Construction method of adaptive intelligent industrial control high-interaction honeypot based on digital twinning

Abstract

The application discloses a kind of based on digital twinning self-adapting intelligent industrial control high interaction honeypot construction method, in the physical layer of honeypot system, based on min icps framework constructs each virtual node in industrial control service module;Collect the sensor data and event log of field device, provide for digital twin module to model physical process;And transmission to industrial control service module;In the digital twinning layer of honeypot system, by to original honeypot system collect historical data and real-time data storage to storage, construct the twin of original honeypot system, add monitoring module, simulation and test module and intelligent analysis module, through monitoring module collects the environmental data and attacker behavior data of honeypot system, after pre-processing is sent to intelligent analysis module and is analyzed to obtain result, response and the modification of honeypot configuration are guided.The embodiment of the application can improve flexibility and expandability, and can be widely applied to the technical field of industrial control system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control systems, and particularly relates to a construction method of an adaptive intelligent industrial control high-interaction honeypot based on digital twinning. BACKGROUND

[0002] With the advent of Industry 4.0, digital transformation has become a key driver for boosting manufacturing efficiency and productivity. This transformation not only introduces advanced automation and intelligent technologies, but also gives rise to highly interconnected industrial control systems (ICS) and Internet of Things (IoT) devices, thus forming a complex Industrial Internet of Things (IIoT) ecosystem. However, this interconnectedness also exposes industrial infrastructure to unprecedented cyber security risks.

[0003] In view of the increasing number of industrial control security threats, traditional security defense mechanisms such as firewalls, intrusion detection systems (IDS) and anti-virus software, while being able to resist external attacks to some extent, often focus on prevention and detection, and lag behind in response to attackers who have penetrated the internal network, and it is difficult to obtain detailed information and motives of the attackers. In order to more deeply understand the strategies and operating modes of the attackers, security experts need to rely on more sophisticated tools and technologies. In this case, honeypot technology, as an active defense means, plays an increasingly important role in the protection of industrial control systems due to its unique functions and advantages.

[0004] Honeypots, in essence, are carefully designed decoy systems whose core mission is not merely defense, but to deliberately attract attackers in order to monitor and study their actions by simulating real network environments or systems. Honeypots can be classified into high-interactive and low-interactive honeypots based on the level of service simulation. Low-interactive honeypots mainly simulate specific service components in the system, and are relatively simple in development, deployment, and hardening, as they only provide a narrow attack surface. For example, Conpot is a popular open-source low-interactive honeypot designed to simulate devices in SCADA systems, such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs). In contrast, high-interactive honeypots are built on real operating systems and integrate real service components or accurately simulate key functions of the operating system, providing a broad attack surface. In addition, they can be classified into virtual and physical types based on implementation. Physical honeypots are deployed on real physical hardware, which may include actual servers, workstations, or other network devices running real operating systems and applications. The advantage of this type of honeypot is that it is more realistic and can provide a richer attack surface, but it is more expensive and complex to maintain. Virtual honeypots simulate real operating systems, applications, and services through software. This type of honeypot is more complex due to the need for higher simulation accuracy, and it must be realistic enough to effectively deceive and attract advanced attackers. Virtual honeypots are less expensive, easy to deploy and manage, but face challenges in simulation accuracy.

[0005] Digital twins refer to the creation of an accurate virtual model of a physical object in a digital space to monitor, analyze, and optimize the physical object. Digital twin technology uses real-time data streams and historical data to accurately reflect the state and behavior of physical entities in a virtual environment through modeling and simulation techniques. Digital twin technology can help better understand the working state of equipment, predict potential problems, and simulate and make decisions before testing and verification in the actual environment. In industrial honeypots, digital twins are often used to model physical processes to improve the simulation level of the honeypot.

[0006] Current research on industrial honeypots focuses on improving the interaction level of the honeypot and capturing data. However, related technologies have the following shortcomings:

[0007] 1. The configuration of the honeypot is determined at the time of deployment and does not consider subsequent modifications during operation, which is not flexible enough.

[0008] 2. Related technologies use physical honeypots, which rely on actual hardware devices and have limited migration and scalability, and it is difficult to modify the configuration. At the same time, related methods based on historical data and pre-set models for threat identification have limitations in responding to new attack patterns and adaptability. Summary of the Invention

[0009] The main objective of this invention is to propose a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, so as to improve the flexibility and scalability of deployment, and to improve the response speed and adaptability to new attack modes.

[0010] To achieve the above objectives, one aspect of this invention proposes a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, comprising the following steps:

[0011] In the physical layer of the honeypot system, virtual nodes in the industrial control service module are constructed based on the mini ICPS framework; sensor data and event logs of field devices are collected; the sensor data and event logs of field devices are provided to the digital twin module, which models the physical process; and the digital twin module transmits the physical process data to the industrial control service module to provide attackers with highly simulated industrial control services.

[0012] In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical and real-time data from the original honeypot system and storing it in a repository. Additional monitoring, simulation and testing modules, as well as intelligent analysis modules, are added. The monitoring module collects environmental data and attacker behavior data of the honeypot system. After preprocessing the collected data, it is sent to the intelligent analysis module for analysis to obtain results, which provide guidance for response and modification of honeypot configuration.

[0013] In some embodiments, the sensor data of the field device includes sensor readings, operation logs, and maintenance records; providing the sensor data and event logs of the field device to the digital twin module, and having the digital twin module model the physical process, includes the following steps:

[0014] By collecting sensor readings, operation logs, and maintenance records through sensors and data acquisition systems, a precise digital representation of the physical process can be established.

[0015] Using advanced mathematical models and simulation technology, the collected data is transformed into a virtual model;

[0016] Maintaining real-time synchronization between the digital twin and the physical entity reflects changes in the physical world in the digital model, providing attackers with a highly realistic view of the industrial site.

[0017] The virtual nodes include HMI modules and PLC modules.

[0018] In some embodiments, the step of collecting historical data and real-time data from the original honeypot system and storing it in a repository includes real-time data such as system environment, configuration data, and network traffic.

[0019] In some embodiments, the model training process of the intelligent analysis module includes the following steps:

[0020] Use historical data to train the model offline and build a basic model;

[0021] The base model is trained online using real-time data, and the model parameters are updated in real time to obtain an intelligent analysis module.

[0022] In some embodiments, the method further includes:

[0023] By collecting data on attackers' attack behavior and honeypot environment, we can predict the attackers' target hosts and the protocols they use, and modify the network topology and the protocols opened by the target hosts based on the prediction results.

[0024] Use network traffic analysis tools to extract attack signatures from the attacker's scanned packets;

[0025] The extracted attack features are preprocessed and converted into numerical types, which are then used as input features for the model.

[0026] In some embodiments, the honeypot environment data includes operating system version, hardware resources, network status, network topology, and open protocol services.

[0027] In some embodiments, the method further includes the following steps:

[0028] Based on the prediction results of the model in the intelligent analysis module, adjust the open industrial control services and network topology in the original honeypot system.

[0029] In some embodiments, adjusting the open industrial control services and network topology in the original honeypot system based on the prediction results of the model in the intelligent analysis module includes the following steps:

[0030] After making predictions based on the current attacker's behavior and the honeypot environment, the intelligent analysis module sends the prediction results and the required historical data to the SDN controller in the original honeypot system.

[0031] When the SDN controller receives a prediction of attack behavior, it dynamically modifies the configuration.

[0032] Based on the predicted attack protocols that the honeypot may be vulnerable to, the SDN controller opens the corresponding protocols and ports in the industrial control service module.

[0033] In some embodiments, the dynamic modification of the configuration by the SDN controller after receiving a prediction of attack behavior includes the following steps:

[0034] The SDN controller receives the prediction results and opens the corresponding protocols and ports based on the prediction results;

[0035] If a potential target host is predicted, other connected nodes are added to the target host, and relevant traffic is extracted from historical data and injected into the target host, thereby completing the configuration modification of the honeypot system; otherwise, no topology modification is performed.

[0036] To achieve the above objectives, another aspect of the present invention provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0037] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0038] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0039] The embodiments of this invention include at least the following beneficial effects: This invention provides a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins. In the physical layer of the honeypot system, this scheme constructs virtual nodes in the industrial control service module based on a minimum ICPS framework; collects sensor data and event logs from field devices; provides the sensor data and event logs from the field devices to the digital twin module, which models the physical process; and transmits the physical process data to the industrial control service module to provide attackers with highly simulated industrial control services. In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical and real-time data from the original honeypot system and storing it in a repository. Additional monitoring, simulation, and testing modules, as well as an intelligent analysis module, are added. The monitoring module collects environmental data and attacker behavior data from the honeypot system. After preprocessing the collected data, it is sent to the intelligent analysis module for analysis to obtain results, providing guidance for responses and modifications to the honeypot configuration. The embodiments of this invention can improve deployment flexibility and scalability, and can improve response speed and adaptability to new attack patterns. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0041] Figure 2 This is a flowchart of the overall steps provided in the embodiments of the present invention;

[0042] Figure 3 This is a schematic diagram of an adaptive intelligent industrial control high-interaction honeypot framework based on digital twin provided in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the training process of an intelligent analysis model based on online learning provided in an embodiment of the present invention;

[0044] Figure 5 This is a flowchart of the dynamic configuration of honeypots based on intelligent analysis provided in an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0047] It is understood that the terms “first,” “second,” etc., used in this invention may be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, first information may also be referred to as second information without departing from the scope of embodiments of the invention, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to determination” as used herein may be interpreted as “when…” or “when…” or “in response to determination.”

[0048] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0050] The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins provided in this invention relates to the field of computer technology. This method can be applied to terminals, servers, or software running on either terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, but is not limited to the above forms.

[0051] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0052] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided by an embodiment of the present invention. (Refer to...) Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0053] Server 101 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0054] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0055] Terminal 102 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc. It can also be a vehicle-mounted terminal of the various device types described above, but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the invention does not impose any limitations.

[0056] Exemplary based on Figure 1 The implementation environment shown in this embodiment of the invention provides a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins. The following description uses the application of this method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins in server 101 as an example. It can be understood that this method can also be applied to terminal 102.

[0057] Reference Figure 2 , Figure 2 The flowchart illustrates a method for constructing a digital twin-based adaptive intelligent industrial control high-interaction honeypot for servers, as provided in this embodiment of the invention. The execution subject of this method can be any of the aforementioned computer devices (including servers or terminals). (Refer to...) Figure 2 The method may include the following steps:

[0058] In the physical layer of the honeypot system, virtual nodes in the industrial control service module are constructed based on the mini ICPS framework; sensor data and event logs of field devices are collected; the sensor data and event logs of field devices are provided to the digital twin module, which models the physical process; and the digital twin module transmits the physical process data to the industrial control service module to provide attackers with highly simulated industrial control services.

[0059] In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical and real-time data from the original honeypot system and storing it in a repository. Additional monitoring, simulation and testing modules, as well as intelligent analysis modules, are added. The monitoring module collects environmental data and attacker behavior data of the honeypot system. After preprocessing the collected data, it is sent to the intelligent analysis module for analysis to obtain results, which provide guidance for response and modification of honeypot configuration.

[0060] In some embodiments, the sensor data of the field device includes sensor readings, operation logs, and maintenance records; providing the sensor data and event logs of the field device to the digital twin module, and having the digital twin module model the physical process, includes the following steps:

[0061] By collecting sensor readings, operation logs, and maintenance records through sensors and data acquisition systems, a precise digital representation of the physical process can be established.

[0062] Using advanced mathematical models and simulation technology, the collected data is transformed into a virtual model;

[0063] Maintaining real-time synchronization between the digital twin and the physical entity reflects changes in the physical world in the digital model, providing attackers with a highly realistic view of the industrial site.

[0064] The virtual nodes include HMI modules and PLC modules.

[0065] In some embodiments, the step of collecting historical data and real-time data from the original honeypot system and storing it in a repository includes real-time data such as system environment, configuration data, and network traffic.

[0066] In some embodiments, the model training process of the intelligent analysis module includes the following steps:

[0067] Use historical data to train the model offline and build a basic model;

[0068] The base model is trained online using real-time data, and the model parameters are updated in real time to obtain an intelligent analysis module.

[0069] In some embodiments, the method further includes:

[0070] By collecting data on attackers' attack behavior and honeypot environment, we can predict the attackers' target hosts and the protocols they use, and modify the network topology and the protocols opened by the target hosts based on the prediction results.

[0071] Use network traffic analysis tools to extract attack signatures from the attacker's scanned packets;

[0072] The extracted attack features are preprocessed and converted into numerical types, which are then used as input features for the model.

[0073] In some embodiments, the honeypot environment data includes operating system version, hardware resources, network status, network topology, and open protocol services.

[0074] In some embodiments, the method further includes the following steps:

[0075] Based on the prediction results of the model in the intelligent analysis module, adjust the open industrial control services and network topology in the original honeypot system.

[0076] In some embodiments, adjusting the open industrial control services and network topology in the original honeypot system based on the prediction results of the model in the intelligent analysis module includes the following steps:

[0077] After making predictions based on the current attacker's behavior and the honeypot environment, the intelligent analysis module sends the prediction results and the required historical data to the SDN controller in the original honeypot system.

[0078] When the SDN controller receives a prediction of attack behavior, it dynamically modifies the configuration.

[0079] Based on the predicted attack protocols that the honeypot may be vulnerable to, the SDN controller opens the corresponding protocols and ports in the industrial control service module.

[0080] In some embodiments, the dynamic modification of the configuration by the SDN controller after receiving a prediction of attack behavior includes the following steps:

[0081] The SDN controller receives the prediction results and opens the corresponding protocols and ports based on the prediction results;

[0082] If a potential target host is predicted, other connected nodes are added to the target host, and relevant traffic is extracted from historical data and injected into the target host, thereby completing the configuration modification of the honeypot system; otherwise, no topology modification is performed.

[0083] The implementation process of this invention in a specific application scenario will be described in detail below with reference to the accompanying drawings:

[0084] Existing industrial control honeypot solutions have the following main drawbacks:

[0085] (1) Insufficient adaptability to changes in the system environment and behavior

[0086] Existing honeypot systems primarily focus on simulating specific cyberattack scenarios. Their configurations are often fixed at deployment time, making subsequent modifications difficult and resulting in a lack of adaptability to environmental changes. Firstly, industrial control systems are dynamic, frequently adjusting their configurations based on operational needs or environmental conditions. For example, the configurations of PLCs and HMIs may change according to production process requirements. If existing honeypot systems cannot simulate this dynamism, they cannot provide an interactive experience similar to real systems. Secondly, existing fixed-configuration honeypot systems can only simulate specific defense strategies and cannot adapt to attackers' constantly evolving attack methods, limiting the breadth and depth of the system's defense capabilities.

[0087] (2) Lack of intelligent analysis

[0088] Existing honeypot systems have limitations in improving interactivity with attackers and intelligent analysis. While traditional honeypots can collect attacker behavioral data, they often require manual intervention for configuration updates and policy adjustments. This means that honeypot systems are limited in their response speed and adaptability to constantly changing attack patterns. Furthermore, honeypots typically only passively record attack activity and lack the ability to actively learn and self-optimize.

[0089] (3) Insufficient scalability and portability of physical honeypots

[0090] Physical honeypots have significant limitations in terms of scalability and portability, particularly regarding data migration. Physical honeypots rely on actual hardware, making it complex and costly to expand their capacity or functionality. Adding new hardware or upgrading existing equipment requires time and expertise, increasing the difficulty of expansion. Furthermore, physical honeypots require specific location deployments, meaning that migrating them to another location or network typically necessitates reconfiguring hardware and network connectivity. Therefore, these data migration challenges increase the complexity and cost of migration, further limiting the scalability and portability capabilities of physical honeypots.

[0091] The reasons for the above-mentioned shortcomings are:

[0092] The main reasons for the above deficiencies include: (1) Existing honeypot systems are configured as static settings during deployment and are not designed to self-adjust according to real-time data or changes in conditions; (2) Existing honeypot systems rely on manual intervention for configuration updates and policy adjustments and do not utilize machine learning or artificial intelligence technologies to automatically analyze and respond to attack patterns; (3) To improve realism, some existing honeypot systems choose to use physical honeypots, but physical honeypots rely on specific hardware devices, which limits their ability to migrate in different environments or networks. In addition, their cost and resource consumption are also high.

[0093] To address the shortcomings of existing industrial control honeypot systems in terms of adaptability, intelligent analysis capabilities, scalability, and portability, this invention utilizes digital twin technology and combines it with online learning to propose a highly adaptable, intelligent, and easily portable highly interactive industrial control system honeypot. This system can respond to environmental changes in real time, automatically adjusting its configuration to simulate a highly realistic industrial control system; it integrates advanced machine learning algorithms to achieve rapid identification and self-optimization of attack behaviors; and simultaneously, virtualization technology eliminates dependence on physical hardware, reducing costs and improving system flexibility and deployability.

[0094] Compared to existing technologies, this invention aims to solve the following problems:

[0095] (1) Design of an adaptive intelligent industrial control high-interaction honeypot framework based on digital twin. It is necessary to establish a linkage between the original honeypot system and its twin to meet the adaptability requirements of the original honeypot system to changes in the system environment and attack behaviors.

[0096] (2) Construction of digital twin models of industrial site physical processes and original honeypot systems. A digital twin model of the industrial site physical processes is constructed to improve realism, and a digital twin model of the original honeypot system is constructed to provide a highly realistic scenario for simulation and testing modules as well as intelligent analysis modules.

[0097] (3) Construction of intelligent analysis model. Using machine learning algorithms, the environmental data and attacker behavior in the original honeypot system are analyzed to explore methods for modifying the honeypot system configuration and realize dynamic configuration of the honeypot to improve the interactivity and realism of the honeypot system.

[0098] Specifically, this invention applies digital twin technology to industrial control honeypots to increase the dynamics of the honeypots and improve their interactivity. For example... Figure 3As shown, the framework of the adaptive intelligent industrial control high-interaction honeypot based on digital twins in this invention mainly comprises two layers: 1) the physical layer of the honeypot system; and 2) the digital twin layer of the honeypot system. The original honeypot system is simulated using the Minicps framework, with each node being a virtual node. Sensor data and event logs from field devices are collected and provided to the data twin module, which models the physical process. The digital twin module then transmits the physical process data to the industrial control service module, providing attackers with a highly simulated industrial control service. In the digital twin layer, historical and real-time data from the original honeypot system are collected and stored in a repository to construct a twin of the original honeypot system. Additional monitoring, simulation, and testing modules, as well as an intelligent analysis module, are added. The monitoring module collects environmental data and attacker behavior data from the honeypot system. The collected data is preprocessed and then sent to the intelligent analysis module for analysis, providing guidance for responses and modifications to the honeypot configuration.

[0099] This invention utilizes digital twin technology to simulate the physical processes of industrial equipment, improving the realism of the original honeypot system. Simultaneously, it constructs a twin of the original honeypot system, within which monitoring, simulation, and intelligent analysis models are trained. Based on the trained model, modifications to responses and honeypot configurations are made, increasing the honeypot's dynamism and enhancing its interactivity. The device of this invention comprises the construction of a digital twin model, the training of an intelligent analysis model, and a dynamic honeypot configuration scheme based on intelligent analysis.

[0100] The construction process of a digital twin model is explained in detail below:

[0101] The construction of a digital twin model is the foundation of this invention, comprising two parts: a digital twin of the physical processes of the field equipment and a digital twin of the original honeypot system. Digital twin technology, based on real-time data and advanced modeling tools, creates precise virtual copies of physical entities. By integrating sensor data, computational models, and simulation software, it enables real-time monitoring, analysis, and prediction of the state and behavior of physical objects.

[0102] First, within the original honeypot system layer, a digital twin is constructed for the physical processes of the field equipment. Relevant data from the field equipment is collected, including but not limited to sensor readings, operation logs, and maintenance records. This data, collected through sensors and data acquisition systems, is used to establish an accurate digital representation of the physical processes. Next, advanced mathematical models and simulation techniques are used to transform the collected data into a virtual model. Finally, the digital twin maintains real-time synchronization with the physical entity, ensuring that any changes in the physical world are promptly reflected in the digital model, providing attackers with a highly realistic view of the industrial field. The remaining nodes in the original honeypot system, such as the HMI module and PLC module, are virtual nodes simulated using the mini-ICPS framework, and the industrial control protocols include various protocols implemented using scripts.

[0103] Next, a digital twin of the original honeypot system is constructed. The original honeypot system continuously collects information about its operational status, including configuration data and network traffic, and sends this data to a database. The database stores historical and real-time data from the original honeypot system for subsequent processing and analysis. Then, the digital twin uses the collected data to replicate the current state and characteristics of the original honeypot, including real-time system environment, network configuration, and network traffic. Based on the twin, a monitoring module, a simulation and testing module, and an intelligent analysis module are added. The monitoring module monitors the honeypot system's environment and attacker behavior, collects necessary data, and preprocesses the data. The intelligent analysis module uses the data from the monitoring module to continuously update its training model through online learning. This model has self-learning and updating capabilities, automatically adjusting its parameters based on new data to improve prediction accuracy and adaptability. The simulation and testing module simulates various network attacks and performs corresponding simulation verifications within the twin based on the strategies developed by the intelligent analysis module.

[0104] The model training process of the intelligent analysis module is explained in detail below:

[0105] To achieve dynamic honeypot configuration and enhance its realism and adaptability, this invention employs an online learning-based method to dynamically update the configuration of the original honeypot system. First, a basic model is established by offline training using historical data. Then, the model is trained online using real-time data, updating its parameters in real time. As attack data changes and increases over time, online learning becomes more suitable for predicting attack behavior within the honeypot system.

[0106] This invention predicts the attacker's target host and the protocols used by collecting attacker behavior data and honeypot environment data. Based on the prediction results, it modifies the network topology and the protocols opened by the target host. Honeypot environment data includes deployment information such as operating system version, hardware resources, network status, network topology, and open protocol services, serving as honeypot environment characteristics. Attack characteristics are extracted from the attacker's scanned data packets using network traffic analysis tools. Finally, the extracted features are preprocessed and converted into numerical types, serving as input features for the model. The specific training process of the intelligent analysis model based on online learning is as follows: Figure 4 First, an initial model is built using historical data through offline learning. Then, when the monitoring module detects new attack behavior, relevant real-time data is fed back into the model. Through continuous updates and iterations, the model achieves better predictive performance.

[0107] The following is a detailed explanation of the honeypot dynamic configuration scheme based on intelligent analysis:

[0108] This invention uses a dynamic approach to improve the interactivity and adaptability of the honeypot system, adjusting the open industrial control services and network topology in the original honeypot system based on the prediction results of the model in the intelligent module.

[0109] The intelligent analysis module makes predictions based on the current attacker's behavior and the honeypot environment, and then sends the prediction results along with the necessary historical data to the SDN controller in the original honeypot system. Upon receiving the attack behavior prediction, the SDN controller dynamically modifies its configuration as follows: Figure 5 As shown, the SDN controller will open the corresponding protocols and ports in the industrial control service module based on the predicted attack protocols that the honeypot may be attacked.

[0110] Simultaneously, based on the predicted target hosts that attackers might target, the SDN controller can make corresponding network topology modifications for those target hosts. For example, it can add more inbound and outbound connections to the predicted target hosts to make them appear more important and realistic. Specifically, it can add other industrial control service nodes connected to the target host, extract traffic patterns related to the target host from historical data, and then inject this traffic into the target host to make it appear as a busy server.

[0111] Existing honeypot systems are often statically configured, making it difficult to adapt to environmental changes. Furthermore, configuration updates and strategy adjustments rely heavily on manual intervention and expert knowledge. Digital twin technology focuses more on simulating physical processes and has not been fully utilized to provide a highly realistic simulation environment for modifying honeypot configurations. This invention applies digital twin technology to honeypot systems and combines it with online learning algorithms to train intelligent analysis models, achieving automated attack behavior prediction and dynamic adjustment of honeypot configurations, thus improving the realism and interactivity of honeypots in industrial control systems.

[0112] Compared with the prior art, the present invention has the following characteristics:

[0113] 1. A highly interactive, adaptive intelligent industrial control honeypot framework based on digital twins is proposed. This framework, based on digital twin technology, comprises two main layers: the original honeypot system layer and the digital twin layer of the honeypot system. The original honeypot system layer is implemented using a minimum ICPS framework, employing virtual nodes to simulate the various components of the industrial control system. The digital twin layer constructs a twin of the original honeypot system and integrates monitoring, simulation, and intelligent analysis modules.

[0114] 2. A digital twin model of the original honeypot system is proposed. This twin can accurately reflect the state and behavior of the honeypot system, thus providing a highly realistic simulation environment for monitoring, simulation, and intelligent analysis modules.

[0115] 3. An intelligent analysis model based on online learning is proposed. Utilizing historical and real-time data, this invention constructs an intelligent analysis model capable of self-learning and optimization. Through online learning algorithms, the model can automatically adjust its parameters to improve prediction accuracy and adaptability.

[0116] 4. A dynamic honeypot configuration process based on intelligent analysis is proposed. Based on the prediction results of the intelligent analysis module, this invention proposes a dynamic honeypot configuration process. This process automatically adjusts the open industrial control services and network topology in the honeypot system through an SDN controller to improve the realism and interactivity of the honeypot.

[0117] In summary, modifications to existing industrial control honeypot configurations largely rely on manual intervention and expert knowledge, resulting in shortcomings in adaptability to changes in system environment and attack behavior, intelligent analysis, and scalability. This invention offers the following benefits:

[0118] 1. This invention constructs a digital twin of the honeypot system and continuously updates the honeypot configuration using an online learning algorithm, enabling the honeypot to self-adjust according to real-time environmental changes and attack behaviors, thus improving the adaptability and dynamism of the honeypot system. This method differs from statically configured honeypot systems in existing technologies, which cannot adaptively adjust to changing environments and attack behaviors.

[0119] 2. By integrating machine learning algorithms to achieve intelligent analysis, this invention enables rapid identification and self-optimization of attack behaviors. Compared to traditional honeypot systems that can only passively record attack activities, this invention can actively learn and self-optimize, improving the interactivity and defense efficiency of the honeypot system.

[0120] 3. By utilizing virtualization technology and the mini ICPS framework, this invention eliminates the dependence on physical hardware, reduces costs, and improves system flexibility and deployability.

[0121] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins. This electronic device can be any intelligent terminal, including tablet computers, in-vehicle computers, etc.

[0122] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0123] Please see Figure 6 , Figure 6 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0124] The processor 601 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0125] The memory 602 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 602 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 602 and is called and executed by the processor 601 to execute the method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to the embodiments of this invention.

[0126] The input / output interface 603 is used to implement information input and output;

[0127] The communication interface 604 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0128] Bus 605 transmits information between various components of the device (e.g., processor 601, memory 602, input / output interface 603, and communication interface 604);

[0129] The processor 601, memory 602, input / output interface 603, and communication interface 604 are connected to each other within the device via bus 605.

[0130] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins.

[0131] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0132] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0133] It should be noted that in various specific embodiments of the present invention, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of the present invention require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to a confirmation page. Only after obtaining the user's separate permission or consent is the necessary user-related data for the normal operation of the embodiments of the present invention acquired.

[0134] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0135] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0136] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0137] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0138] The terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0139] It should be understood that in this invention, "at least one (item)" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0140] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0141] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0143] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0144] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.

Claims

1. A method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, characterized in that, Includes the following steps: In the physical layer of the honeypot system, virtual nodes in the industrial control service module are constructed based on the minicps framework; Collect sensor data and event logs from field devices; provide the sensor data and event logs from field devices to a digital twin module, which then models the physical process; and the digital twin module transmits the physical process data to an industrial control service module to provide attackers with highly simulated industrial control services. In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical and real-time data from the original honeypot system and storing it in a repository. Additional monitoring, simulation and testing modules, as well as intelligent analysis modules, are added. The monitoring module collects environmental data and attacker behavior data of the honeypot system. After preprocessing the collected data, it is sent to the intelligent analysis module for analysis to obtain results and provide guidance for response and modification of honeypot configuration. Various network attacks are simulated through simulation and testing modules, and corresponding simulation verifications are performed in the twin based on the prediction results made by the intelligent analysis module. The method further includes the following steps: By collecting data on attackers' attack behavior and honeypot environment, we can predict the attackers' target hosts and the protocols they use, and modify the network topology and the protocols opened by the target hosts based on the prediction results. Use network traffic analysis tools to extract attack signatures from the attacker's scanned packets; The extracted attack features are preprocessed and converted into numerical types, which are then used as input features for the model. After making predictions based on the current attacker's behavior and the honeypot environment, the intelligent analysis module sends the prediction results and the required historical data to the SDN controller in the original honeypot system. When the SDN controller receives a prediction of attack behavior, it dynamically modifies the configuration. Based on the predicted attack protocols that the honeypot may be attacked, the SDN controller opens the corresponding protocols and ports in the industrial control service module. The dynamic modification of the configuration by the SDN controller after receiving a prediction of attack behavior includes the following steps: The SDN controller receives the prediction results and opens the corresponding protocols and ports based on the prediction results; If a potential target host is predicted, other connected nodes are added to the target host, and relevant traffic is extracted from historical data and injected into the target host, thereby completing the configuration modification of the honeypot system; otherwise, no topology modification is performed.

2. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1, characterized in that, The sensor data from the field equipment includes sensor readings, operation logs, and maintenance records. Providing the sensor data and event logs from the field equipment to the digital twin module, which then models the physical process, includes the following steps: By collecting sensor readings, operation logs, and maintenance records through sensors and data acquisition systems, a precise digital representation of the physical process can be established. Using advanced mathematical models and simulation technology, the collected data is transformed into a virtual model; Maintaining real-time synchronization between the digital twin and the physical entity reflects changes in the physical world in the digital model, providing attackers with a highly realistic view of the industrial site. The virtual nodes include HMI modules and PLC modules.

3. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1, characterized in that, In the step of collecting historical data and real-time data from the original honeypot system and storing it in the repository, the real-time data includes system environment, configuration data, and network traffic.

4. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1, characterized in that, The model training process of the intelligent analysis module includes the following steps: Use historical data to train the model offline and build a basic model; The base model is trained online using real-time data, and the model parameters are updated in real time to obtain an intelligent analysis module.

5. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1, characterized in that, The honeypot environment data includes operating system version, hardware resources, network status, network topology, and open protocol services.

6. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 5.

Images