A framework for the design and deployment of a SCADA honeynet
Michael Haney, Mauricio Papa · 2014
This paper describes a framework for the design and deployment of SCADA Honeynets using the IMUNES network simulator and exposing it to an external network. IMUNES uses FreeBSD-based kernel-level network stack virtualization to instantiate and simulate network nodes. It also has user-friendly facilities such as a GUI and configuration mechanisms that simplify network topology design. In other words, IMUNES is a viable alternative to live experimental testbed networks. SCADA support is then built on top of IMUNES by incorporating into a node image the necessary components to emulate digital controllers communicating over the network. A prototype is presented where a Java-based package has been added to the network nodes to support the emulation of MODBUS/TCP, a protocol widely used by the oil & gas industry. The framework presented here incorporates a number of design elements and tools for attacker control, data capture, and alerting in a fully functional SCADA Honeynet. Benefits of this framework approach, along with challenges to consider when deploying it, are presented.