research-article

Open access

Interaction matters: a comprehensive analysis and a dataset of hybrid IoT/OT honeypots

Authors:

Shreyas Srinivasa,

Jens Myrup Pedersen,

Emmanouil VasilomanolakisAuthors Info & Claims

ACSAC '22: Proceedings of the 38th Annual Computer Security Applications Conference

Pages 742 - 755

https://doi.org/10.1145/3564625.3564645

Published: 05 December 2022 Publication History

All formats PDF

Abstract

The Internet of things (IoT) and critical infrastructure utilizing operational technology (OT) protocols are nowadays a common attack target and/or attack surface used to further propagate malicious actions. Deception techniques such as honeypots have been proposed for both IoT and OT but they either lack an extensive evaluation or are subject to fingerprinting attacks. In this paper, we extend and evaluate RIoTPot, a hybrid-interaction honeypot, by exposing it to attacks on the Internet and perform a longitudinal study with multiple evaluation parameters for three months. Furthermore, we publish the aforementioned study in the form of a dataset that is available to researchers upon request. We leverage RIoTPot’s hybrid-interaction model to deploy it in three interaction variants with six protocols deployed on both cloud and self-hosted infrastructure to study and compare the attacks gathered. At a glance, we receive 10.87 million attack events originating from 22,518 unique IP addresses that involve brute-force, poisoning, multistage and other attacks. Moreover, we fingerprint the attacker IP addresses to identify the type of devices who participate in the attacks. Lastly, our results indicate that the honeypot interaction levels have an important role in attracting specific attacks and scanning probes.

References

[1]

P Dilsheer Ali and T. Gireesh Kumar. 2017. Malware capturing and detection in dionaea honeypot. In 2017 Innovations in Power and Advanced Computing Technologies (i-PACT). IEEE, Vellore, India, 1–5. https://doi.org/10.1109/IPACT.2017.8245158

[2]

Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J. Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Deepak Kumar, Chaz Lever, Zane Ma, Joshua Mason, Damian Menscher, Chad Seaman, Nick Sullivan, Kurt Thomas, and Yi Zhou. 2017. Understanding the Mirai Botnet. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 1093–1110. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis

Digital Library

[3]

Timothy Barron and Nick Nikiforakis. 2017. Picky Attackers: Quantifying the Role of System Properties on Intruder Behavior. In Proceedings of the 33rd Annual Computer Security Applications Conference (Orlando, FL, USA) (ACSAC ’17). Association for Computing Machinery, New York, NY, USA, 387–398. https://doi.org/10.1145/3134600.3134614

Digital Library

[4]

Busybox. 2022. Busybox DockerHub. BusyBox. https://hub.docker.com/_/busybox

[5]

Warren Z. Cabral, Craig Valli, Leslie F. Sikos, and Samuel G. Wakeling. 2021. Analysis of Conpot and Its BACnet Features for Cyber-Deception. In Advances in Security, Networks, and Internet of Things, Kevin Daimi, Hamid R. Arabnia, Leonidas Deligiannidis, Min-Shiang Hwang, and Fernando G. Tinetti (Eds.). Springer International Publishing, Cham, 329–339.

[6]

Censys. 2021. Censys Search. Retrieved June 28, 2021 from https://censys.io/

[7]

Fan Dang, Zhenhua Li, Yunhao Liu, Ennan Zhai, Qi Alfred Chen, Tianyin Xu, Yan Chen, and Jingyu Yang. 2019. Understanding Fileless Attacks on Linux-Based IoT Devices with HoneyCloud. In Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services (Seoul, Republic of Korea) (MobiSys ’19). Association for Computing Machinery, New York, NY, USA, 482–493. https://doi.org/10.1145/3307334.3326083

Digital Library

[8]

Docker. 2022. DockerHub. Docker. https://hub.docker.com/

[9]

Michael Dodson, Alastair R. Beresford, and Mikael Vingaard. 2020. Using Global Honeypot Networks to Detect Targeted ICS Attacks. In 2020 12th International Conference on Cyber Conflict (CyCon), Vol. 1300. IEEE, Estonia, 275–291. https://doi.org/10.23919/CyCon49761.2020.9131734

[10]

ENISA. 2020. ENISA Threat Landscape 2020 - Malware. ENISA. https://www.enisa.europa.eu/publications/malware

[11]

Golang. 2021. Go Language. Retrieved March 16, 2022 from https://golang.org/

[12]

GreyNoise. 2022. GreyNoise. https://viz.greynoise.io/

[13]

Juan David Guarnizo, Amit Tambe, Suman Sankar Bhunia, Martin Ochoa, Nils Ole Tippenhauer, Asaf Shabtai, and Yuval Elovici. 2017. SIPHON: Towards Scalable High-Interaction Physical Honeypots. In Proceedings of the 3rd ACM Workshop on Cyber-Physical System Security (Abu Dhabi, United Arab Emirates) (CPSS ’17). Association for Computing Machinery, New York, NY, USA, 57–68. https://doi.org/10.1145/3055186.3055192

Digital Library

[14]

iphub. 2022. iphub. iphub. https://iphub.info/

[15]

Celine Irvene, David Formby, Samuel Litchfield, and Raheem Beyah. 2018. HoneyBot: A Honeypot for Robotic Systems. Proc. IEEE 106, 1 (2018), 61–70. https://doi.org/10.1109/JPROC.2017.2748421

[16]

Xingbin Jiang, Michele Lora, and Sudipta Chattopadhyay. 2020. An Experimental Analysis of Security Vulnerabilities in Industrial IoT Devices. ACM Trans. Internet Technol. 20, 2, Article 16 (may 2020), 24 pages. https://doi.org/10.1145/3379542

Digital Library

[17]

Linuxserver.io. 2022. Openssh DockerHub. OpenSSH. https://hub.docker.com/r/linuxserver/openssh-serve

[18]

Samuel Litchfield, David Formby, Jonathan Rogers, Sakis Meliopoulos, and Raheem Beyah. 2016. Poster: Re-thinking the honeypot for cyber-physical systems. In Poster at IEEE Symposium on Security and Privacy. IEEE, San Jose, California.

[19]

Microsoft. 2021. The Mozi Botnet. Microsoft. https://www.microsoft.com/security/blog/2021/08/19/how-to-proactively-defend-against-mozi-iot-botnet/

[20]

Thomas Miller, Alexander Staves, Sam Maesschalck, Miriam Sturdee, and Benjamin Green. 2021. Looking Back to Look Forward: Lessons Learnt from Cyber-Attacks on Industrial Control Systems. Int. J. Crit. Infrastruct. Prot. 35, C (dec 2021), 14 pages. https://doi.org/10.1016/j.ijcip.2021.100464

Digital Library

[21]

Mawal Mohammed, Mahmoud Elish, and Abdallah Qusef. 2016. Empirical insight into the context of design patterns: Modularity analysis. In 2016 7th International Conference on Computer Science and Information Technology (CSIT). IEEE, Amman, Jordan, 1–6. https://doi.org/10.1109/CSIT.2016.7549474

[22]

Lisa O. Monaco. 2021. DAG Monaco Delivers Remarks at Press Conference on Darkside Attack on Colonial Pipeline. The United States Department of Justice. https://www.justice.gov/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline

[23]

Shun Morishita, Takuya Hoizumi, Wataru Ueno, Rui Tanabe, Carlos Gañán, Michel JG van Eeten, Katsunari Yoshioka, and Tsutomu Matsumoto. 2019. Detect me if you… oh wait. An internet-wide view of self-revealing honeypots. In 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM). IEEE, IEEE, Washington DC, USA, 134–143.

[24]

Digital Ocean. 2022. Digital Ocean Droplet monitoring. Retrieved March 16, 2022 from https://docs.digitalocean.com/products/monitoring/

[25]

OITC. 2022. Modbus-server DockerHub. OITC. https://hub.docker.com/r/oitc/modbus-server

[26]

Michel Oosterhof. 2016. Cowrie SSH/telnet honeypot. https://github.com/micheloosterhof/cowrie

[27]

Yin Minn Pa Pa, Shogo Suzuki, Katsunari Yoshioka, Tsutomu Matsumoto, Takahiro Kasama, and Christian Rossow. 2015. IoTPOT: Analysing the Rise of IoT Compromises. In 9th USENIX Workshop on Offensive Technologies (WOOT 15). USENIX Association, Washington, D.C.https://www.usenix.org/conference/woot15/workshop-program/presentation/pa

[28]

plgd. 2022. CoAP-Gateway. plgd. https://hub.docker.com/r/plgd/coap-gateway

[29]

Deutsche Telekom AG Honeypot Project. 2022. T-Pot: A Multi-Honeypot Platform.

[30]

Eclipse Project. 2022. Eclipse Mosquitto DockerHub. Eclipse Project. https://hub.docker.com/_/eclipse-mosquitto

[31]

The Apache HTTP Server Project. 2022. HTTPD DockerHub. The Apache Project. https://hub.docker.com/_/httpd

[32]

The Tor Project. 2022. ExoneraTor. The Tor Project. https://metrics.torproject.org/exonerator.html

[33]

L Rist. 2009. Glastopf project.

[34]

Lukas Rist, Johnny Vestergaard, Daniel Haslinger, A Pasquale, and J Smith. 2013. Conpot ics/scada honeypot.

[35]

Frances Robles and Nicole Perlroth. 2021. ‘Dangerous Stuff’: Hackers Tried to Poison Water Supply of Florida Town. The New York Times. https://www.nytimes.com/2021/02/08/us/oldsmar-florida-water-supply-hack.html

[36]

Stewart Sentanoe, Benjamin Taubmann, and Hans P. Reiser. 2018. Sarracenia: Enhancing the Performance and Stealthiness of SSH Honeypots Using Virtual Machine Introspection. In Secure IT Systems, Nils Gruschka (Ed.). Springer International Publishing, Cham, 255–271.

[37]

SHODAN. 2022. Honeypot or Not?https://honeyscore.shodan.io

[38]

SHODAN. 2022. Shodan. https://www.shodan.io/

[39]

Shreyas Srinivasa, Jens Myrup Pedersen, and Emmanouil Vasilomanolakis. 2021. Gotta catch ’em all: a Multistage Framework for honeypot fingerprinting. arxiv:2109.10652 [cs.CR]

[40]

Shreyas Srinivasa, Jens Myrup Pedersen, and Emmanouil Vasilomanolakis. 2021. Open for Hire: Attack Trends and Misconfiguration Pitfalls of IoT Devices. Association for Computing Machinery, New York, NY, USA, 195–215. https://doi.org/10.1145/3487552.3487833

Digital Library

[41]

Shreyas Srinivasa, Jens Myrup Pedersen, and Emmanouil Vasilomanolakis. 2021. RIoTPot: a modular hybrid-interaction IoT/OT honeypot. In 26th European Symposium on Research in Computer Security (ESORICS) 2021. Springer, Springer, Darmstadt, Germany.

[42]

Dino Tools. 2010. Web Honeypot. https://github.com/DinoTools/dionaea/

[43]

R Trapkickin. 2015. Who is scanning the Internet?

[44]

Veronica Valeros and Sebastian Garcia. 2022. Hornet 40: Network dataset of geographically placed honeypots. Data in Brief 40(2022), 107795. https://doi.org/10.1016/j.dib.2022.107795

[45]

Veronica Valeros and Sebastian Garcia. 2022. Hornet 40: Network dataset of geographically placed honeypots. Data in Brief 40(2022), 107795. https://doi.org/10.1016/j.dib.2022.107795

[46]

Emmanouil Vasilomanolakis, Shankar Karuppayah, Max Mühlhäuser, and Mathias Fischer. 2014. HosTaGe: A Mobile Honeypot for Collaborative Defense. In Proceedings of the 7th International Conference on Security of Information and Networks (Glasgow, Scotland, UK) (SIN ’14). Association for Computing Machinery, New York, NY, USA, 330–333. https://doi.org/10.1145/2659651.2659663

Digital Library

[47]

Alexander Vetterl and Richard Clayton. 2018. Bitter Harvest: Systematically Fingerprinting Low- and Medium-interaction Honeypots at Internet Scale. In 12th USENIX Workshop on Offensive Technologies (WOOT 18). USENIX Association, Baltimore, MD, 9. https://www.usenix.org/conference/woot18/presentation/vetterl

[48]

Alexander Vetterl and Richard Clayton. 2019. Honware: A Virtual Honeypot Framework for Capturing CPE and IoT Zero Days. In 2019 APWG Symposium on Electronic Crime Research (eCrime). IEEE, Pittsburgh, PA, USA, 1–13. https://doi.org/10.1109/eCrime47957.2019.9037501

[49]

Virustotal. 2022. Virustotal. https://www.virustotal.com

[50]

Jianxin Wang, Ming K. Lim, Chao Wang, and Ming-Lang Tseng. 2021. The evolution of the Internet of Things (IoT) over the past 20 years. Computers & Industrial Engineering 155 (2021), 107174. https://doi.org/10.1016/j.cie.2021.107174

[51]

Andy Wick and community. 2022. Arkime. Arkime. https://arkime.com/index#home/

[52]

Armin Ziaie Tabari and Xinming Ou. 2020. A Multi-Phased Multi-Faceted IoT Honeypot Ecosystem. Association for Computing Machinery, New York, NY, USA, 2121–2123. https://doi.org/10.1145/3372297.3420023

Digital Library

Cited By

Altunay H(2024)Analysis of Cyber Attacks Using HoneypotBlack Sea Journal of Engineering and Science10.34248/bsengineering.1531420Online publication date: 3-Sep-2024
https://doi.org/10.34248/bsengineering.1531420
Omar ASoubra HMoulla DAbran A(2024)An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT DevicesIoT10.3390/iot50400335:4(730-755)Online publication date: 31-Oct-2024
https://doi.org/10.3390/iot5040033
Putrevu VMukhopadhyay SManna SRani NVaid AChunduri HPutrevu MShukla S(2024)ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent ThreatsDigital Threats: Research and Practice10.1145/36519915:3(1-35)Online publication date: 7-Mar-2024
https://dl.acm.org/doi/10.1145/3651991
Show More Cited By

Index Terms

Interaction matters: a comprehensive analysis and a dataset of hybrid IoT/OT honeypots
1. Security and privacy
  1. Network security

Recommendations

Wireless honeypots: survey and assessment
ISTA '09: Proceedings of the 2009 conference on Information Science, Technology and Applications

The great recent advancements in wireless networking have drawn attention to the privacy and security problems that accompanied them. Wireless Honeypots have been introduced as tools whose value lies in the unauthorized attempts to use them. They have ...
Probabilistic Performance Analysis of Moving Target and Deception Reconnaissance Defenses
MTD '15: Proceedings of the Second ACM Workshop on Moving Target Defense

Deception and moving target reconnaissance defenses are techniques that attempt to invalidate information an attacker attempts to gather. Deception defenses attempt to mislead attackers performing network reconnaissance, while moving target defenses ...
Towards proactive detection of advanced persistent threat (APT) attacks using honeypots
SIN '15: Proceedings of the 8th International Conference on Security of Information and Networks

The Advanced Persistent Threat (APT) attacks are special kind of slow moving attacks that are designed to defeat security controls using unique attack vectors and malware specifically developed for the target organization. Aim behind APT attacks is not ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Other conferences

ACSAC '22: Proceedings of the 38th Annual Computer Security Applications Conference

December 2022

1021 pages

ISBN:9781450397599

DOI:10.1145/3564625

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 05 December 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Funding Sources

COM3, an Interreg project supported by the North Sea Programme of the European Regional Development Fund of the European Union

Conference

ACSAC

ACSAC: Annual Computer Security Applications Conference

December 5 - 9, 2022

TX, Austin, USA

Acceptance Rates

Overall Acceptance Rate 104 of 497 submissions, 21%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

6
Total Citations
View Citations
1,339
Total Downloads

Downloads (Last 12 months)699
Downloads (Last 6 weeks)103

Reflects downloads up to 12 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Altunay H(2024)Analysis of Cyber Attacks Using HoneypotBlack Sea Journal of Engineering and Science10.34248/bsengineering.1531420Online publication date: 3-Sep-2024
https://doi.org/10.34248/bsengineering.1531420
Omar ASoubra HMoulla DAbran A(2024)An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT DevicesIoT10.3390/iot50400335:4(730-755)Online publication date: 31-Oct-2024
https://doi.org/10.3390/iot5040033
Putrevu VMukhopadhyay SManna SRani NVaid AChunduri HPutrevu MShukla S(2024)ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent ThreatsDigital Threats: Research and Practice10.1145/36519915:3(1-35)Online publication date: 7-Mar-2024
https://dl.acm.org/doi/10.1145/3651991
Ahmed YBeyioku KYousefi M(2024)Securing smart cities through machine learning: A honeypot‐driven approach to attack detection in Internet of Things ecosystemsIET Smart Cities10.1049/smc2.12084Online publication date: 29-May-2024
https://doi.org/10.1049/smc2.12084
Singla RSrinivasa SReddy NPedersen JVasilomanolakis EBettati R(2023)An Analysis of War Impact on Ukrainian Critical Infrastructure Through Network Measurements2023 7th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA58422.2023.10199005(1-10)Online publication date: 26-Jun-2023
https://doi.org/10.23919/TMA58422.2023.10199005
Chowdhury SDudley BSun R(2023)The Case for Virtual PLC-enabled Honeypot Design2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)10.1109/EuroSPW59978.2023.00044(351-357)Online publication date: Jul-2023
https://doi.org/10.1109/EuroSPW59978.2023.00044

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

HTML Format

View this article in HTML Format.

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Table of Contents