清晨好,您是今天最早来到科研通的研友!由于当前在线用户较少,发布求助请尽量完整地填写文献信息,科研通机器人24小时在线,伴您科研之路漫漫前行!

HoneyJudge: A PLC Honeypot Identification Framework Based on Device Memory Testing

蜜罐 计算机科学 鉴定(生物学) 嵌入式系统 操作系统 计算机安全 植物 生物
作者
Hengye Zhu,Mengxiang Liu,Binbin Chen,Xin Che,Peng Cheng,Ruilong Deng
出处
期刊:IEEE Transactions on Information Forensics and Security [Institute of Electrical and Electronics Engineers]
卷期号:19: 6028-6043 被引量:1
标识
DOI:10.1109/tifs.2024.3407520
摘要

The widespread use of programmable logic controllers (PLCs) in critical infrastructures has given rise to escalating cybersecurity concerns regarding PLC attacks. As a proactive defense mechanism, PLC honeypots emulate genuine controllers to engage adversaries so as to observe their attack tactics and techniques. As part of the arms race between the offense and defense, multiple PLC honeypot identification tools have been developed. However, many existing tools cannot recognize high-fidelity honeypots, since they rely on identifying common network services and fingerprints. In this paper, we propose an innovative and practical honeypot identification framework called HoneyJudge , which goes beyond state-of-the-art (SOTA) network fingerprint-based identification tools like Nmap and the PLCScan tool. HoneyJudge tests the suspected target's special memory content and features. Specifically, HoneyJudge models the internal memory of a PLC in three categories, from system-level, user-level, to process-level categories, based on which it extracts six representative memory features. All characteristics are acquired through automated network request messages. Then, we design a weighted voting algorithm to combine the test results over different memory features to reach the final conclusion. We validate the effectiveness of HoneyJudge in comparison with several SOTA honeypot identification tools, and the results indicate that the memory-related issues have not been well addressed in existing PLC honeypots and still need substantial research efforts.
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
2秒前
任性翠安完成签到 ,获得积分10
5秒前
蓝桉完成签到 ,获得积分10
6秒前
李健应助科研通管家采纳,获得30
6秒前
乐观的星月完成签到 ,获得积分10
9秒前
hzauhzau完成签到 ,获得积分10
11秒前
亚尔完成签到 ,获得积分10
11秒前
jiujieweizi完成签到 ,获得积分10
22秒前
SYLH应助ly普鲁卡因采纳,获得10
23秒前
shuangfeng1853完成签到 ,获得积分10
27秒前
ly普鲁卡因完成签到,获得积分10
42秒前
47秒前
efren1806完成签到,获得积分10
51秒前
52秒前
奋斗的妙海完成签到 ,获得积分0
56秒前
lisa完成签到 ,获得积分10
1分钟前
qqaeao完成签到,获得积分10
1分钟前
魔幻的妖丽完成签到 ,获得积分10
1分钟前
Cell完成签到 ,获得积分10
1分钟前
砳熠完成签到 ,获得积分10
1分钟前
israr完成签到,获得积分10
1分钟前
1分钟前
迅速千愁完成签到 ,获得积分10
1分钟前
SDS完成签到 ,获得积分10
1分钟前
下颌磨牙钳完成签到 ,获得积分10
1分钟前
1分钟前
曾经不言完成签到 ,获得积分10
1分钟前
1分钟前
yxdjzwx发布了新的文献求助10
2分钟前
思源应助科研通管家采纳,获得10
2分钟前
大个应助科研通管家采纳,获得10
2分钟前
2分钟前
xhsz1111完成签到 ,获得积分10
2分钟前
shining完成签到,获得积分10
2分钟前
2分钟前
思源应助yxdjzwx采纳,获得10
2分钟前
xun完成签到,获得积分10
2分钟前
2分钟前
涵涵涵hh完成签到 ,获得积分10
2分钟前
Lrcx完成签到 ,获得积分10
2分钟前
高分求助中
A new approach to the extrapolation of accelerated life test data 1000
Cognitive Neuroscience: The Biology of the Mind 1000
Technical Brochure TB 814: LPIT applications in HV gas insulated switchgear 1000
Immigrant Incorporation in East Asian Democracies 600
Nucleophilic substitution in azasydnone-modified dinitroanisoles 500
不知道标题是什么 500
A Preliminary Study on Correlation Between Independent Components of Facial Thermal Images and Subjective Assessment of Chronic Stress 500
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 3968543
求助须知:如何正确求助?哪些是违规求助? 3513358
关于积分的说明 11167312
捐赠科研通 3248700
什么是DOI,文献DOI怎么找? 1794453
邀请新用户注册赠送积分活动 875030
科研通“疑难数据库(出版商)”最低求助积分说明 804664