Abstract:Cyber Security is a critical topic for organizations with IT/OT networks as they are always susceptible to attack, whether insider or outsider. Since the cyber landscape is an ever-evolving scenario, one must keep upgrading its security systems to enhance the security of the infrastructure. Tools like Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Threat Intelligence Platform (TIP), Information Technology Service Management (ITSM), along with other defensive techniques like Intrusion Detection System (IDS), Intrusion Protection System (IPS), and many others enhance the cyber security posture of the infrastructure. However, the proposed protection mechanisms have their limitations, they are insufficient to ensure security, and the attacker penetrates the network. Deception technology, along with Honeypots, provides a false sense of vulnerability in the target systems to the attackers. The attacker deceived reveals threat intel about their modus operandi. We have developed a Security Orchestration, Automation, and Response (SOAR) Engine that dynamically deploys custom honeypots inside the internal network infrastructure based on the attacker's behavior. The architecture is robust enough to support multiple VLANs connected to the system and used for orchestration. The presence of botnet traffic and DDOS attacks on the honeypots in the network is detected, along with a malware collection system. After being exposed to live traffic for four days, our engine dynamically orchestrated the honeypots 40 times, detected 7823 attacks, 965 DDOS attack packets, and three malicious samples. While our experiments with static honeypots show an average attacker engagement time of 102 seconds per instance, our SOAR Engine-based dynamic honeypots engage attackers on average 3148 seconds.

DiPot: A Distributed Industrial Honeypot System.

A High-interaction Physics-aware ICS Honeypot for Industrial Environments

NeuPot: A Neural Network-Based Honeypot for Detecting Cyber Threats in Industrial Control Systems

A Survey of Industrial Control System Devices on the Internet

Analysis of ICS and SCADA Systems Attacks Using Honeypots.

S7commTrace: A High Interactive Honeypot for Industrial Control System Based on S7 Protocol.

Early Intrusion Detection System using honeypot for industrial control networks

AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

LLMPot: Automated LLM-based Industrial Protocol and Physical Process Emulation for ICS Honeypots

Honeyeye: A Network Traffic Collection Framework for Distributed ICS Honeynets

An IoT Honeynet Based on Multiport Honeypots for Capturing IoT Attacks

Security Orchestration, Automation, and Response Engine for Deployment of Behavioural Honeypots

Anti-Honeypot Enabled Optimal Attack Strategy for Industrial Cyber-Physical Systems.

Containerized cloud-based honeypot deception for tracking attackers

Network Intrusion Detection System Based on Honeypot

Design and Implementation of a Low-interaction Honeypot Based on Apache

Brief Industry Paper: Catching IoT Malware in the Wild Using HoneyIoT

Exploring Shodan from the Perspective of Industrial Control Systems

A Data-Driven Based Security Situational Awareness Framework for Power Systems

Deployment of honeypot cluster system HoneyPool