Medium Interactivity Operational Technology Honeypots for Threat Intelligence

Threats towards operational technology and industrial control systems are ever increasing. The landscape has become more perilous due to the increasing connectivity between operational and informational technology sectors. New threats are not only taking the form of sophisticated malware tool sets like Chernovite's "PipeDream" or Sandworm's "CrashOverride", but we are also seeing an increase in generic ransomware attacks originating from the Ransomware-as-a-service trend.

In a time where attacks are growing more frequent, it is important that we maintain a flow of threat intelligence to assist in securing these systems.

Honeypots have a long history being deployed mimicking Internet-of-Things devices to gather threat intelligence, but their application in the field of operational technology is considerably under-explored. A pivotal issue surrounding this is a lack of research towards effective deployments. Low-interactivity honeypots are not adequately convincing and are only effective for catching automated attacks, whereas high interaction honeypots are far too expensive to deploy on a larger scale.

This research aims to explore the creation of a honeypot which strikes a balance between simulation and physical hardware, also known as a medium-interactivity honeypot. Throughout the stages of research, what makes an effective honeypot will be explored from the angle of technological implementation, effective deceptive characteristics, as well as the lawful and ethical deployment of such measures.