Industrial control network honeypot system

Abstract

The invention discloses an industrial control network honeypot system, which comprises an external network honeypot node, an internal network honeypot node, a honeypot management system, Internt and a PC. The beneficial effects of the present invention are: the external network honeypot node can help users set up a disguised "business system" around the IP address of the core server, and induce attackers by constructing a real industry business SCADA template, thereby protecting the real business system, honeypot The management system can simulate SCADA and PLC system services, and can switch to different business types according to the multi-service templates preset in the system, making it impossible for attackers to distinguish the real attack target. The industrial control protocol simulation module creates a real industrial control system for attackers. The operating environment of the service, any operation and scanning attack behavior of the attacker will be recorded by the data analysis function of the honeypot system.

Description

technical field [0001] The invention relates to a honeypot system, in particular to an industrial control network honeypot system, which belongs to the technical field of network security. Background technique [0002] A honeypot is a security resource whose value lies in being detected, attacked or compromised. Honeypot technology is a way to lure intruders through false resources, thereby collecting hacker attack data and analyzing hacker attack behavior, so as to protect the real Decoy techniques for host targets. This means that the honeypot is a pre-configured system. The system may contain certain loopholes, or contain various forged documents and information to deceive hackers into attacking and invading the honeypot. The significance of the existence of the honeypot system It lies in being detected and attacked. Any interaction with the honeypot can be considered an attack. Therefore, through the monitoring of the honeypot, the behavior of the attacker can be discov...

AI Technical Summary

Problems solved by technology

[0003] However, once the currently used honeypot system is compromised, the risk may be brought into the system where the honeypot is located. The honeypot may be used as a springboard to attack other systems, causing serious consequences and having a great impact on data collection. Limitation, the honeypot can only function when the attacker launches an attack on it, and if the attacker launches an attack on other systems in the network where the honeypot is located, the honeypot will not be aware of the existence of the attack. Fingerprint identification of the existing honeypot technology. When an attacker finds that a honeypot is used to detect attacks, the attacker will avoid any further activities in the system. The attacker may also notify other parties of this discovery. attackers, so that all attackers will avoid the honeypot, or deliberately attack it

Images