Towards Very-High Interaction Honeypots for ICS: a Proof of Concept

The secure operation of Industrial Control Systems (ICS) is a critical requirement for ensuring the safety of the plants and of the people involved in the industrial processes they control. The advent of Industrial IoT devices boosted the innovation in the development of new industrial applications but at the same time it determined an increase of the attack surface and of the number of vulnerabilities that can be exploited by malicious entities. Honeypots are a technology whose goal is to deceive attackers by emulating a real system for allowing the gathering of relevant information about the malicious activity which can be later used to devise suitable countermeasures. Honeypots effectiveness mainly depends on the level of realism with which system interactions are reproduced. In this paper we propose a simple yet effective scheme that enable a very high level of interaction for ICS honeypots by resorting to hybrid solution including both hardware and software building blocks.