Scholarlink

This article discusses the importance of industrial control systems in daily life and highlights the security challenges they face under the trends of Industry 4.0 and smart manufacturing. It focuses on Programmable Logic Controllers (PLCs) as the core equipment in industrial control systems, and the reality that their critical nature makes them a target for attacks. Addressing the limitations and challenges of existing PLC emulate honeypots, the article introduces EmuGuard, a high-interaction, fingerprint-enhanced, feature-rich ICS active defense system based on PLC emulation. EmuGuard uses programmable switches instead of traditional switches to increase defenders’ initiative in the network. EmuGuard achieves advanced emulation of various industrial control protocols, improves device fingerprint information, and enhances fingerprint deception realism through scripting techniques. Additionally, EmuGuard implements a high emulation level of PLC devices and constructs a diverse set of attack scenarios to provide realistic feedback to attackers. Finally, the article summarizes EmuGuard’s contributions, including providing active defense methods using programmable switches, emulating a complete ICS business systems, improving the fingerprint information of emulational devices, and offering system flexibility and reconfigurability based on containerized software.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

EmuGuard: An Active Defense System for ICS Emulation

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Mengen Liang,
  • Tao Liu,
  • Xiaowei Song,
  • Wei Peng,
  • Mingqian Yang,
  • Ning Hu

摘要

This article discusses the importance of industrial control systems in daily life and highlights the security challenges they face under the trends of Industry 4.0 and smart manufacturing. It focuses on Programmable Logic Controllers (PLCs) as the core equipment in industrial control systems, and the reality that their critical nature makes them a target for attacks. Addressing the limitations and challenges of existing PLC emulate honeypots, the article introduces EmuGuard, a high-interaction, fingerprint-enhanced, feature-rich ICS active defense system based on PLC emulation. EmuGuard uses programmable switches instead of traditional switches to increase defenders’ initiative in the network. EmuGuard achieves advanced emulation of various industrial control protocols, improves device fingerprint information, and enhances fingerprint deception realism through scripting techniques. Additionally, EmuGuard implements a high emulation level of PLC devices and constructs a diverse set of attack scenarios to provide realistic feedback to attackers. Finally, the article summarizes EmuGuard’s contributions, including providing active defense methods using programmable switches, emulating a complete ICS business systems, improving the fingerprint information of emulational devices, and offering system flexibility and reconfigurability based on containerized software.