Accession Number : AD1044935


Title :   Using Honeynets and the Diamond Model for ICS Threat Analysis


Descriptive Note : Technical Report


Corporate Author : CARNEGIE-MELLON UNIV PITTSBURGH PA PITTSBURGH United States


Personal Author(s) : Kotheimer,John ; OMeara,Kyle ; Shick,Deana


Full Text : https://apps.dtic.mil/dtic/tr/fulltext/u2/1044935.pdf


Report Date : 11 May 2016


Pagination or Media Count : 39


Abstract : The use of a honeyneta network of seemingly vulnerable machines designed to lure attackersis an established technique for collecting threat intelligence across various network environments. As a result, organizations have begun to use this approach to protect networked industrial control systems (ICS). Organizations hope to observe attempts to compromise their systems in an isolated environment, enabling them to deploy mitigations and harden their networks against emerging threats. This report presents an approach to analyzing approximately 16 gigabytes of full packet capture data collected from an ICS honeynet. The data is analyzed in the context of other open source information about known threats to ICS to understand how adversaries interacted with the net-work and the types of attacks they attempted. To provide a more rigorous approach to characterizing these threat actors, the study employed the well-known Diamond Model of Intrusion Analysis. It applied this model to define and categorize several groups of potential threat actors observed within the data. The study also evaluated the effectiveness of honeynets as a tool for ICS threat intelligence. This report includes several recommendations for their deployment and emphasizes active interaction with external hosts to generate higher quality data.


Descriptors :   CYBER DEFENSE TECHNIQUES , COMPUTER SECURITY , COMPUTER SECURITY TECHNIQUES , NETWORK SECURITY TECHNIQUES , COMPUTER NETWORK SECURITY , COMPUTER NETWORKS


Subject Categories : Computer Systems
      Computer Systems Management and Standards


Distribution Statement : APPROVED FOR PUBLIC RELEASE