Design And Implementation Of Industrial Control Intrusion Capture System Based On Honeypot Technology

With the close integration of industrial control and Internet technology,more and more industrial control security problems are exposed to the public eye.The traditional industrial control network environment is closed,and the Internet network has strict boundaries with the outside world.However,the deep integration of industrialization and information technology has brought more Internet factors to industrial control systems,so the traditional network attacks have gradually penetrated into the field of industrial control.In recent years,industrial control network security incidents occur frequently,a variety of industrial control equipment vulnerabilities are common,and even Advanced Persistent Threat(APT)also appears the trend of growth.Under the severe security situation,we must adopt corresponding countermeasures and defense measures.This paper first introduces the research background and significance of the research,the research status and research purpose at home and abroad,and the narrates the concepts and knowledge related to industrial control and honeypot technology,emphatically analyzes the feasibility of industrial control security threats and the use of honeypot technology as means of defense,for the construction of intrusion capturing system laid the foundation.Honeypot technology as a new type of network security technology,in terms of security and threat warning,than other defense means to perform better.The intrusion prevention system based on honeypot technology is a kind of dynamic security defense mode,which combines intrusion deception,data capture,data analysis,data visualization and data tracing.At the same time,this paper uses honeypot technology to simulate industrial control scenarios and equipment to attract attackers to invade.The intrusion and trapping technology for industrial control network is a new type of industrial control network security defense technology.It helps to analyze the attacker and network space engine behavior,determine the hacker attacks,attack tools and mode,can provide a certain threat intelligence for the field of industrial control,with theprevention of APT attack effect.Finally,according to the security requirements of industrial control,open-source honeypot framework is developed twice,and perfect open source framework,data visualization and analysis module based on attack information is introduced,which makes the system applicable to the industrial control network security research.Based on the diversity of the industrial control system,this paper sets up different types of honeypot and intrusion path,which is good for confusing the attacker and the network search engine.And the cloud host in the form of deploying honeypot honeypot,different distribution in different countries of the IP,the system presents the distribution difference in attack data,has a certain significance to study the attack situation in different countries from the industrial control.