Medium Interactivity Operational Technology Honeypots for Threat Intelligence

用于威胁情报的中等交互操作技术蜜罐

• 批准号: 2603671
• 金额: --
• 依托单位: University of Bristol
• 依托单位国家: 英国
• 项目类别: Studentship
• 财政年份: 2021
• 资助国家: 英国
• 起止时间: 2021 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=studentship-2603671
• 关键词: Medium; Interactivity; Operational; Technology; Honeypots

Threats towards operational technology and industrial control systems are ever increasing. The landscape has become more perilous due to the increasing connectivity between operational and informational technology sectors. New threats are not only taking the form of sophisticated malware tool sets like Chernovite's "PipeDream" or Sandworm's "CrashOverride", but we are also seeing an increase in generic ransomware attacks originating from the Ransomware-as-a-service trend. In a time where attacks are growing more frequent, it is important that we maintain a flow of threat intelligence to assist in securing these systems.Honeypots have a long history being deployed mimicking Internet-of-Things devices to gather threat intelligence, but their application in the field of operational technology is considerably under-explored. A pivotal issue surrounding this is a lack of research towards effective deployments. Low-interactivity honeypots are not adequately convincing and are only effective for catching automated attacks, whereas high interaction honeypots are far too expensive to deploy on a larger scale.This research aims to explore the creation of a honeypot which strikes a balance between simulation and physical hardware, also known as a medium-interactivity honeypot. Throughout the stages of research, what makes an effective honeypot will be explored from the angle of technological implementation, effective deceptive characteristics, as well as the lawful and ethical deployment of such measures.

对操作技术和工业控制系统的威胁正在不断增加。由于业务和信息技术部门之间的联系日益密切，这一局面变得更加危险。新的威胁不仅以Chernovite的“PipeDream”或Sandworm的“Crashworm”等复杂的恶意软件工具集的形式出现，而且我们还看到源于勒索软件即服务趋势的通用勒索软件攻击的增加。在这个攻击越来越频繁的时代，我们必须保持威胁情报流，以帮助保护这些系统。蜜罐在模仿物联网设备收集威胁情报方面有着悠久的历史，但其在运营技术领域的应用却相当缺乏探索。围绕这一点的一个关键问题是缺乏对有效部署的研究。低交互性蜜罐的说服力不足，只能有效地捕捉自动化攻击，而高交互性蜜罐是太昂贵了，部署在更大的规模。本研究旨在探索创建一个蜜罐之间取得平衡的模拟和物理硬件，也被称为一个中等交互性蜜罐。在整个研究阶段，是什么使一个有效的蜜罐将从技术实施的角度，有效的欺骗性特征，以及这些措施的合法和道德的部署进行探讨。