高交互式工控蜜罐系统设计与实现  

Design and Implementation of Highly Interactive Industrial Control Honeypot System

作　　者：罗野 王英 闫怀超 陈政熙 张家鹏 LUO Ye;WANG Ying;YAN Huaichao;CHEN Zhengxi;ZHANG Jiapeng(Shanghai Institute of Process Automation&Instrumentation Co.,Ld,Shanghai 200233,China;不详)

机构地区：[1]上海工业自动化仪表研究院有限公司,上海200233 [2]不详

出　　处：《自动化仪表》2021年第3期98-101,共4页Process Automation Instrumentation

基　　金：申能新能源工业互联网安全技术保障平台基金资助项目(XX-GYHL-0120-2684)。

摘　　要：随着工业互联网技术在工业行业的广泛应用,工业互联网安全问题也越来越多地暴露在公众视野中。在工业互联网安全领域,攻击和防护之间始终存在着差距。这使得针对工业互联网的安全研究处于一个不利的局面。蜜罐系统作为一种吸引潜在攻击者的陷阱工具,通过服务模拟吸引对象攻击,记录攻击数据、分析攻击行为,研究攻击策略,形成威胁情报数据,在平衡攻击和防护之间差距中起着重要的作用。首先,研究了当前蜜罐系统的背景,分析了不同种类蜜罐系统之间的区别;接着,明确了蜜罐系统的功能需求,提出了基于真实工控环境的高交互式蜜罐系统,完成了蜜罐系统的设计与搭建工作;最后,通过渗透测试验证了蜜罐系统的有效性,为进一步依靠蜜罐系统开展网络安全研究奠定基础。With the widespread application of industrial Internet technology in various industrial industries,more and more industrial Internet security issues are exposed to the public's vision.In the field of industrial Internet security,there is always a gap.between attack and protection,which puts security research on the industrial Internet in a disadvantageous situation.As a trap tool to attract potential attackers,the honeypot system uses service simulation to attract target attacks,records attack data,analyzes attack behaviors,studies attack strategies,and forms threat intelligence data.It plays an important role in balancing the gap between attack and protection.The role of.First studied the background of the current honeypot system,analyzed the differences between different types of honeypot systems,clarified the functional requirements of the honeypot system,and proposed a highly interactive honeypot system based on a real industrial control environment,completing the honeypot system Finally,the effectiveness of the honeypot system was verified through penetration testing,which laid the foundation for further network security research based on the honeypot system.

关 键 词：工.控环境 高交互 蜜罐系统 渗透测试 网络安全 安全防护 主动防御:工业审计 

分 类 号：TH89[机械工程—仪器科学与技术]