PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

Javier Franco, Ahmet Aris, Berk Canberk, A. Selcuk Uluagac

arXiv:2108.02287v1cs.CR

TL;DR

IoT, IIoT, and CPS are increasingly important but exposed by device constraints, legacy assumptions, and expanding connectivity, creating a need to understand attacker behavior. This paper surveys their honeypot and honeynet research, organizes it through taxonomies and design factors, and identifies open issues for future work.

  • Problem

    IoT, IIoT, and CPS environments face security challenges from resource limitations, legacy assumptions, and increasing Internet connectivity, while existing defenses do not transparently expose attacker behavior.

  • Method

    The paper comprehensively surveys honeypot and honeynet models, classifies them by multiple characteristics, analyzes common features, and extracts design factors and open research problems.

  • Results

    The survey provides a taxonomy and extensive analysis of IoT, IIoT, and CPS honeypots and honeynets while identifying key design factors and open issues.

  • Takeaways & Limitations

    Future honeypot and honeynet research should address emerging IoT platforms, deployment-location optimization, and greater use of machine learning, especially for IIoT and CPS.

Abstract

from arXiv · show

The Internet of Things (IoT), the Industrial Internet of Things (IIoT), and Cyber-Physical Systems (CPS) have become essential for our daily lives in contexts such as our homes, buildings, cities, health, transportation, manufacturing, infrastructure, and agriculture. However, they have become popular targets of attacks, due to their inherent limitations which create vulnerabilities. Honeypots and honeynets can prove essential to understand and defend against attacks on IoT, IIoT, and CPS environments by attracting attackers and deceiving them into thinking that they have gained access to the real systems. Honeypots and honeynets can complement other security solutions (i.e., firewalls, Intrusion Detection Systems - IDS) to form a strong defense against malicious entities. This paper provides a comprehensive survey of the research that has been carried out on honeypots and honeynets for IoT, IIoT, and CPS. It provides a taxonomy and extensive analysis of the existing honeypots and honeynets, states key design factors for the state-of-the-art honeypot/honeynet research and outlines open issues for future honeypots and honeynets for IoT, IIoT, and CPS environments.

I. INTRODUCTION

IoT, IIoT, and CPS connect digital systems to physical processes across many domains but remain vulnerable because of resource constraints, legacy security assumptions, and connectivity. The survey addresses this gap by comprehensively analyzing their honeypot and honeynet research, developing a taxonomy, identifying design factors, and outlining open problems.

  • Motivation: IoT, IIoT, and CPS span connected devices and physical-process control across homes, infrastructure, industry, healthcare, transportation, and agriculture.Their boundaries overlap, although IoT emphasizes networking and information technology while CPS emphasizes sensing and controlling the physical world.
  • Motivation: Resource limitations restrict IoT security mechanisms, while IIoT and CPS inherited systems that were not initially designed with security in mind.The discovery of Stuxnet, DuQu, and Flame broke the assumption that isolated industrial systems were secure.
  • Motivation: Traditional defenses can protect these environments but do not transparently reveal how attackers operate, whereas honeypots and honeynets provide actionable attacker intelligence.Honeypots deceive attackers into believing they reached real systems, and honeynets combine two or more honeypots.
  • Research gap: No prior study holistically covered honeypot and honeynet models for IoT, IIoT, and CPS while analyzing similarities, differences, design points, and implementation considerations.The survey covers state-of-the-art models proposed from 2002 through 2020.
  • Contributions: The survey classifies existing research, presents taxonomies, extracts shared characteristics, identifies key design factors, and outlines open research problems.Its contributions include a taxonomy for honeypots and honeynets in IoT, IIoT, and CPS environments.
  • Organization: The paper covers background, classification methodology, IoT and CPS/IIoT models, taxonomies, and related design and research issues.The organization explicitly separates IoT research from CPS and IIoT research while including related work and terminology.

B. Other Related Terms

Honeypots and honeynets are distinguished from related simulation tools by their decoy purpose, and classified across multiple design dimensions. Interaction level involves trade-offs among realism, fidelity, risk, cost, and maintainability.

  • Other Related Terms: Testbeds, emulators, and simulation frameworks model devices or environments but do not function as attacker-attracting decoy systems.Researchers use these tools to create honeypots and honeynets.
  • Classification Methodology: The survey classifies honeypots and honeynets by purpose, role, interaction level, scalability, resources, source-code availability, and application.Its taxonomy builds on prior surveys and identifies recurring characteristics.
  • Classification Methodology: Research honeypots gather attack information, whereas production honeypots focus on preventing attackers from reaching an organization’s actual systems.Role separately distinguishes active client honeypots from mostly passive server honeypots.
  • Classification Methodology: Low-interaction honeypots are inexpensive and easier to maintain, while high-interaction honeypots provide operating-system access and higher-fidelity behavioral data.High interaction also increases setup complexity, maintenance demands, compromise risk, and liability.
  • Classification Methodology: Medium-interaction honeypots occupy a continuum between low and high interaction, while hybrid honeynets combine different levels to balance their benefits.The survey emphasizes that interaction characteristics are fluid rather than fixed.
  • Classification Methodology: Scalable honeypots can expand their monitored decoys, while physical, virtual, and hybrid resource choices trade data-capture fidelity against cost.Open-source availability supports researchers’ ability to understand and improve decoy systems.
  • Classification Methodology: IoT studies are organized by general, IoT, and Smart Home applications, while the review presents them through multiple research sections and interaction characteristics.The reviewed IoT section covers general application honeypots, full device emulation, and attack-focused studies.

A. General Application Honeypots

General-purpose honeypots provide reusable foundations for IoT research, while later systems add adaptive behavior, full-device emulation, and attack analysis capabilities.

  • General Application Honeypots: General-purpose honeypots were not created specifically for IoT but are reused in IoT research; all considered tools are open source except AHA with Rootkit Detection.The survey lists these systems in Table I.
  • General Application Honeypots: HoneyD creates low-interaction, scalable virtual honeypots that can integrate physical machines and simulate numerous network services.Comparisons with real IoT devices found similar served content but significant differences in response times and Nmap results.
  • General Application Honeypots: Dionaea provides medium-interaction simulation for many services and aims to obtain malware copies, but its static configuration limits adaptation.It has also been deployed on Raspberry Pi for cost-effective IoT honeypot research.
  • General Application Honeypots: Kippo is a scalable SSH honeypot that logs brute-force and interactive attacks, while RASSH adds reinforcement-learning-based dynamic responses.RASSH can allow, block, or delay attacker actions.
  • General Application Honeypots: Cowrie supports medium- to high-interaction virtual honeypots, logging simulated UNIX shell activity or proxying SSH and Telnet interactions to backend systems.Its flexibility helped make it a foundation for later IoT honeypots.
  • General Application Honeypots: QRASSH used Cowrie and deep Q-learning, but its reward functions were subjective; IRASSH-T subsequently pursued optimal reward functions for self-adaptive behavior.The later system was intended to attract more attacks and collect more malware.
  • General Application Honeypots: IoT measurement research combined a /15 network telescope with Cowrie, HoneyPy, and Dionaea to obtain broader traffic observations and attack details.The study observed commonly targeted IoT protocols, including Telnet and SSH.
  • Full Device Emulation: Full device emulation increases realism and detection difficulty, and five of the six identified full-emulation IoT studies were also self-adaptive.Examples include FIRMADYNE, ThingPot, and Chameleon.

C. Research with IoT Honeypots and Honeynets Focused on Type of Attack

Attack-focused IoT honeypot research spans botnets, authentication, protocol abuse, denial-of-service, malware, and man-in-the-middle attacks, using interaction, emulation, and learning techniques.

  • Attack Types: IoT attack-focused studies are grouped by target attack type, including Telnet, SSH, HTTP, CWMP, authentication, DoS, DDoS, fileless malware, MitM, and other attacks.Table III lists the considered IoT honeypots by attack type.
  • Telnet Attacks: IoTPOT simulates Telnet services for different IoT devices and focuses on Telnet intrusions, while MTPot detects Mirai through Telnet connections and requested commands.MTPot is low interaction, virtual, unscalable, and designed specifically for Mirai attacks.
  • Telnet and SSH Attacks: ML-Enhanced Cowrie classified Telnet and SSH requests across six categories, with Support Vector Machine achieving 97.39 % accuracy.The categories included malicious payload, SSH attack, XOR DDoS, suspicious, spying, and clean requests.
  • Telnet and SSH Attacks: IRASSH-T applies reinforcement learning to identify reward functions that improve self-adaptive attacker communication and malware collection.Its evaluation reported improvement over previously identified reward functions.
  • Botnet Attacks: Three Cowrie honeypots found that two Mirai attack patterns accounted for 97.7 % of received attacks, with Telnet botnet attacks commonly creating or downloading files.The study clustered command sequences using edit distance to identify identical attack patterns.
  • Telnet, SSH, HTTP, and CWMP Attacks: A hybrid protocol honeypot uses low-interaction front ends for Telnet, SSH, HTTP, and CWMP with a configurable high-interaction backend for deeper analysis.The backend may use physical or virtual machines and protocol-specific modules.
  • DoS and DDoS Attacks: IoT attack defenses include IDS-directed analysis of malicious DoS requests, ML classifiers trained on ThingPot logs, and NFV/SDN-based adaptive honeynets for DDoS botnets.VPN tunnels were also used to make a small number of real devices appear as many globally distributed devices.
  • Authentication Attacks: 94% of honeypot activity consisted of dictionary attacks that repeatedly tried sequential username and password combinations.The cited analysis concerns attempts to access the network and was not specifically geared toward Zigbee.

VI. TAXONOMY OF HONEYPOTS AND HONEYNETS FOR INTERNET OF THINGS

The survey classifies IoT honeypot and honeynet research by development, interaction, resources, applications, services, tools, openness, and attacks. It identifies inheritance patterns, common infrastructure choices, and versatile self-adaptive models.

  • Development of Research Over Time: IoT honeypot research began in 2015 with IoTPOT, while about half of IoT honeypot models inherit from another model.Cowrie has directly spawned the greatest number of IoT honeypots; research increased after Mirai in 2017 and self-adaptive development increased in 2019.
  • Common Characteristics: Most surveyed models are research systems using Linux server decoys, and all open-source models were written in Python.HoneyIo4 and Molina’s IoT honeynet were production systems, while HIoTPot served both research and production purposes.
  • Level of Interaction: Most research combines low- and high-interaction benefits through medium-interaction or hybrid honeynet systems.The survey notes that interaction-level classification is fluid because definitions beyond low interaction vary across studies.
  • Resource Level and Scalability: Only Siphon, Stafira, and Scalable VPN-forwarded Honeypots used physical resources; most IoT honeynet research used virtual resources.Most systems were scalable, but Dionaea and HoneyIo4 could deploy only one simulation at a time.
  • Application: Nine models targeted general use, 22 targeted IoT applications, and four targeted Smart Home applications.The survey distinguishes general-purpose, IoT-specific, and Smart Home application areas.
  • Simulated Services: Telnet, SSH, and HTTP(S) were the most commonly simulated services, matching the three most attacked protocols identified by prior work.These are standard TCP/IP protocols rather than IoT-specific protocols; five models additionally stood out for full-device emulation and self-adaptation.
  • Model Characteristics: IoTCandyJar, Chameleon, Firmadyne, Honware, and ML-enhanced ThingPot were the most versatile models because they emulate full devices and adapt self-adaptively.Only IoTCandyJar and Firmadyne were open-source among these five models.
  • Openness and Tools: Approximately half of the surveyed IoT honeypot and honeynet models were open-source, while Shodan, Nmap, and MASSCAN were the most commonly used tools.The survey attributes tool prevalence to availability, low cost, ease of use, and effectiveness; Nmap scans networks and MASSCAN emphasizes speed.

J. The Most Common Attacks

IoT honeypots and honeynets most commonly addressed Telnet, SSH, DoS/DDoS, and HTTP(S) attacks, while also covering reconnaissance, brute force, malware, and Mirai activity.

  • The Most Common Attacks: Telnet, SSH, DoS/DDoS, and HTTP(S) attacks were the most commonly detected or tested attack types in IoT honeypots and honeynets.Reconnaissance, brute force, malware, and Mirai attacks were also detected or tested.
  • The Most Common Attacks: Botnet, Man-in-the-Middle, malicious cryptocurrency mining, and buffer overflow attacks were less commonly detected or tested.These categories appeared less often than the main attack types surveyed.

VII. HONEYPOTS AND HONEYNETS FOR IIOT AND CPS

The survey organizes IIoT and CPS honeypot and honeynet research by application type. The categories are ICS, Smart Grid, Water Systems, Gas Pipeline, Building Automation Systems, and IIoT.

  • VII. HONEYPOTS AND HONEYNETS FOR IIOT AND CPS: IIoT and CPS honeypot and honeynet studies are grouped into ICS, Smart Grid, Water Systems, Gas Pipeline, Building Automation Systems, and IIoT applications.The grouping provides the organizational basis for the survey’s overview of these environments.

A. Honeypots and Honeynets for Industrial Control Systems

ICS honeypot research spans low- and high-interaction systems, virtual and physical deployments, protocol-specific simulations, and increasingly realistic industrial environments. Studies report scanning activity, deployment trade-offs, and differences between tools and configurations.

  • ICS Honeypots and Honeynets: SCADA HoneyNet and Digital Bond’s SCADA Honeynet used low-interaction virtual systems to simulate PLC services and monitor attacker traffic.The projects supported protocols including Modbus/TCP, FTP, Telnet, HTTP, and SNMP.
  • Conpot and Conpot-based ICS Honeypots: Conpot is a maintained open-source low-interaction ICS honeypot supporting industrial protocols including IEC 60870-5-104, BACnet, EtherNet/IP, Modbus, and S7comm.Researchers deployed Conpot on cloud platforms, network emulators, and Raspberry Pi hardware for different ICS studies.
  • Conpot and Conpot-based ICS Honeypots: Shodan and Nmap identified different ports in Conpot deployments, while Ferretti’s four-month study found most ICS scanners were legitimate.The authors reported that legitimate scanner patterns could help detect malicious scanning and attack activity.
  • Conpot and Conpot-based ICS Honeypots: DiPot extended Conpot with higher-fidelity protocol simulations, data capture, K-means analysis, and visualization, and its cloud honeypots deceived Shodan.Zhao and Qin similarly enhanced Conpot with additional S7comm functions and a dynamic HMI.
  • ICS Honeypots and Honeynets: Lu et al.’s Conpot deployment simulated Siemens S7 PLCs on Raspberry Pi and Arduino hardware but provided limited implementation detail and no deployment or testing results.The stated boundary concerns PLC simulation details, supported industrial protocols, and empirical evaluation.
  • ICS Honeypots and Honeynets: S7CommTrace received more connections than Conpot in 60-day deployments across four cloud locations and supported more S7comm functions and sub-functions.Both systems were deployed worldwide for comparative analysis.
  • ICS Honeypots and Honeynets: Honeyd+ simulated 75 ICS honeypots with one PLC device and Raspberry Pi board, but serious performance drops began at five simultaneous attacker connections.The result illustrates a scalability trade-off between decoy count and concurrent connection handling.
  • ICS Honeypots and Honeynets: High-interaction deployments used real PLC hardware to increase fidelity and reduce detectability, including production environments and a smart-factory honeypot.Hilt et al.’s system used four real PLCs, HMIs, robotics, workstations, fake files, monitoring taps, and multiple industrial protocols.

B. Honeypots and Honeynets for Smart Grid

Smart-grid honeypot research spans low- and high-interaction designs, emulates industrial protocols and devices, and records scanning and compromise attempts.

  • CryPLH simulates Siemens Simatic 300 PLC devices and observed scanning, pinging, and SSH login attempts.
  • SHaPe extends Dionaea with libiec61850 to emulate IEC 61850-compliant IEDs in electric power substations.
  • GridPot emulates SCADA components with physics simulations and anomaly detection based on changes in simulated data.
  • Over 600 Modbus and 102 S7comm connections were recorded during 19 days of GridPot data collection, alongside heavy HTTP scanning.
  • A Conpot-based Siemens S7-200 PLC honeypot received compromise attempts primarily through HTTP, Modbus, and S7comm services.

C. Honeypots and Honeynets for Water Systems

Water-system honeypots range from virtual low-interaction decoys to high-interaction and hybrid CPS designs, with efforts to improve realism and reduce detectability.

  • Wilhoit used high- and low-interaction honeypots that mimicked a water pressure station across physical PLCs and geographically distributed virtual HMIs.
  • MiniCPS-based designs separated honeypots from real ICS networks and modeled networks, industrial devices, and physical processes.
  • MiniCPS was also extended with a nonlinear plant model to improve realism in simulated ICS response times and water-tank behavior.
  • MimePot used SDN traffic redirection and network-address camouflage while modeling ICS components and control routines with a linear time-invariant model.
  • GasPot deployments identified reconnaissance attempts and DDoS attacks, while an enhanced version added realistic responses and fuller ATG command support.
  • High-interaction CPS honeypots face safety risks, costs, and reduced usefulness without the physical CPS component, motivating hybrid designs such as HoneyPhy.

VIII. TAXONOMY OF HONEYPOTS AND HONEYNETS FOR IIOT AND CPS

The IIoT and CPS honeypot literature shows substantial reuse of existing systems and virtual resources, while emphasizing research deployments, scalability, and varied interaction levels.

  • Development of research over time: More than one-third of works inherit from earlier honeypots, with Conpot serving as the basis for six developed honeypots.
  • Development of research over time: Researchers also use Mininet, IMUNES, GridLab-D, SoftGrid, POWERWORLD, and MiniCPS as emulation, simulation, or framework building blocks.
  • Development of research over time: Half of the studies propose independent honeypots, reflecting shortcomings of existing systems or their fingerprintability by attackers.
  • Common characteristics: Most proposals serve research purposes rather than production deployment, because IIoT and CPS environments make active security-tool deployment difficult.
  • Common characteristics: Python is the most favored development language, supported by libraries for industrial protocols; Conpot is also written in Python.
  • Common characteristics: Half of the works provide low interaction, while medium-, high-, and hybrid-interaction honeypots appear in approximately equal numbers.
  • Common characteristics: Most decoy systems use virtual resources, and the majority have scalable designs, partly because physical industrial devices are costly and difficult to scale.

G. Industrial process simulations

Industrial-process simulations connect honeypot behavior to modeled physical systems, using hydraulic, nonlinear, linear, and power-system models and comparing simulated responses with physical behavior.

  • Only five studies employed industrial-process simulations, including hydraulic, nonlinear, linear time-invariant, and Newton-Raphson power-system models.
  • Industrial-process simulation studies evaluated physical effects through plant variables such as tank levels, sensor and actuator operations, and network conditions.
  • HoneyPhy compared heating and cooling curves from a physical HVAC system with those from its process model.

H. Simulated services

IIoT and CPS honeypots support both industrial and general-purpose protocols, with Modbus, HTTP, SNMP, and S7comm appearing most often.

  • Modbus, HTTP, SNMP, and S7comm are the most popular protocols among IIoT and CPS honeypot studies.

I. Availability of open-source honeypot and honeynet solutions

Open implementations are uncommon and unevenly maintained across the surveyed honeypot and honeynet studies.

  • Eight studies provide implementations openly, but several shared systems are unavailable or no longer maintained.CISCO SCADA HoneyNet’s last shared version was in 2015, while Digital Bond’s SCADA Honeynet is unreachable.
  • Conpot remains open-source and actively maintained, alongside only Zamiri et al.’s honeypot among the remaining studies.

J. Most commonly used tools

The survey identifies common attack-detection tools and design considerations spanning protocols, deployment, realism, interaction, resources, and security improvement.

  • Most commonly used tools: Nmap is used most commonly, followed by Wireshark, Snort IDS, Shodan tools, Mininet, iptables, tshark, TCPDUMP, and syslog.Nmap supports fingerprinting and exposed-port identification, while Wireshark supports traffic capture and analysis.
  • Most commonly used tools: Scanning attacks are the most commonly detected or tested attacks in IIoT and CPS honeypots and honeynets.DoS/DDoS, SSH, brute-force, Man-in-the-Middle, ransomware, cryptocurrency mining, malware, and ICS-specific attacks are also covered.
  • Lessons learned: Design choices should account for application area, purpose, cost, location, interaction level, resources, services, tools, fingerprintability, and realism.
  • Lessons learned: Deployment location affects activity, visibility, cost, and suitability, but only twelve reviewed studies reported where their decoys were deployed.University, cloud, and public-IP deployments each offer different benefits and risks, including possible provider or address-space fingerprinting.
  • Lessons learned: High interaction can reveal complex attacks but increases the importance of realistic simulation or emulation and adequate resource selection.
  • Lessons learned: Realistic decoys should avoid hardcoded configurations, missing service features, unusual behavior, detectable hosting platforms, and unrealistic response times.These issues can expose a system as a decoy and undermine attacker engagement.
  • Lessons learned: Honeypot-derived information can support security improvements such as IoTCheck measures for passwords, user privileges, and related device protections.

B. Open Issues

The survey synthesizes open issues across coverage, deployment, realism, management, detection, learning, and production use for IoT, IIoT, and CPS decoys.

  • Open Issues: 79 honeypots and honeynets were studied in detail, while the survey identifies additional open issues for future research.
  • Emerging Technologies/Domains: Decoy coverage remains limited for emerging domains, including wearable devices, medical devices, smart cities, transportation, nuclear plants, and modern healthcare.The survey also notes limited coverage for building automation systems.
  • Unexplored Protocols: Existing decoys do not cover every protocol or service; no reviewed study supports HART or WirelessHART, and proprietary Enterprise IoT protocols remain underexplored.The survey suggests extending open-source systems such as Conpot, Honeyd, Dionaea, and Kippo.
  • Emerging Platforms: No studies focus on honeypot design for several emerging IoT management platforms, despite their increasing popularity.The survey suggests extending existing open-source IoT decoys to these platforms.
  • Optimized Deployment Location: No reviewed study optimizes deployment location under multiple constraints such as fingerprintability, suitability, complexity, and cost.The authors call for analysis and frameworks to approximate better deployment decisions.
  • Anti-Detection Mechanisms: Virtual decoys are widely used, but reviewed studies did not address anti-detection mechanisms for attackers using virtual-environment detection.The authors recommend anti-detection mechanisms for medium- and high-interaction virtual decoys.
  • Vulnerabilities of Industrial Devices: Industrial-device vulnerabilities remain unexamined in IIoT and CPS decoy proposals, leaving attacker attention to vulnerable versus patched systems unresolved.The survey proposes advertising vulnerable and patched ICS firmware or management software.
  • Insider Attacks: Current research largely omits simple large-scale deployment and insider attacks, although NFV, containers, and SDN are proposed as possible enablers.
Loading 2108.02287v1…