Medium Interactivity Operational Technology Honeypots for Threat Intelligence

对操作技术和工业控制系统的威胁日益增加。由于业务和信息技术部门之间的联系日益紧密，形势变得更加危险。新的威胁不仅以复杂的恶意软件工具集的形式出现，如Chernovite的“PipeDream”或Sandworm的“CrashOverride”，而且我们也看到了来自勒索软件即服务趋势的通用勒索软件攻击的增加。在攻击日益频繁的时代，我们保持威胁情报的流动以协助保护这些系统是很重要的。蜜罐在模拟物联网设备收集威胁情报方面已经有很长的历史，但它们在操作技术领域的应用还没有得到充分的探索。围绕这个问题的一个关键问题是缺乏对有效部署的研究。低交互性的蜜罐没有足够的说服力，只对捕获自动化攻击有效，而高交互性的蜜罐过于昂贵，无法大规模部署。本研究旨在探索在仿真和物理硬件之间取得平衡的蜜罐的创建，也称为中等交互性蜜罐。在整个研究阶段，将从技术实施、有效欺骗特征以及这些措施的合法和道德部署的角度来探索有效蜜罐的构成。

Threats towards operational technology and industrial control systems are ever increasing. The landscape has become more perilous due to the increasing connectivity between operational and informational technology sectors. New threats are not only taking the form of sophisticated malware tool sets like Chernovite's "PipeDream" or Sandworm's "CrashOverride", but we are also seeing an increase in generic ransomware attacks originating from the Ransomware-as-a-service trend. In a time where attacks are growing more frequent, it is important that we maintain a flow of threat intelligence to assist in securing these systems.Honeypots have a long history being deployed mimicking Internet-of-Things devices to gather threat intelligence, but their application in the field of operational technology is considerably under-explored. A pivotal issue surrounding this is a lack of research towards effective deployments. Low-interactivity honeypots are not adequately convincing and are only effective for catching automated attacks, whereas high interaction honeypots are far too expensive to deploy on a larger scale.This research aims to explore the creation of a honeypot which strikes a balance between simulation and physical hardware, also known as a medium-interactivity honeypot. Throughout the stages of research, what makes an effective honeypot will be explored from the angle of technological implementation, effective deceptive characteristics, as well as the lawful and ethical deployment of such measures.