Design and implementation of high-interaction programmable logic controller honeypot system based on industrial control business simulation

doi:10.11772/j.issn.1001-9081.2019122214

Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (9): 2650-2656.DOI: 10.11772/j.issn.1001-9081.2019122214

• Cyber security • Previous Articles Next Articles

Design and implementation of high-interaction programmable logic controller honeypot system based on industrial control business simulation

ZHAO Guoxin¹, DING Ruofan^2,3, YOU Jianzhou³, LYU Shichao³, PENG Feng¹, LI Fei¹, SUN Limin³

1. College of Information Engineering, Beijing Institute of Petrochemical Technology, Beijing 102617, China;
2. College of Information Science and Technology, Beijing University of Chemical Technology, Beijing 100020, China;
3. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100089, China

Received:2020-01-03 Revised:2020-03-01 Online:2020-09-10 Published:2020-07-06
Supported by:
This work is partially supported by the National Key Research and Development Program of China (2018YFC1201102), the Key Research and Development Program of Guangdong Province (2019B010137004), the Science and Technology Project of Headquarter of State Grid Corporation of China (522722180007).

基于工控业务仿真的高交互可编程逻辑控制器蜜罐系统设计实现

赵国新¹, 丁若凡^2,3, 游建舟³, 吕世超³, 彭锋¹, 李菲¹, 孙利民³

1. 北京石油化工学院信息工程学院, 北京 102617;
2. 北京化工大学信息科学与技术学院, 北京 100020;
3. 中国科学院信息工程研究所, 北京 100089

通讯作者: 游建舟
作者简介:赵国新(1963-),男,辽宁铁岭人,教授,硕士,主要研究方向:智能控制、工控安全;丁若凡(1995-),男,江苏扬州人,硕士研究生,主要研究方向:工控安全、蜜罐技术;游建舟(1992-),男,福建龙岩人,博士研究生,主要研究方向:工控安全、物联网安全、蜜罐技术;吕世超(1985-),男,河北保定人,助理研究员,博士研究生,主要研究方向:无线通信安全、工控安全;彭锋(1993-),男,湖北黄冈人,硕士研究生,主要研究方向:智能控制、工控安全;李菲(1994-),女,北京人,硕士研究生,主要研究方向:工控安全、故障诊断;孙利民(1966-),男,河南淮阳人,研究员,博士,主要研究方向:工控安全、物联网安全。
基金资助:
国家重点研发计划项目（2018YFC1201102）；广东省重点研发计划项目（2019B010137004）；国家电网公司总部科技项目（522722180007）。

Abstract

Abstract: The capability of entrapment is significantly influenced by the degree of simulation in industrial control honeypots. In view of the lack of business logic simulation of existing industrial control honeypots, the high-interaction Programmable Logic Controller (PLC) honeypot design framework and implementation method based on industrial control business simulation were proposed. First, based on the interaction level of industrial control system, a new classification method of Industrial Control System (ICS) honeypots was proposed. Then, according to different simulation dimensions of ICS devices, the entrapment process in honeypot was divided into a process simulation cycle and a service simulation cycle. Finally, in order to realize the real-time response to business logic data, the process data was transferred to the service simulation cycle through a customized data transfer module. Combining typical ICS honeypot software Conpot and the modeling simulation tool Matlab/Simulink, the experiments were carried out with Siemens S7-300 PLC device as the reference, and so as to realize the collaborative work of information service simulation and control process simulation. The experimental results show that compared with Conpot, the proposed PLC honeypot system newly adds 11 private functions of Siemens S7 devices. Especially, the operating read (function code 04 Read) and write (function code 05 Write) in the new functions realize 7 channel monitoring for I area data and 1 channel control for Q area data in PLC. This new honeypot system breaks through the limitations of existing interaction levels and methods and finds new directions for ICS honeypot design.

Key words: honeypot, Industrial Control System (ICS), Conpot, high-interaction, S7comm private function

摘要： 工控蜜罐的诱捕能力受仿真程度显著影响，针对现有工控蜜罐缺乏业务逻辑仿真的问题，提出了一种基于工控业务仿真的高交互可编程逻辑控制器（PLC）蜜罐设计框架和搭建方法。首先，基于工控系统的交互层次提出了一种新的工控系统（ICS）蜜罐分类方法；然后，根据工控设备的不同仿真维度，将蜜罐诱捕过程分为过程仿真循环和服务仿真循环；最后，通过定制的数据转存模块将过程数据转换到服务仿真循环中，以实现业务逻辑数据的实时响应。实验以西门子S7-300 PLC设备为参考，结合典型工控蜜罐软件Conpot和建模仿真工具Matlab/Simulink，实现了信息服务仿真和控制过程仿真的协同工作。实验结果表明，相较于Conpot，高交互PLC蜜罐系统新增了11种西门子S7设备私有功能，其中读（04 Read功能码）写（05 Write功能码）操作实现了对PLC的I区7个通道的监测和Q区1个通道的控制。这种全新的蜜罐系统突破了现有交互层次和方式的局限，为工控蜜罐设计拓展了新方向。

关键词: 蜜罐, 工控系统, Conpot, 高交互, S7comm私有功能

CLC Number:

TP393.08

ZHAO Guoxin, DING Ruofan, YOU Jianzhou, LYU Shichao, PENG Feng, LI Fei, SUN Limin. Design and implementation of high-interaction programmable logic controller honeypot system based on industrial control business simulation[J]. Journal of Computer Applications, 2020, 40(9): 2650-2656.

赵国新, 丁若凡, 游建舟, 吕世超, 彭锋, 李菲, 孙利民. 基于工控业务仿真的高交互可编程逻辑控制器蜜罐系统设计实现[J]. 计算机应用, 2020, 40(9): 2650-2656.

References

[1] 范文斌. 工业控制协议安全防护分析[J]. 电子科学技术, 2015,2(3):334-337.(FAN W B. Analysis of security protection on industrial control protocol[J]. Electronic Science and Technology,2015,2(3):334-337.)
[2] 国家计算机网络应急技术处理协调中心. 2011年中国互联网网络安全态势报告[J]. 信息网络安全,2012,12(4):98-100. (National Computer Network Emergency Response Technical Team/Coordination Center of China. 2011 China Internet network security situation report[J]. Netinfo Security,2012,12(4):98-100.)
[3] GUPTA J N D, SHARMA S K. Handbook of Research on Information Security and Assurance[M]. Hershey, PA:Information Science Reference,2008:527-532.
[4] NARUOKA H,MATSUTA M,MACHⅡ W,et al. ICS honeypot system(CamouflageNet) based on attacker's human factors[J]. Procedia Manufacturing,2015,3:1074-1081.
[5] SIMÕES P,CRUZ T,PROENÇA J,et al. Specialized honeypots for SCADA systems[M]//LEHTO M,NEITTAANMÄKI P. Cyber Security:Analytics,Technology and Automation,ISCA 78. Cham:Springer,2015:251-269.
[6] IRVENE C,FORMBY D,LITCHFIELD S,et al. HoneyBot:a honeypot for robotic systems[J]. Proceedings of the IEEE,2018, 106(1):61-70.
[7] PROVOS N. A virtual honeypot framework[C]//Proceedings of the 13th USENIX Security Symposium. Berkeley:USENIX Association,2004:1-14.
[8] POTHAMSETTY V, FRANZ M. SCADA HoneyNet project:building honeypots for industrial networks[EB/OL].[2019-10-29]. http://scadahoneynet.sourceforge.net/.
[9] TAMMINEN U. Kippo-SSH honeypot[EB/OL].[2019-10-29]. https://github.com/desaster/kippo.
[10] MushMush. Conpot:ICS/SCADA honeypot[EB/OL].[2019-04-06]. https://github.com/mushorg/conpot.
[11] BUZA D I,JUHÁSZ F,MIRU G,et al. CryPLH:protecting smart energy systems from targeted attacks with a PLC honeypot[C]//Proceedings of the 2014 International Workshop on Smart Grid Security,LNCS 8448. Cham:Springer,2014:181-192.
[12] Cowrie Project. Cowrie SSH/Telnet honeypot[EB/OL].[2019-10-29]. https://github.com/cowrie/cowrie.
[13] LAU S,KLICK J,ARNDT S,et al. POSTER:towards highly interactive honeypots for industrial control systems[C]//Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM,2016:1823-1825.
[14] LITCHFIELD S,FORMBY D,ROGERS J,et al. Rethinking the honeypot for cyber-physical systems[J]. IEEE Internet Computing,2016,20(5):9-17.
[15] KYUNG S,HAN W,TIWARI N,et al. HoneyProxy:design and implementation of next-generation honeynet via SDN[C]//Proceedings of the 2017 IEEE Conference on Communications and Network Security. Piscataway:IEEE,2017:1-9.
[16] 游建舟, 张悦阳, 吕世超, 等. 基于数据包分片的工控蜜罐识别方法[J]. 信息安全学报,2019,4(3):83-92.(YOU J Z, ZHANG Y Y, LYU S C, et al. Method of ICS honeypot identification based on packet-sharding[J]. Journal of Cyber Security,2019,4(3):83-92.)

Design and implementation of high-interaction programmable logic controller honeypot system based on industrial control business simulation

基于工控业务仿真的高交互可编程逻辑控制器蜜罐系统设计实现

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 5

Recommended Articles

Metrics

[1]	LIU Yukun, ZHUGE Jianwei, WU Yixiong. Threat and defense of new ransomware worm in industrial control system [J]. Journal of Computer Applications, 2018, 38(6): 1608-1613.
[2]	BAI Qing SU Yang. Design of distributed honeypot system based on clustering and data shunting algorithm [J]. Journal of Computer Applications, 2013, 33(04): 1077-1080.
[3]	. Overview of Botnet [J]. Journal of Computer Applications, 2006, 26(7): 1628-1630.
[4]	. Implementation of honeypot system for detecting unknown attacks [J]. Journal of Computer Applications, 2006, 26(10): 2336-2337.
[5]	CHEN Ling,HUANG Hao. Design of a deception-based intrusion prevention model [J]. Journal of Computer Applications, 2005, 25(09): 2074-2077.