Conpot-based industrial control system deception defense system construction method and system

Abstract

The invention belongs to the technical field of industrial control, and discloses a Conpot-based industrial control system deception defense system construction method and system, and the method comprises the steps: building a simulated industrial control system environment through simulating industrial control equipment such as a programmable logic controller, an SCADA server and the like and industrial control protocols such as S7comm, Modbus, SNMP and the like; deploying and configuring a honeypot; constructing a honey net; and log acquisition and HMI simulation are carried out. According to the method, a real industrial control system simulation environment is constructed based on the open-source low-interaction industrial control honey pot Conpot, and information such as rules and parameters is improved and optimized, so that the cheating capability of a honey net system is improved, and the problem of insufficient cheating of a traditional honey net is effectively solved. And in the next step, aiming at the limitation of honeypot deployment, the dynamic property of deployment is optimized.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of industrial control technology, and in particular relates to a method and system for constructing a deceptive defense system for an industrial control system based on Conpot. Background Art

[0002] As a key infrastructure of modern society, the security of industrial control systems is directly related to national security and social stability. However, with the evolution of the Industrial 4.0 era, the new generation of information technology and industrialization are experiencing unprecedented integration. This trend has promoted the transformation of traditional closed industrial control systems to openness and intelligence, and has also made them increasingly the main target of cyber attacks. Although traditional network security protection measures, such as firewalls and intrusion detection systems, have played a protective role to a certain extent, their effectiveness has been severely tested by the ever-changing attack methods, especially those advanced persistent threats (APTs) that exploit system vulnerabilities and unknown attack patterns. Therefore, security personnel have begun to focus on active honeynet security defense technology, by deploying honeypots that simulate the characteristics of industrial control systems to lure attackers, capture attack behaviors and conduct research and analysis, and update defense strategies to strengthen the security protection capabilities of industrial control systems.

[0003] The current status and challenges of industrial control system security protection are as follows:

[0004] (1) Vulnerability analysis

[0005] Vulnerability mainly refers to the potential weaknesses or deficiencies in network architecture and facilities, as well as computer hardware and software. These potential security risks can be easily identified and exploited by malicious threat actors, thereby damaging the stability and security of the system and endangering its normal operation.

[0006] The technical vulnerability is mainly reflected in industrial control protocols such as Modbus and OPC (OLE for Process Control), which have high-risk vulnerabilities and lack identity authentication and encryption mechanisms, making them easy to be exploited by attackers, resulting in information leakage or control system tampering. At the management level, the security management system for industrial control network maintenance and other links is not sound or the system is poorly implemented, making it difficult to discover and repair security vulnerabilities in a timely manner. The lack of security awareness of operators and managers can also easily lead to operational errors or security vulnerabilities being exploited.

[0007] (2) Security Threat Analysis

[0008] Industrial control systems are facing severe security challenges in the context of the rapid development of information technology. The detection and exploitation of system vulnerabilities, the destruction of industrial control equipment, the implantation of malicious software, the theft of key data, the export of illegal data, cross-network infection of management networks, and the failure of control of one-way data transmission equipment all pose direct threats to the stability and reliability of industrial control systems. These complex security threats not only stem from technical vulnerabilities, but are also closely related to the defects of the management system. It is urgent to improve the security of industrial control systems through in-depth research and the implementation of effective security protection measures. Summary of the invention

[0009] In view of the problems existing in the prior art, the present invention provides a method and system for constructing a deceptive defense system for an industrial control system based on Conpot.

[0010] The present invention is implemented as follows: a method for constructing a deceptive defense system for an industrial control system based on Conpot, the method comprising:

[0011] S1: Establish a simulated industrial control system environment by simulating industrial control equipment such as programmable logic controllers, SCADA servers, and industrial control protocols such as S7comm, Modbus, and SNMP;

[0012] S2: Honeypot deployment and configuration;

[0013] S3: Honeynet construction;

[0014] S4: Log collection and HMI simulation.

[0015] Furthermore, the Conpot honeypot adopts a flexible and modular design, so that users can customize the configuration based on the general configuration and simulate different scenarios by adding customized templates or protocols.

[0016] Furthermore, when the Conpot is attacked or invaded by the network, the processing process is as follows:

[0017] First, Conpot will open a specific port for listening. When the attack establishes a connection, it will start capturing the attack traffic. At the same time, the session management module will create a new session to track and manage this connection and interact with the attack traffic data. All data information will be recorded in the log. Finally, different response measures will be taken according to the attacker's behavior and log records.

[0018] Further, the S2 specifically includes:

[0019] In the default template of Conpot, the template.xml file simulates the Siemens S7-200 series PLC. The file not only simulates the copyright information of the device, but also imitates the CPU information of the device. However, it has the defect of Conpot's unique fingerprint information "88111222", which makes it easy for attackers to identify it and mark it as "honeypot".

[0020] According to the characteristics of the equipment and protocols in the industrial control system, the initial configuration file of the Conpot honeypot needs to be modified.

[0021] Further, the S3 specifically includes:

[0022] In order to simulate a more realistic and attractive industrial control network environment, it is necessary to deploy multiple different types of honeypot nodes at the same time to simulate different types of industrial control equipment respectively, and enable communication services to interact between honeypot nodes; in this way, when an attacker detects a honeypot node, he will also detect the data flow exchange with other honeypot nodes, and cannot determine whether it is a trap, thereby effectively enhancing the system's deception ability;

[0023] Therefore, based on the previous simulation of the Siemens S7-300 PLC device, another model of PLC device in the microgrid is further simulated; a special honeynet gateway is set up by using bridge technology, and two different honeypot nodes are connected to different network interfaces of the gateway, thereby constructing a simulated honeynet system based on the microgrid power industrial control system environment.

[0024] Further, the S4 specifically includes:

[0025] In the honeynet architecture, since there may be a large number of honeypots deployed, in order to collect the log information generated by each honeypot in the honeynet, an effective log management system is essential for monitoring and analyzing the security status of the entire industrial control network. In order to uniformly manage the logs of each honeypot node, the MySQL database is used to facilitate users to query efficiently and analyze from multiple dimensions, so as to deeply understand the attack behavior;

[0026] The Conpot honeypot automatically records valuable information in a MySQL database, such as timestamps, session identifiers, source IP addresses, request details, and response status;

[0027] Since the UI of the Conpot honeypot defaults to a static web page; when an attacker finds that the 8800 port of Conpot is open through scanning, he can access it with a browser; the static page is easily discovered by the attacker, causing the attacker to stop attacking the honeypot; in order to make the honeynet more effectively attract and divert network attacks, the index.html sub-file in the http folder is modified using div elements and CSS styles to modify the original static web page, and it is designed as a highly simulated microgrid management system login interface, thereby constructing a real HMI human-computer interaction interface, making it difficult for attackers to distinguish the authenticity.

[0028] Another object of the present invention is to provide a system for constructing a deceptive defense system for an industrial control system based on Conpot based on the method for constructing a deceptive defense system for an industrial control system based on Conpot, the system specifically comprising:

[0029] The industrial control system environment establishment module establishes a simulated industrial control system environment by simulating industrial control equipment such as programmable logic controllers, SCADA servers, and industrial control protocols such as S7comm, Modbus, and SNMP;

[0030] Deploy the configuration module and establish a module connection with the industrial control system environment. This is used to target the characteristics of the equipment and protocols in the industrial control system. The initial configuration file of the Conpot honeypot needs to be modified.

[0031] The honeynet construction module is connected to the deployment configuration module, and deploys multiple different types of honeypot nodes at the same time, simulating different types of industrial control equipment respectively, and enabling communication services to interact between honeypot nodes;

[0032] The log collection and HMI simulation module is connected to the honeynet construction module and uses the MySQL database, which facilitates users to query efficiently and analyze from multiple dimensions, thereby gaining a deep understanding of attack behavior.

[0033] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for constructing a deceptive defense system for an industrial control system based on Conpot.

[0034] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to execute the steps of the method for constructing a deceptive defense system for an industrial control system based on Conpot.

[0035] Another object of the present invention is to provide an information data processing terminal, which is used to implement the industrial control system deceptive defense system construction system based on Conpot.

[0036] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0037] First, the present invention optimizes and improves the open source low-interaction industrial control honeypot Conpot to build a more efficient and more deceptive honeynet system, providing a new solution for the security protection of industrial control systems.

[0038] This paper builds a real industrial control system simulation environment based on the open source low-interaction industrial control honeypot Conpot. By improving and optimizing information such as rules and parameters, the deception ability of the honeynet system is enhanced, effectively solving the problem of insufficient deception of traditional honeynets. The next step will be to optimize the dynamic nature of deployment in view of the limitations of honeypot deployment.

[0039] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0040] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0041] For enterprises, the present invention can significantly reduce the risk of cyber attacks, prevent production interruptions, equipment damage, data leakage and other problems, avoid huge economic losses, ensure stable production, and enhance market competitiveness. At the same time, in the industrial control security market, its unique advantages can attract many enterprises and related institutions, meet the needs of enterprises for industrial control security protection upgrades in the era of Industry 4.0, and increase sales revenue and profits after integrating security solutions, and promote industrial development. In the long run, it can drive the research and development of security technology and talent training, give birth to related businesses, create jobs, promote industrial chain collaboration, and lay a solid security foundation for economic and social stability.

[0042] (2) The technical solution of the present invention fills the technical gap in the industry at home and abroad:

[0043] The present invention builds a deceptive defense system for industrial control systems based on Conpot, which effectively fills these gaps through unique design and optimization. First of all, the flexible and modular design of the Conpot honeypot itself provides a basis for customized simulation to a certain extent, but the present invention further improves it so that it can simulate different industrial control equipment and protocols more accurately. For example, in the honeypot deployment and configuration link, the files for simulating Siemens S7-200 series PLCs in the default template are deeply analyzed and modified, solving the defect that its original fingerprint information is easily identified. At the same time, detailed parameter configuration is performed for different models of PLCs such as Siemens S7-300 and S7-315, achieving a high degree of simulation.

[0044] In terms of honeynet construction, the network bridge technology is innovatively used to set up the honeynet gateway and connect multiple different types of honeypot nodes, realizing the communication service interaction between honeypot nodes and building a more realistic and attractive industrial control network environment, which is not fully realized by previous industrial control honeypot technology. In the log collection and HMI simulation part, the MySQL database is used to uniformly manage the logs of multiple honeypots, analyze attack behaviors from multiple dimensions, and transform the static UI of the Conpot honeypot into a highly simulated microgrid management system login interface, which greatly improves the monitoring and analysis capabilities of attack behaviors and has groundbreaking significance in the industry.

[0045] (3) The technical solution of the present invention solves the technical problems that people have been eager to solve but have never been able to solve successfully:

[0046] For a long time, the security of industrial control systems has been faced with the difficult problem of how to effectively defend against unknown attacks and advanced persistent threats. Traditional security protection methods are often powerless in the face of new attacks, and although honeypot technology has certain potential, there are many challenges when it is actually applied to industrial control systems.

[0047] The present invention successfully solves these problems. On the one hand, by establishing a highly simulated industrial control system environment, the attacker is induced to shift his attention to the honeynet system, thereby protecting the security of the real industrial control system. In actual experiments, after a series of optimized configurations of the Conpot honeypot and the construction of the honeynet, the attacker's attack behavior was successfully attracted, and it was effectively monitored and analyzed. For example, by comparing the Nmap fingerprint scan and the Shodan search results, the accuracy of the present invention in simulating industrial control equipment was verified, making it difficult for attackers to distinguish between the real system and the honeypot system. On the other hand, by improving the configuration of the honeypot and the architecture of the honeynet, the problem that the honeypot was easily identified by the attacker in the past was solved, such as modifying the fingerprint information of the Conpot honeypot and transforming the static UI into a dynamic simulation interface. Measures such as greatly enhancing the deceptiveness and practicality of the honeypot have successfully overcome the long-standing technical difficulties in the field of industrial control system security protection.

[0048] (4) The technical solution of the present invention overcomes technical prejudice.

[0049] In the field of industrial control system security protection, there has long been a technical bias. The traditional concept is that firewalls and intrusion detection systems can prevent external attacks by setting rules and monitoring traffic, and are the main means to ensure the security of industrial control systems. However, with the increasing sophistication of network attacks and the frequent emergence of advanced persistent threats (APT), these traditional protection methods have gradually exposed their limitations.

[0050] The technical solution of the present invention overcomes this technical bias. Through in-depth research and practice, it is proved that the unique advantages of the industrial control system deception defense system based on Conpot in dealing with complex security threats. Unlike traditional protection methods, the honeypot system of the present invention does not passively wait for an attack to occur and then respond, but takes the initiative to attack by building a highly simulated industrial control environment to attract attackers, thereby discovering potential security risks in advance. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a flow chart of a method for constructing a deceptive defense system for an industrial control system based on Conpot provided by an embodiment of the present invention;

[0052] Figure 2 is a diagram of the Conpot processing process provided by an embodiment of the present invention;

[0053] Figure 3 It is a Conpot deployment flow chart provided by an embodiment of the present invention;

[0054] Figure 4 It is a network topology diagram of the industrial control honeynet provided by an embodiment of the present invention;

[0055] Figure 5 It is an Nmap fingerprint scan diagram provided by an embodiment of the present invention;

[0056] Figure 6 is a Shodan search result graph provided by an embodiment of the present invention;

[0057] Figure 7 This is a Wireshark packet capture diagram provided by an embodiment of the present invention;

[0058] Figure 8 It is a log collection record diagram provided by an embodiment of the present invention;

[0059] Fig. 9 This is an HMI simulation interface diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0061] like Figure 1 The embodiment of the present invention provides a method for constructing a deceptive defense system for an industrial control system based on Conpot, the method comprising:

[0062] S1: Establish a simulated industrial control system environment by simulating industrial control equipment such as programmable logic controllers, SCADA servers, and industrial control protocols such as S7comm, Modbus, and SNMP;

[0063] S2: Honeypot deployment and configuration;

[0064] S3: Honeynet construction;

[0065] S4: Log collection and HMI simulation.

[0066] In the first step, a complete virtual industrial control system environment is constructed by simulating common industrial control devices such as programmable logic controllers (PLCs) and SCADA servers, and simulating industrial control protocols (such as S7comm, Modbus, SNMP, etc.). Through the industrial control protocol support provided by the Conpot platform, the behavior and interaction of real industrial control systems are simulated, inducing potential attackers to regard the simulation environment as a real target, thereby shifting the risk of attack. The combination of equipment and protocols in this environment is designed to be as close to the actual industrial control system as possible, making it difficult for attackers to detect its falsity.

[0067] In the simulated industrial control system environment, multiple honeypots are deployed as deception targets. Honeypots simulate the characteristics of real industrial control devices, including common open ports, device response behaviors, and fault states, to attract the attention of attackers. At the same time, honeypots are configured according to the type of expected threats, such as setting specific vulnerabilities or response modes to lure attackers to further interact. During deployment, honeypot devices are distinguished from normal industrial control system traffic, and the credibility of honeypots is enhanced through disguised behaviors, ensuring that attackers focus their resources on honeypots.

[0068] Honeynet virtually connects multiple honeypot devices to form a multi-layered, highly complex virtual industrial control network environment. Devices in the honeynet interact with each other through simulated industrial control protocols (such as S7comm and Modbus), simulating normal industrial control network traffic, further increasing the credibility and complexity of the system. In addition, by introducing dynamic behaviors (such as data flow changes, device status response adjustments, etc.) into the honeynet, its behavior is closer to the dynamic characteristics of the real industrial control system network, thereby further confusing attackers and reducing the possibility of attackers identifying the honeynet.

[0069] In the simulation environment, by integrating the log collection module, all interactive behaviors in the honeypot are recorded in real time, including the ports that the attacker attempts to access, the commands sent, and the malicious behaviors attempted to be performed. Log data can help the security team analyze the attacker's behavior patterns, tool usage, and potential attack targets. At the same time, the simulated HMI (human-machine interface) system provides the attacker with a false operation interface to induce the attacker to perform further interactive operations. These simulated interactive behaviors can not only delay the attacker's offensive process, but also provide detailed data support for subsequent security research and defense strategy optimization.

[0070] (1) Conpot Honeypot

[0071] Conpot is an open source low-interaction industrial control honeypot developed and designed by the Mushroom Security team. It establishes a simulated industrial control system environment by simulating industrial control devices such as programmable logic controllers (PLCs), SCADA servers, and industrial control protocols such as S7comm, Modbus, and SNMP. The Conpot honeypot adopts a flexible and modular design, allowing users to customize the configuration based on the general configuration and simulate different scenarios by adding customized templates or protocols. Table 1 shows the core modules of the Conpot honeypot and its functions.

[0072] Table 1 Conpot modules and functions

[0073]

[0074] When Conpot is attacked or invaded by the network, the following is the process: Figure 2 As shown in the figure. First, Conpot will open a specific port for listening. When the attack establishes a connection, it will start capturing the attack traffic. At the same time, the session management module will create a new session to track and manage this connection and interact with the attack traffic data. All data information will be recorded in the log. Finally, different response measures will be taken according to the attacker's behavior and log records.

[0075] (2) Honeypot deployment and configuration

[0076] The deployment of Conpot honeypot usually requires the following steps: Figure 3 Several steps are shown.

[0077] In the default template of Conpot, the template.xml file simulates the Siemens S7-200 series PLC. This file not only simulates the copyright information of the device, but also imitates the CPU information of the device. However, it has the defect of Conpot's unique fingerprint information "88111222", which makes it easy for attackers to identify it and mark it as a "honeypot".

[0078] According to the characteristics of the equipment and protocols in the industrial control system, the initial configuration file of the Conpot honeypot needs to be modified. This paper takes the Siemens S7-300 PLC device in the microgrid as an example to simulate the configuration of Conpot. Table 2 lists the modified key parameter information in detail.

[0079] Table 2 Siemens S7-300 simulation parameter information

[0080]

[0081] (3) Honeynet Construction

[0082] A single honeypot can only simulate a specific device or service in an industrial control system, which cannot attract attackers. Therefore, in order to simulate a more realistic and attractive industrial control network environment, it is necessary to deploy multiple different types of honeypot nodes at the same time, simulate different types of industrial control equipment, and enable communication services to interact between honeypot nodes. In this way, when an attacker detects a honeypot node, he will also detect the data flow exchange with other honeypot nodes, and cannot determine whether it is a trap, thereby effectively enhancing the system's deception ability.

[0083] Therefore, based on the simulation of the Siemens S7-300 PLC device, another model of PLC device in the microgrid is further simulated. By using the bridge technology to set up a special honeynet gateway and connecting two different honeypot nodes with different network interfaces of the gateway, a simulated honeynet system based on the power industrial control system environment of the microgrid is constructed. The other model used here is Siemens S7-315, and its key parameter information is shown in Table 3.

[0084] Table 4:Simulation Parameter Information for Siemens S7-315

[0085]

[0086]

[0087] (4) Log collection and HMI simulation

[0088] In the honeynet architecture, since there may be a large number of honeypots deployed, in order to collect the log information generated by each honeypot in the honeynet, an effective log management system is essential for monitoring and analyzing the security status of the entire industrial control network. In order to uniformly manage the logs of each honeypot node, this article uses the MySQL database, which is convenient for users to query efficiently and analyze from multiple dimensions, so as to deeply understand the attack behavior.

[0089] The Conpot honeypot will automatically record valuable information in the MySQL database, such as timestamp, session ID, source IP address, request details, and response status. The detailed design of the table in the MySQL database is shown in Table 4.

[0090] Table 4 Session information record table

[0091]

[0092] Since the UI (User Interface) of the Conpot honeypot defaults to a static web page. When an attacker finds that the 8800 port of Conpot is open through scanning, he can access it with a browser. Static pages are easily discovered by attackers, causing them to stop attacking the honeypot. In order to make the honeynet more effective in attracting and diverting network attacks, this paper uses div elements and CSS styles to modify the original static web page in the index.html sub-file in the http folder, and designs it into a highly simulated microgrid management system login interface, thereby constructing a real HMI human-computer interaction interface, making it difficult for attackers to distinguish the authenticity.

[0093] The embodiment of the present invention provides a system for constructing a deceptive defense system for an industrial control system based on Conpot based on the method for constructing a deceptive defense system for an industrial control system based on Conpot, and the system specifically includes:

[0094] The industrial control system environment establishment module establishes a simulated industrial control system environment by simulating industrial control equipment such as programmable logic controllers, SCADA servers, and industrial control protocols such as S7comm, Modbus, and SNMP;

[0095] Deploy the configuration module and establish a module connection with the industrial control system environment. This is used to target the characteristics of the equipment and protocols in the industrial control system. The initial configuration file of the Conpot honeypot needs to be modified.

[0096] The honeynet construction module is connected to the deployment configuration module, and deploys multiple different types of honeypot nodes at the same time, simulating different types of industrial control equipment respectively, and enabling communication services to interact between honeypot nodes;

[0097] The log collection and HMI simulation module is connected to the honeynet construction module and uses the MySQL database, which facilitates users to query efficiently and analyze from multiple dimensions, thereby gaining a deep understanding of attack behavior.

[0098] An embodiment of the present invention provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for constructing a deceptive defense system for an industrial control system based on Conpot.

[0099] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the method for constructing a deceptive defense system for an industrial control system based on Conpot.

[0100] An embodiment of the present invention provides an information data processing terminal, which is used to implement the industrial control system deception defense system construction system based on Conpot.

[0101] Relevant evidence of the technical effects achieved by the embodiments of the present invention.

[0102] (1) Experimental environment

[0103] The honeypot target machine is an Ubuntu 24.04 system based on the Linux 64-bit operating system, and the attack machine is a Kali 6.6.9 system based on the Debian12.x 64-bit Linux distribution operating system.

[0104] (2) Experimental analysis

[0105] After starting the Conpot honeypot, start Nmap in the terminal of the Kali Linux virtual machine. The info.nse script in Nmap can be used to detect the fingerprint information of the S7 series PLC. Use nmap-p102--script s7-info.nse <ip>Instruction, scanning results such as Figure 5 shown.

[0106] The Nmap scan results show that Conpot's fingerprint information has been modified to "S C-E3U665052014" and the CPU information has also been modified to "CPU 317-2PN / DP". Then use the Shodan search engine to search for real Siemens industrial control devices, such as Figure 6 shown.

[0107] The search results show the specific parameter information of real Siemens S7-300 PLCs in Italy and Russia. It can be seen that the fingerprint information scanned by Namp is no different from the fingerprint information of real industrial control equipment.

[0108] By capturing the network traffic with Wireshark software on Ubuntu, we can conclude that the S7comm server completes three handshakes in total. The second handshake establishes the S7comm connection after parsing the TPKT (Transport Protocol Data Unit) and COTP (Connection-Oriented Transport Protocol) layer data, and receives the S7comm data cycle during the third handshake. Figure 7 shown.

[0109] While performing the Nmap scan, the MySQL database also records the log information of the attacker's interaction with the honeynet, including the name of the honeypot node, timestamp, attacker's source IP address, and protocol information, such as Figure 8 By analyzing these log information in detail, users can also gain a deeper understanding of the attacker's behavior patterns.

[0110] Access the Conpot webpage in the browser of the Kali Linux virtual machine. The displayed interface is as follows Fig. 9 shown.

[0111] It can be seen that the interface is highly similar to the login interface of the real microgrid management system in terms of visual design and interaction logic, making it difficult for attackers to distinguish its authenticity after accessing it. At the same time, all the information operated by the attacker on the web page will be captured and recorded by the honeynet. This high degree of simulation makes it easier for attackers to be attracted and stay in the honeynet system for a long time, effectively protecting the security of the real system.

[0112] The final results show that Conpot performs well on simulated industrial control equipment and can effectively attract the attention of attackers and monitor and analyze them. The industrial control honeynet system constructed in this paper can effectively perform deceptive defense.

[0113] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0114] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.< / ip>

Claims

1. A method for constructing a deceptive defense system for an industrial control system based on Conpot, characterized in that: The method includes: S1: Simulate programmable logic controller (PLC), SCADA server industrial control equipment, and establish a simulated industrial control system environment by implementing S7comm, Modbus, and SNMP industrial control protocols; S2: deploying a honeypot device in the simulated industrial control system environment, wherein the honeypot device simulates the characteristics of a real industrial control device, including open ports, response behaviors, and device status, attracts attackers through disguised behaviors, and sets specific vulnerabilities or response modes according to expected threat types; S3: Connect multiple honeypot devices through simulated industrial control protocols to build a virtual industrial control network environment, simulate normal industrial control network traffic, and introduce dynamic behaviors to improve the credibility of the honeynet; S4: An integrated log collection module records the interactive behaviors of the honeypot device, including accessing ports, sending commands, and malicious behaviors. At the same time, a false operation interface is provided through the HMI simulation module to induce attackers to perform further operations and obtain attack behavior data.

2. The method for constructing a deceptive defense system for an industrial control system based on Conpot according to claim 1 is characterized in that: The Conpot honeypot adopts a flexible and modular design, which allows users to customize the configuration based on the general configuration and simulate different scenarios by adding customized templates or protocols.

3. The method for constructing a deceptive defense system for an industrial control system based on Conpot as claimed in claim 1, characterized in that: When the Conpot is attacked or invaded by the network, the processing process is as follows: First, Conpot will open a specific port for listening. When the attack establishes a connection, it will start capturing the attack traffic. At the same time, the session management module will create a new session to track and manage this connection and interact with the attack traffic data. All data information will be recorded in the log. Finally, different response measures will be taken according to the attacker's behavior and log records.

4. The method for constructing a deceptive defense system for an industrial control system based on Conpot as claimed in claim 1, characterized in that: The S2 specifically includes: In the default template of Conpot, the template.xml file simulates the Siemens S7-200 series PLC. The file not only simulates the copyright information of the device, but also imitates the CPU information of the device. However, it has the defect of Conpot's unique fingerprint information "88111222", which makes it easy for attackers to identify it and mark it as "honeypot". According to the characteristics of the equipment and protocols in the industrial control system, the initial configuration file of the Conpot honeypot needs to be modified.

5. The method for constructing a deceptive defense system for an industrial control system based on Conpot as claimed in claim 1, characterized in that: The S3 specifically includes: In order to simulate a more realistic and attractive industrial control network environment, it is necessary to deploy multiple different types of honeypot nodes at the same time to simulate different types of industrial control equipment respectively, and enable communication services to interact between honeypot nodes; in this way, when an attacker detects a honeypot node, he will also detect the data flow exchange with other honeypot nodes, and cannot determine whether it is a trap, thereby effectively enhancing the system's deception ability; Therefore, based on the previous simulation of the Siemens S7-300 PLC device, another model of PLC device in the microgrid is further simulated; a special honeynet gateway is set up by using bridge technology, and two different honeypot nodes are connected to different network interfaces of the gateway, thereby constructing a simulated honeynet system based on the microgrid power industrial control system environment.

6. The method for constructing a deceptive defense system for an industrial control system based on Conpot as claimed in claim 1, characterized in that: The S4 specifically includes: In the honeynet architecture, since there may be a large number of honeypots deployed, in order to collect the log information generated by each honeypot in the honeynet, an effective log management system is essential for monitoring and analyzing the security status of the entire industrial control network. In order to uniformly manage the logs of each honeypot node, the MySQL database is used to facilitate users to query efficiently and analyze from multiple dimensions, so as to deeply understand the attack behavior; The Conpot honeypot automatically records valuable information in a MySQL database, such as timestamps, session identifiers, source IP addresses, request details, and response status; Since the UI of the Conpot honeypot defaults to a static web page; when an attacker finds that the 8800 port of Conpot is open through scanning, he can access it with a browser; the static page is easily discovered by the attacker, causing the attacker to stop attacking the honeypot; in order to make the honeynet more effectively attract and divert network attacks, the index.html sub-file in the http folder is modified using div elements and CSS styles to modify the original static web page, and it is designed as a highly simulated microgrid management system login interface, thereby constructing a real HMI human-computer interaction interface, making it difficult for attackers to distinguish the authenticity.

7. A system for constructing a deceptive defense system for an industrial control system based on Conpot based on the method for constructing a deceptive defense system for an industrial control system based on Conpot as claimed in claims 1 to 6, characterized in that: The system specifically includes: The industrial control system environment establishment module establishes a simulated industrial control system environment by simulating industrial control equipment such as programmable logic controllers, SCADA servers, and industrial control protocols such as S7comm, Modbus, and SNMP; Deploy the configuration module and establish a module connection with the industrial control system environment. This is used to target the characteristics of the equipment and protocols in the industrial control system. The initial configuration file of the Conpot honeypot needs to be modified. The honeynet construction module is connected to the deployment configuration module, and deploys multiple different types of honeypot nodes at the same time, simulating different types of industrial control equipment respectively, and enabling communication services to interact between honeypot nodes; The log collection and HMI simulation module is connected to the honeynet construction module and uses the MySQL database, which facilitates users to query efficiently and analyze from multiple dimensions, thereby gaining a deep understanding of attack behavior.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for constructing a deceptive defense system for an industrial control system based on Conpot as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the method for constructing a deceptive defense system for an industrial control system based on Conpot as described in any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the industrial control system deceptive defense system construction system based on Conpot as described in claim 7.

Images