

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

6 Scopus citations

Abstract

Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.

Original language	English
Title of host publication	Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers
Editors	Sujeet Shenoi, Mason Rice
Publisher	Springer New York LLC
Pages	83-98
Number of pages	16
ISBN (Print)	9783319487366
DOIs	https://doi.org/10.1007/978-3-319-48737-3_5
State	Published - 2016
Externally published	Yes
Event	10th IFIP WG 11.10 International Conference on Critical Infrastructure Protection X, ICCIP 2016 - Arlington, United States Duration: Mar 14 2016 → Mar 16 2016

Publication series

Name	IFIP Advances in Information and Communication Technology
Volume	485
ISSN (Print)	1868-4238

Conference

Conference	10th IFIP WG 11.10 International Conference on Critical Infrastructure Protection X, ICCIP 2016
Country/Territory	United States
City	Arlington
Period	03/14/16 → 03/16/16

Keywords

Emulator
Honeypot
Industrial control systems
Proxy

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

Access to Document

10.1007/978-3-319-48737-3_5

Cite this

Girtz, K., Mullins, B., Rice, M., & Lopez, J. (2016). Practical application layer emulation in industrial control system honeypots. In S. Shenoi, & M. Rice (Eds.), Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers (pp. 83-98). (IFIP Advances in Information and Communication Technology; Vol. 485). Springer New York LLC. https://doi.org/10.1007/978-3-319-48737-3_5

Girtz, Kyle ; Mullins, Barry ; Rice, Mason et al. / Practical application layer emulation in industrial control system honeypots. Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers. editor / Sujeet Shenoi ; Mason Rice. Springer New York LLC, 2016. pp. 83-98 (IFIP Advances in Information and Communication Technology).

@inproceedings{b2c8ae678ad148709637651766477080,

title = "Practical application layer emulation in industrial control system honeypots",

abstract = "Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.",

keywords = "Emulator, Honeypot, Industrial control systems, Proxy",

author = "Kyle Girtz and Barry Mullins and Mason Rice and Juan Lopez",

note = "Publisher Copyright: {\textcopyright} IFIP International Federation for Information Processing 2016.; 10th IFIP WG 11.10 International Conference on Critical Infrastructure Protection X, ICCIP 2016 ; Conference date: 14-03-2016 Through 16-03-2016",

year = "2016",

doi = "10.1007/978-3-319-48737-3_5",

language = "English",

isbn = "9783319487366",

series = "IFIP Advances in Information and Communication Technology",

publisher = "Springer New York LLC",

pages = "83--98",

editor = "Sujeet Shenoi and Mason Rice",

booktitle = "Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers",

}

Girtz, K, Mullins, B, Rice, M & Lopez, J 2016, Practical application layer emulation in industrial control system honeypots. in S Shenoi & M Rice (eds), Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers. IFIP Advances in Information and Communication Technology, vol. 485, Springer New York LLC, pp. 83-98, 10th IFIP WG 11.10 International Conference on Critical Infrastructure Protection X, ICCIP 2016, Arlington, United States, 03/14/16. https://doi.org/10.1007/978-3-319-48737-3_5

Practical application layer emulation in industrial control system honeypots. / Girtz, Kyle; Mullins, Barry; Rice, Mason et al.
Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers. ed. / Sujeet Shenoi; Mason Rice. Springer New York LLC, 2016. p. 83-98 (IFIP Advances in Information and Communication Technology; Vol. 485).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Practical application layer emulation in industrial control system honeypots

AU - Girtz, Kyle

AU - Mullins, Barry

AU - Rice, Mason

AU - Lopez, Juan

N1 - Publisher Copyright: © IFIP International Federation for Information Processing 2016.

PY - 2016

Y1 - 2016

N2 - Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.

AB - Attacks on industrial control systems and critical infrastructure assets are on the rise. These systems are at risk due to outdated technology and ad hoc security measures. As a result, honeypots are often deployed to collect information about malicious intrusions and exploitation techniques. While virtual honeypots mitigate the excessive cost of hardware-replicated honeypots, they often suffer from a lack of authenticity. In addition, honeypots utilizing a proxy to a live programmable logic controller suffer from performance bottlenecks and limited scalability. This chapter describes an enhanced, application layer emulator that addresses both limitations. The emulator combines protocol-agnostic replay with dynamic updating via a proxy to produce a device that is easily integrated into existing honeypot frameworks.

KW - Emulator

KW - Honeypot

KW - Industrial control systems

KW - Proxy

UR - http://www.scopus.com/inward/record.url?scp=84996931609&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-48737-3_5

DO - 10.1007/978-3-319-48737-3_5

M3 - Conference contribution

AN - SCOPUS:84996931609

SN - 9783319487366

T3 - IFIP Advances in Information and Communication Technology

SP - 83

EP - 98

BT - Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers

A2 - Shenoi, Sujeet

A2 - Rice, Mason

PB - Springer New York LLC

T2 - 10th IFIP WG 11.10 International Conference on Critical Infrastructure Protection X, ICCIP 2016

Y2 - 14 March 2016 through 16 March 2016

ER -

Girtz K, Mullins B, Rice M, Lopez J. Practical application layer emulation in industrial control system honeypots. In Shenoi S, Rice M, editors, Critical Infrastructure Protection X - 10th IFIP WG 11.10 International Conference, ICCIP 2016, Revised Selected Papers. Springer New York LLC. 2016. p. 83-98. (IFIP Advances in Information and Communication Technology). doi: 10.1007/978-3-319-48737-3_5

Practical application layer emulation in industrial control system honeypots

Abstract

Publication series

Conference

Keywords

UN SDGs

Access to Document

Other files and links

Fingerprint

Cite this