Parent-child portable industrial control honeynet system and deployment method

Abstract

The present invention provides a parent-child portable industrial control honeynet system and a deployment method. The parent-child portable industrial control honeynet system includes a portable parent device and a portable child device, both of which are portable miniaturized all-in-one machines that can be directly connected by plugging and unplugging, plug and play, easy to deploy, small in size, convenient to carry, strong networking flexibility, and convenient for arbitrarily changing the position for probe deployment; the portable child device is used as a probe, which is a physical entity machine with a real network card and a real hardware environment. The use of a physical machine has better concealment and is less likely to be discovered by attackers.

Description

Technical Field

[0001] The present invention relates to the field of network security honeypot and industrial control network technology, and in particular to a parent-child portable industrial control honeynet system and a deployment method. Background Art

[0002] As the network security situation becomes increasingly severe, network security attack and defense methods are rapidly iterating. Network security defense has gradually shifted from passive defense to active defense, and honeypot technology has made significant progress. Honeypot technology is to induce attackers to attack, thereby protecting real network assets and collecting attacker information to achieve the role of active defense. However, today's industrial control honeypot technology is still not widely used, deployment is not flexible, costly or easy to be identified by attackers, and it is difficult to achieve the desired purpose due to the inability of industrial control networks to connect to the Internet. Summary of the invention

[0003] In order to solve the above problems, the present invention provides a parent-child portable industrial control honeynet system, which includes a portable mother device and multiple portable child devices; the portable mother device is deployed with a honeynet master service architecture, and serves as a honeynet master server for providing honeypot services; the portable child device is deployed with a network configuration, and serves as a probe for forwarding scanning information to the portable mother device; the portable mother device and the portable child device are both portable miniaturized all-in-one machines, and the portable miniaturized all-in-one machine includes an interface suitable for connecting to an industrial control network.

[0004] Optionally, the interfaces of the portable sub-device and the portable main device are suitable for accessing the industrial control network via a pluggable connection line.

[0005] Optionally, the portable sub-device is deployed with a network configuration of IPVS DR mode.

[0006] Optionally, the portable mother device is deployed with a Docker service.

[0007] Optionally, the interface of the portable sub-device is connected to any switch of the industrial control network via a network cable.

[0008] Optionally, the interface of the portable mother device is connected to any switch of the industrial control network via a network cable.

[0009] Optionally, when any one of the portable child devices is scanned as a probe, the scanning information is forwarded to the portable parent device for reception through traffic forwarding means in IPVS DR mode.

[0010] Optionally, after receiving the scanning information, the portable mother device utilizes the deployed Docker service and uses the Host mode to forward the traffic to its own Docker container.

[0011] Optionally, the portable mother device automatically connects each of the portable child devices in a scripted IPVS DR mode.

[0012] The present invention provides a deployment method of a parent-child portable industrial control honeynet system, which is used to execute the above-mentioned parent-child portable industrial control honeynet system. The method comprises: connecting a portable child device deployed with an IPVS DR mode to any switch of an industrial control network via a network cable as a probe, and setting an IP address to access the subnet; connecting a portable mother device deployed with a honeynet main service architecture to any switch of the industrial control network via a network cable, and setting an IP address to access the subnet; and automatically performing a scripted IPVS DR mode connection on the portable child device through the portable mother device to achieve one-click rapid deployment.

[0013] In the embodiment of the present invention, the parent-child portable industrial control honeynet system includes a portable parent device and a portable child device, both of which are portable miniaturized all-in-one machines that can be directly plugged in and connected, plug and play, easy to deploy, small in size, convenient to carry, and have strong networking flexibility, which is convenient for arbitrarily changing the location for probe deployment; the portable child device is used as a probe, which is a physical entity machine with a real network card and a real hardware environment. The use of a physical machine has better concealment and is less likely to be discovered by attackers. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0015] Figure 1 It is a structural schematic diagram of a parent-child portable industrial control honeynet system in an embodiment of the present invention;

[0016] Figure 2 It is a schematic diagram of the protection process of the parent-child portable industrial control honeynet system in an embodiment of the present invention;

[0017] Figure 3 It is a flow chart of a deployment method of a parent-child portable industrial control honeynet system in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more clearly understood, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0019] The embodiment of the present invention provides a parent-child portable industrial control honeynet system and deployment method, including a portable industrial control honeynet based on IPVSDR mode + Docker, specifically utilizing the traffic forwarding technology of the IPVS DR mode, a portable miniaturized all-in-one machine, a honeynet master service architecture and other technologies.

[0020] The embodiment of the present invention provides a parent-child portable industrial control honeynet system, which includes a portable parent device and a plurality of portable child devices.

[0021] The portable mother device is deployed with the honeynet main service architecture, serving as the honeynet main server to provide honeypot services; the portable child device is deployed with the network configuration, serving as a probe to forward the scan information to the portable mother device. As a probe, several child devices can be installed according to demand, while as a mother device of the honeynet main server, only one is required.

[0022] Both the portable mother device and the portable child device adopt a portable miniaturized integrated machine, which includes an interface suitable for connecting to the industrial control network. By using the portable host as a probe for deployment, it can be directly plugged in and connected on site, plug and play, and easy to deploy. The portable integrated host on the market is small in size, easy to carry, and has strong networking flexibility, which makes it easy to change the location of the probe for deployment.

[0023] Honeypots should have the principle of camouflage and cannot be discovered by attackers. In this embodiment, the honeypot uses a portable miniaturized all-in-one machine as a probe, which is a physical machine with a real network card and real hardware environment, and is less likely to be discovered by attackers. However, most honeypots on the market now use virtual machine technology, such as KVM (Kernel-based Virtual Machine), which is easily identified as a virtual machine by attackers, making it difficult to achieve the purpose of deception.

[0024] Exemplarily, the interfaces of the portable sub-device and the portable mother device are suitable for accessing the industrial control network through a pluggable connection line. Based on the above pluggable connection method, it is easy to deploy, does not require high after-sales service, is plug-and-play, and can be completed by computer novices. If probes at multiple locations are required, multiple portable sub-devices can be inserted into the corresponding locations for deployment.

[0025] Optionally, the portable sub-device is deployed with a network configuration of IPVS DR mode. IPVS is a software module of LVS (Linux Virtual Server) cluster, which is installed on the LVS cluster as the main node of load balancing, and virtualizes an IP address and port to provide external services.

[0026] When any portable sub-device is scanned as a probe, the scan information is forwarded to the portable main device for reception through the traffic forwarding means of the IPVS DR mode.

[0027] Most of the existing honeypots are Internet honeypots. Since the industrial control system cannot be connected to the Internet, it cannot use the traditional Internet protocol for traffic forwarding. Therefore, this embodiment adopts the IPVS DR mode for traffic forwarding. The IPVS DR mode has the fastest transmission speed, and in the existing deployment scheme of IPVS, the DR mode can retain the attacker's IP (Internet Protocol) address. Other methods, such as NAT mode, can only display the IP of the LVS virtual scheduling server in the honeypot master server, which is not conducive to tracing the attacker's IP.

[0028] Optionally, the portable mother device is deployed with a Docker service. As a lightweight service, Docker is deployed very quickly and takes up very little space. Its container also takes up very little space. Compared with the virtual machine software used in traditional honeypot solutions: KVM, VMWARE and other images that are often 20GB in size, Docker's container image is usually only a few hundred MB. Therefore, this system does not require a dedicated independent honeypot server, and can be deployed and implemented using the above-mentioned portable miniaturized all-in-one machine. Its lightweight, low cost and flexible deployment are the biggest advantages of this solution.

[0029] After receiving the scan information, the portable mother device uses the deployed Docker service and uses the Host mode to forward the traffic to its own Docker container.

[0030] See also Figure 1 The structural diagram of the parent-child portable industrial control honeynet system shown in the figure shows the interconnected portable mother device and portable child device. The IPVS DR mode is used to perform traffic forwarding between the portable child device and the portable mother device. The portable mother device is deployed with industrial control protocol simulation, production environment simulation, office system, and SIS (Supervisory Information System, factory-level real-time monitoring information system) system Docker.

[0031] See also Figure 2 The protection process diagram of the parent-child portable industrial control honeynet system shown includes the following steps:

[0032] S201, when the attacker scans the portable child device as a probe through scanning means, the probe forwards the scanning information to the portable main device through the traffic forwarding means of the IPVS DR mode for reception.

[0033] S202, the portable mother device uses the deployed Docker service and uses the Host mode to forward traffic to its own Docker container, allowing the attacker to access the Docker container.

[0034] S203, all the attacker's attack traffic and attacker's IP will be forwarded to the Docker container to mislead the attacker.

[0035] Optionally, the interface of the portable child device is connected to any switch of the industrial control network through a network cable; the interface of the portable mother device is connected to any switch of the industrial control network through a network cable. After the portable mother device and the portable child device are connected to the industrial control network, the portable mother device automatically connects each portable child device in scripted IPVS DR mode.

[0036] The embodiment of the present invention provides a deployment method of a parent-child portable industrial control honeynet system, which is used to execute the parent-child portable industrial control honeynet system. Figure 3 The schematic diagram of the process of deploying the parent-child portable industrial control honeynet system shown in FIG. 1 includes:

[0037] S301, deploy a portable sub-device with IPVS DR mode as a probe to any switch of the industrial control network through a network cable, and set the IP address to access the subnet.

[0038] S302, connect the portable mother device deployed with the honeynet master service architecture to any switch of the industrial control network through a network cable, and set the IP address to access the subnet.

[0039] S303, automatically and scriptably connect the portable child device to the IPVS DR mode through the portable mother device to achieve one-click rapid deployment.

[0040] The embodiments of the present invention have the following advantages:

[0041] (1) The IPVS DR mode is used for traffic forwarding. It has a fast transmission speed and can retain the attacker's IP, which is conducive to tracing the attacker's IP.

[0042] (2) Use a portable host as a probe for deployment (several sub-devices), and deploy the portable host as the main server of the honeynet (mother device). Simply plug the network cable to connect to the subnet on site, plug and play, and easy to deploy. Existing honeypots are usually deployed on the main server. Although the same effect can be achieved between different subnets, virtual machines are used. In this embodiment, a physical machine is used, which is more concealed.

[0043] (3) A portable host is used as a probe. It is a physical machine with a real network card and real hardware environment, which is less likely to be discovered by attackers.

[0044] (4) Using lightweight services such as Docker, deployment is extremely fast and takes up very little space. The space occupied by its container is also very small. Docker container images are usually only a few hundred MB and can be deployed on portable integrated devices. They are lightweight, low-cost, and flexible to deploy.

[0045] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0046] Of course, those skilled in the art can understand that all or part of the processes of the above embodiments can be implemented by instructing the control device through a computer, and the program can be stored in a computer-readable storage medium. When the program is executed, it may include the processes of the above-mentioned method embodiments, wherein the storage medium may be a memory, a disk, an optical disk, etc.

[0047] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0048] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0049] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A parent-child portable industrial control honeynet system, characterized in that: The system includes a portable mother device and a plurality of portable child devices; The portable mother device is deployed with a honeynet master service architecture, and is used as a honeynet master server to provide honeypot services; The portable child device is deployed with a network configuration and is used as a probe to forward scan information to the portable mother device; The portable mother device and the portable child device are both portable miniaturized all-in-one machines, and the portable miniaturized all-in-one machine includes an interface suitable for connecting to an industrial control network; The interfaces of the portable sub-device and the portable mother device are suitable for accessing the industrial control network through a pluggable connection line; the interface of the portable sub-device is connected to any switch of the industrial control network through a network cable, and the interface of the portable mother device is connected to any switch of the industrial control network through a network cable; The portable child device is deployed with a network configuration of IPVSDR mode; the portable mother device is deployed with a Docker service; When any of the portable sub-devices is scanned as a probe, the scanning information is forwarded to the portable mother device for reception through the traffic forwarding means of the IPVS DR mode; after receiving the scanning information, the portable mother device uses the deployed Docker service and uses the Host mode to forward the traffic to its own Docker container.

2. The system according to claim 1, characterized in that The portable mother device automatically connects each of the portable child devices in a scripted IPVSDR mode.

3. A method for deploying a parent-child portable industrial control honeynet system, characterized in that: The method for executing the parent-child portable industrial control honeynet system according to any one of claims 1 to 2 comprises: The portable sub-device deployed with IPVSDR mode is connected to any switch of the industrial control network through a network cable as a probe, and the IP address is set to access the subnet; Connect the portable mother device with the honeynet main service architecture to any switch of the industrial control network through a network cable, and set the IP address to access the subnet; The portable child device is automatically connected to the portable mother device in a scripted IPVSDR mode to achieve one-click rapid deployment.

Images