ICS Honeypot Interactions: A Latitudinal Study

Francesco Lupia; Marco Lucchese; Massimo Merro; Nicola Zannone

doi:10.1109/BigData59044.2023.10386497

ICS Honeypot Interactions: A Latitudinal Study

Francesco Lupia, Marco Lucchese, Massimo Merro, Nicola Zannone

Data Protection

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

13 Citations (Scopus)

23 Downloads (Pure)

Abstract

The recent proliferation of sophisticated threats targeting the plant of Industrial Control Systems (ICSs) has triggered a growing interest in the development of dedicated honeypots/honeynets in which the emulation of Operational Technology (OT) components plays a major role. This work presents a latitudinal study on a dataset comprising both IT and ICS interactions collected from an instance of an ICS honeynet emulating ICS devices exposed on the Internet for three months. The study focuses on three orthogonal aspects of such interactions: level of interaction, origin of interactions, and interaction/attack patterns. Our results shed light on the impact of different choices in the configuration of a honeynet on its attractiveness and on the captured behavior.

Original language	English
Title of host publication	2023 IEEE International Conference on Big Data, BigData 2023
Editors	Jingrui He, Themis Palpanas, Xiaohua Hu, Alfredo Cuzzocrea, Dejing Dou, Dominik Slezak, Wei Wang, Aleksandra Gruca, Jerry Chun-Wei Lin, Rakesh Agrawal
Publisher	Institute of Electrical and Electronics Engineers
Pages	3025-3034
Number of pages	10
ISBN (Electronic)	979-8-3503-2445-7
DOIs	https://doi.org/10.1109/BigData59044.2023.10386497
Publication status	Published - 22 Jan 2024
Event	2023 IEEE International Conference on Big Data, BigData 2023 - Sorrento, Italy Duration: 15 Dec 2023 → 18 Dec 2023

Conference

Conference	2023 IEEE International Conference on Big Data, BigData 2023
Country/Territory	Italy
City	Sorrento
Period	15/12/23 → 18/12/23

Funding

Part of this work was supported by project SERICS (PE00000014) under the MUR National Recovery and Resilience Plan funded by the EU - NextGenerationEU.

Funders	Funder number
European Commission

Keywords

data analysis
honeypots
Industrial control systems
threat intelligence

Access to Document

10.1109/BigData59044.2023.10386497

pdfFinal published version, 411 KBLicence: TAVERNE

Cite this

Lupia, F., Lucchese, M., Merro, M., & Zannone, N. (2024). ICS Honeypot Interactions: A Latitudinal Study. In J. He, T. Palpanas, X. Hu, A. Cuzzocrea, D. Dou, D. Slezak, W. Wang, A. Gruca, J. C.-W. Lin, & R. Agrawal (Eds.), 2023 IEEE International Conference on Big Data, BigData 2023 (pp. 3025-3034). Article 10386497 Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/BigData59044.2023.10386497

Lupia, Francesco ; Lucchese, Marco ; Merro, Massimo et al. / ICS Honeypot Interactions : A Latitudinal Study. 2023 IEEE International Conference on Big Data, BigData 2023. editor / Jingrui He ; Themis Palpanas ; Xiaohua Hu ; Alfredo Cuzzocrea ; Dejing Dou ; Dominik Slezak ; Wei Wang ; Aleksandra Gruca ; Jerry Chun-Wei Lin ; Rakesh Agrawal. Institute of Electrical and Electronics Engineers, 2024. pp. 3025-3034

@inproceedings{753aa562dfbd460ab69685361fee9c9e,

title = "ICS Honeypot Interactions: A Latitudinal Study",

abstract = "The recent proliferation of sophisticated threats targeting the plant of Industrial Control Systems (ICSs) has triggered a growing interest in the development of dedicated honeypots/honeynets in which the emulation of Operational Technology (OT) components plays a major role. This work presents a latitudinal study on a dataset comprising both IT and ICS interactions collected from an instance of an ICS honeynet emulating ICS devices exposed on the Internet for three months. The study focuses on three orthogonal aspects of such interactions: level of interaction, origin of interactions, and interaction/attack patterns. Our results shed light on the impact of different choices in the configuration of a honeynet on its attractiveness and on the captured behavior.",

keywords = "data analysis, honeypots, Industrial control systems, threat intelligence",

author = "Francesco Lupia and Marco Lucchese and Massimo Merro and Nicola Zannone",

year = "2024",

month = jan,

day = "22",

doi = "10.1109/BigData59044.2023.10386497",

language = "English",

pages = "3025--3034",

editor = "Jingrui He and Themis Palpanas and Xiaohua Hu and Alfredo Cuzzocrea and Dejing Dou and Dominik Slezak and Wei Wang and Aleksandra Gruca and Lin, {Jerry Chun-Wei} and Rakesh Agrawal",

booktitle = "2023 IEEE International Conference on Big Data, BigData 2023",

publisher = "Institute of Electrical and Electronics Engineers",

address = "United States",

note = "2023 IEEE International Conference on Big Data, BigData 2023 ; Conference date: 15-12-2023 Through 18-12-2023",

}

Lupia, F, Lucchese, M, Merro, M & Zannone, N 2024, ICS Honeypot Interactions: A Latitudinal Study. in J He, T Palpanas, X Hu, A Cuzzocrea, D Dou, D Slezak, W Wang, A Gruca, JC-W Lin & R Agrawal (eds), 2023 IEEE International Conference on Big Data, BigData 2023., 10386497, Institute of Electrical and Electronics Engineers, pp. 3025-3034, 2023 IEEE International Conference on Big Data, BigData 2023, Sorrento, Italy, 15/12/23. https://doi.org/10.1109/BigData59044.2023.10386497

ICS Honeypot Interactions: A Latitudinal Study. / Lupia, Francesco; Lucchese, Marco; Merro, Massimo et al.
2023 IEEE International Conference on Big Data, BigData 2023. ed. / Jingrui He; Themis Palpanas; Xiaohua Hu; Alfredo Cuzzocrea; Dejing Dou; Dominik Slezak; Wei Wang; Aleksandra Gruca; Jerry Chun-Wei Lin; Rakesh Agrawal. Institute of Electrical and Electronics Engineers, 2024. p. 3025-3034 10386497.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - ICS Honeypot Interactions

T2 - 2023 IEEE International Conference on Big Data, BigData 2023

AU - Lupia, Francesco

AU - Lucchese, Marco

AU - Merro, Massimo

AU - Zannone, Nicola

PY - 2024/1/22

Y1 - 2024/1/22

N2 - The recent proliferation of sophisticated threats targeting the plant of Industrial Control Systems (ICSs) has triggered a growing interest in the development of dedicated honeypots/honeynets in which the emulation of Operational Technology (OT) components plays a major role. This work presents a latitudinal study on a dataset comprising both IT and ICS interactions collected from an instance of an ICS honeynet emulating ICS devices exposed on the Internet for three months. The study focuses on three orthogonal aspects of such interactions: level of interaction, origin of interactions, and interaction/attack patterns. Our results shed light on the impact of different choices in the configuration of a honeynet on its attractiveness and on the captured behavior.

AB - The recent proliferation of sophisticated threats targeting the plant of Industrial Control Systems (ICSs) has triggered a growing interest in the development of dedicated honeypots/honeynets in which the emulation of Operational Technology (OT) components plays a major role. This work presents a latitudinal study on a dataset comprising both IT and ICS interactions collected from an instance of an ICS honeynet emulating ICS devices exposed on the Internet for three months. The study focuses on three orthogonal aspects of such interactions: level of interaction, origin of interactions, and interaction/attack patterns. Our results shed light on the impact of different choices in the configuration of a honeynet on its attractiveness and on the captured behavior.

KW - data analysis

KW - honeypots

KW - Industrial control systems

KW - threat intelligence

UR - http://www.scopus.com/inward/record.url?scp=85184986206&partnerID=8YFLogxK

U2 - 10.1109/BigData59044.2023.10386497

DO - 10.1109/BigData59044.2023.10386497

M3 - Conference contribution

AN - SCOPUS:85184986206

SP - 3025

EP - 3034

BT - 2023 IEEE International Conference on Big Data, BigData 2023

A2 - He, Jingrui

A2 - Palpanas, Themis

A2 - Hu, Xiaohua

A2 - Cuzzocrea, Alfredo

A2 - Dou, Dejing

A2 - Slezak, Dominik

A2 - Wang, Wei

A2 - Gruca, Aleksandra

A2 - Lin, Jerry Chun-Wei

A2 - Agrawal, Rakesh

PB - Institute of Electrical and Electronics Engineers

Y2 - 15 December 2023 through 18 December 2023

ER -

Lupia F, Lucchese M, Merro M, Zannone N. ICS Honeypot Interactions: A Latitudinal Study. In He J, Palpanas T, Hu X, Cuzzocrea A, Dou D, Slezak D, Wang W, Gruca A, Lin JCW, Agrawal R, editors, 2023 IEEE International Conference on Big Data, BigData 2023. Institute of Electrical and Electronics Engineers. 2024. p. 3025-3034. 10386497 doi: 10.1109/BigData59044.2023.10386497

ICS Honeypot Interactions: A Latitudinal Study

Abstract

Conference

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this