Honeynet Module Simulation and Dynamic Configuration of Honeypots Based on Online Learning

With the emergence of various attack techniques, defending against malicious behavior and attacks is very important for industrial control systems. Unlike defenses such as firewalls, intrusion detection, and anti-virus software, honeynet is a more proactive and deceptive defense. This paper addresses the specific design and implementation challenges of honeynets by proposing an innovative approach that leverages a dynamic Human-Machine Interface (HMI) interface for virtual honeypots. This approach enables active trapping of attackers and enhances the overall effectiveness of the honeynet. Additionally, the paper introduces a realistic and dynamic physical process simulation to enhance the functionality of physical honeypots within the honeynet. To achieve dynamic configuration of the honeypots, an online prediction model based on the Follow-the-Regularized-Leader (FTRL) algorithm is presented. The proposed solution is evaluated through the deployment and testing of a high interaction hybrid honeypot system called Baggage Handling System (BHS). The experimental results demonstrate that the honeynet presented in this paper exhibits exceptional concealment, camouflage capability, and interaction capability, while maintaining a high level of cost effectiveness.