HoneyPhy: A physics-aware CPS honeypot framework

Abstract

Cyber Physical Systems (CPS) are vulnerable systems, and attacks are currently being carried out against them. Some of these attacks have never been seen before, and so the first step in defending CPS is to understand what attackers are doing, and how they are doing it. Traditionally, honeypots have been a tool used to gain this information, but honeypots need to be convincing to fool attackers. For CPS, being convincing entails not only ad- dressing networking concerns, but also modeling device actuation fingerprints and how the attached process responds to actuations. In order to create a convincing CPS honeypot, a framework was developed to address the need to present convincing networking, device, and process fingerprints. Two proof of concept systems were developed for this framework, and a set of proof of concept device and process models were implemented.