Multimode honeypot system and data analysis method thereof

Abstract

The invention discloses a multimode honeypot system and a data analysis method thereof. The system comprises a plurality of single-node honeypot systems, and the single-node honeypot systems are connected with each other to form a network topological structure. The method comprises the steps: obtaining the original data of each single-node honeypot system; carrying out the feature screening of the original data through a PCA (principal component analysis) method, and obtaining the intermediate data; carrying out the clustering analysis and supervised learning of the intermediate data, and obtaining a plurality of clusters, wherein each cluster comprises a plurality of examples; carrying out the association rule extraction of an hostile attack command in each cluster; taking the extracted association rules as the attack features, and storing the attack features in a feature mark set.

Description

technical field [0001] The invention relates to the technical field of industrial control system security, in particular to a multi-node honeypot system oriented to industrial control system security and a data analysis method thereof. Background technique [0002] It is a common and mature solution in the security field to use honeypots to simulate specific devices to attract attacks, and then analyze the attack methods to extract attack signatures and fingerprints. However, in the emerging field of industrial security, only a few honeypots such as CONPOT, XPOT, DIGITALBONDSCADA HONEYNET simulate a single programmable logic control (PLC, Programmable Logic Controller) device. [0003] CONPOT, as the current mainstream open source low-interaction industrial control honeypot, emulates a single PLC device on the host by embedding protocols such as Modbus and SiemensS7Comm and opening specific ports 502 and 102. [0004] XPOT supports PLC program compilation and interpretatio...

AI Technical Summary

Problems solved by technology

Even if a single honeypot that simulates industrial control equipment is highly simulated, it is impossible to attract attackers to scan and read and write operations

In addition, the ultimate purpose of the honeypot is to extract key scanning and attack signature fingerprints. Currently, there is no method for extracting scanning attack signatures for PLC equipment and systems that can be realized in the industry and scientific research circles.

Images