Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks
- Idaho National Lab. (INL), Idaho Falls, ID (United States)
A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, an established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% of the monitored emulated devices.
- Research Organization:
- Idaho National Laboratory (INL), Idaho Falls, ID (United States)
- Sponsoring Organization:
- USDOE
- Grant/Contract Number:
- AC07-05ID14517
- OSTI ID:
- 1136315
- Report Number(s):
- INL/JOU-14-32392; TRN: US1500453
- Journal Information:
- IEEE Transactions on Industrial Informatics, Vol. 10, Issue 2; ISSN 1551-3203
- Publisher:
- IEEECopyright Statement
- Country of Publication:
- United States
- Language:
- English
Web of Science
Security Attacks in Wireless Sensor Networks: A Survey
|
book | January 2018 |
Research on information security system of waste terminal disposal process
|
journal | May 2017 |
Cyber Physical System (CPS)-Based Industry 4.0: A Survey
|
journal | September 2017 |
Similar Records
PMU Data Integrity Evaluation through Analytics on a Virtual Test-Bed
Ten million and one penguins, or, lessons learned from booting millions of virtual machines on HPC systems.