Overview on industrial Internet honeynet technology

The industrial Internet was integrated with Internet and IoT technologies into traditional industrial sectors, with the aim of enhancing production efficiency, optimizing resource utilization, and fostering innovation in products and services. However, the complexity of industrial Internet devices and protocols posed security vulnerabilities, resulting in numerous security threats. Honeynets emerged as a powerful cybersecurity measure, employing virtual or simulated systems, services, or resources to lure attackers. Upon interaction with the honeynet, monitoring and recording of attack activities were conducted, which aided in the early detection of novel cybersecurity threats, enhanced network security defenses, and contributed valuable data for security research. A substantial body of literature and resources on industrial Internet honeynets were synthesized, outlining their fundamental concepts and developmental processes. Key technologies of industrial Internet honeynets, including device simulation, protocol emulation, and deployment analysis, were comprehensively discussed. Additionally, a honeynet assessment system based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) framework was proposed, tailored to the functionalities and structures of industrial Internet honeynets. Several industrial Internet honeynets were evaluated using this model, and the conclusion was addressed with prospects for future research in industrial Internet honeynets.