Automated Generation of Configurable, High-Fidelity, Smart Grid Honeynet

Honeypots are valuable tools for collecting real-world attack data and threat intelligence, and a network of honeypots, also called honeynet, further allows us to observe attackers' behavior after their penetration into the infrastructure. Yet, designing and implementing high-fidelity honeynets for smart grid systems remains challenging. Besides the scarcity of available implementations, most of the honeypots available for smart grid offer imitation of a single device (e.g., PLC), and the setup of such devices in a desired topology requires a significant amount of manual configuration efforts. To address the challenge, this paper presents the first-of-its-kind framework for automated instantiation of operational smart-grid honeynets based on user-provided configurations, by extending the automated cyber range generation toolchains, called SG-ML. The developed framework not only facilitates the development of high-fidelity smart grid honeynets but also operation of such honeypot, such as re-configuration and restoration. Our framework integrates and orchestrates configuration of multiple open-source tools, such as Honeyd and HoneyPLC, according to user preferences, for deception. Moreover, multiple communication protocols, Modbus, OPC UA, Siemens S7comm, in addition to IEC 61850, are supported for flexibility. We also tackle a challenge on systematic evaluation of smart grid honeynets. In this direction, in addition to conducting qualitative assessment based on the established taxonomy of fingerprinting tactics, we further develop a toolchain on MITRE Caldera platform for evaluating the deception and logging capabilities of smart grid honeypots/honeynets. The honeynet generation framework and evaluation toolchain will be open-sourced for smart grid R&D community.