Dynamic Honeypot Configuration for Programmable Logic Controller Emulation
Technical Report,01 Sep 2014,24 Mar 2016
AIR FORCE INSTITUTE OF TECHNOLOGY WRIGHT-PATTERSON AFB OH WRIGHT-PATTERSON AFB United States
Pagination or Media Count:
This research develops an enhanced, application layer emulator capable of alleviating honey net scalability and honeypot inauthenticity limitations. The proposed emulator combines protocol-agnostic replay with dynamic updating via a proxy. The result is a software tool which can be readily integrated into existing honeypot frameworks for improved performance. The proposed emulator is evaluated on traffic reduction on the back-end proxy device, application layer task accuracy, and byte-level traffic accuracy. Experiments show the emulator is able to successfully reduce the load on the proxy device by up to 98 for some protocols. The emulator also provides equal or greater accuracy over a design which does not use a proxy. At the byte level, traffic variation is statistically equivalent while task success rates increase by 14 to 90 depending on the protocol. Finally, of the proposed proxy synchronization algorithms, temp lock and its minimal variant are found to provide the best overall performance.
- Computer Systems Management and Standards