| Honeypot technology,as a special existence in the field of security research,can provide unique value and a special perspective for security personnel.Honeypots protect the security of systems by tricking attackers into a fake environment and deviating from the real one.In addition,honeypots can collect a large amount of attack data to help security personnel analyze the behaviors and strategies of the attacker.However,there are some problems with deploying honeypots in industrial control systems.Firstly,industrial control systems have special physical devices,protocols and control processes,but the existing honeypot architecture is imperfect and lacks relevance,making it difficult to apply to specific industrial control scenarios.Therefore,the existing honeypot research cannot be well applied to special scenarios due to its limitations.Secondly,there are still some shortcomings in the specific design and implementation of honeypots.First,the interaction ability of honeypots is insufficient;second,the honeypots have insufficient ability to simulate the physical process;and third,the dynamic expression of honeypots is insufficient.For the application limitations of existing industrial control honeypots,this paper designs a customized honeynet architecture for airport baggage handling systems.First,a honeynet design structure based on the idea of hierarchical policy is proposed.Different security control and defense mechanisms are assigned to each subsystem of the airport baggage handling system.Secondly,by studying the malware propagation model,a three-dimensional honeynet design and deployment scheme is proposed,and the effectiveness of the introduction of honeynet in suppressing malware propagation in industrial control networks is also verified.The multilayered and three-dimensional honeynet defense architecture implemented in this paper provides new ideas for airport industrial control security research,and provides practical experience for the application of honeypots and honeynets.For the problems existing in the design and implementation of honeynet,this paper provides a dynamic HMI interface for the virtual honeypots in honeynet to realize the active trapping of attackers.It provides real and dynamic physical process simulation for physical honeypots in honeynet.Furthermore,an online prediction model based on FTRL algorithm is provided for the honeypots,which realizes the dynamic configuration of honeypots.Finally,the BHS(Baggage Handling System)high-interactivity hybrid honeynet system is deployed and tested.The results show that the honeynet has excellent concealment,camouflage and interaction capabilities while meeting high cost efficiency.Finally,this paper collects,organizes and presents various types of data from the honeynet.This paper designs and implements a user-friendly visualization system for honeynet,which helps users to monitor the attack situation and attack trend in real time,and manage honeypots in honeynet. |
