PLC Honeypots: Enhancing Interaction-Level Assessment

The motivation for this work arose when noticing that definitions of honeypots’ interaction level are mainly based on the information technology environment and do not reflect operational technology even if several honeypot projects approach this field. Within operational technology, programmable logic controllers (PLCs) have a main role, resulting in several honeypot researchers choosing to mimic this device at a certain interaction level. However, searching for an interaction level definition that approaches PLCs results in few studies. In this context, this work aims to explore how to adapt the information technology definition of the interaction level in order to encompass PLCs and their specific features. The method chosen to obtain inputs was a literature review where, in attempting to keep the connection with information technology, the features were based in terms of honey system, honey service, and honey token. The findings of this review provide a means to translate these terms when developing a PLC honeypot for a desired interaction level, resulting in a metrics proposal for low and high interaction. Summarizing the proposed metrics, the system of a PLC can be considered as the vendor specific firmware, its unique device banner, and a realistic network topology. For services, a PLC honeypot reflects the tasks performed by the real device, thus resulting in industrial communication protocols, network management protocols, appropriate response times, code-related interactions, dynamic input and output data processing, physical process simulation, and web interface. Lastly, a PLC honey token can be approached with the PLC program file, MIB file, and software license, among other elements. Based on these metrics, researchers can better evaluate how to design a programmable logic controller honeypot or select tools that match their target interaction level.