Fake PLC in the cloud, we thought the attackers believed that: How ICS honeypot deception gets impacted by cloud deployments?

Ivanova, Stanislava; Moradpoor, Naghmeh

Abstract

The Industrial Control System (ICS) industry faces an ever-growing number of cyber threats - defence against which can be strengthened using honeypots. As the systems they mimic, ICS honeypots shall be deployed in a similar context to field ICS systems. This ICS context demands a novel honeypot deployment process, that is more consistent with real ICS systems. State-of-the-art ICS honeypots mainly focus on deployments in cloud environments which could divulge the true intent to cautious adversaries. This experimental research project addresses this limitation by evaluating the deception capability of a public cloud and an on-premise deployment. Results from a 65-day, HoneyPLC experiment show that the on-premise deployment attracts more Denial of Service and Reconnaissance ICS attacks. The results guide future researchers that an on-premise deployment might be more convincing and attract more ICS-relevant interactions.

Citation

Ivanova, S., & Moradpoor, N. (2023, April). Fake PLC in the cloud, we thought the attackers believed that: How ICS honeypot deception gets impacted by cloud deployments?. Presented at WFCS 2023: 19th IEEE International Conference on Factory Communication Systems, Pavia, Italy

• Presentation Conference Type: Conference Paper (Published)
• Conference Name: WFCS 2023: 19th IEEE International Conference on Factory Communication Systems
• Start Date: Apr 26, 2023
• End Date: Apr 28, 2023
• Acceptance Date: Mar 28, 2023
• Online Publication Date: Jun 7, 2023
• Publication Date: 2023
• Deposit Date: Mar 31, 2023
• Publisher: Institute of Electrical and Electronics Engineers
• Pages: 217-220
• Series Title: IEEE International Workshop on Factory Communication Systems
• Series ISSN: 2835-8414
• Book Title: 2023 IEEE 19th International Conference on Factory Communication Systems (WFCS)
• DOI: https://doi.org/10.1109/WFCS57264.2023.10144119
• Keywords: Industrial Control Systems, Critical National Infrastructure, Programmable Logic Controllers, Supervisory Control & Data Acquisition, Industrial Honeypot
• Related Public URLs: https://wfcs23.unipv.it/