Computer networks are ubiquitous, particularly in enterprise and industrial contexts. For example, industrial control systems monitor and control the operation of machinery, such as wind turbines, gas turbines, compressors, motors, generators, and other devices. Interconnection of these and other computer networks facilitates sharing of information therebetween, but increases the threat of cyber attacks.
Honeynets, Honeypots and honeyports have been employed to address this threat. These systems are used to create fake, or dummy, services which appear legitimate to attackers. Honeynets, Honeyports and/or honeypots may cause an attacker to make additional pivots in a system, stay connected longer, and be more likely to identify themselves or their motives. Honeyports employ server socket listeners which expose fake services in order to entice port scanners to connect thereto, and report when a connection has been established. A honeypot may comprise a partial or full system (e.g., decoy servers or systems) which gathers information regarding the tactics and/or identity of a network intruder. The threat information received by a honey system (e.g. honeyports/pots/nets) facilitates the detection of, investigation of and response to attacks.
However, deployment of honeyports/pots/nets in production environments is typically not feasible due to the high level of overhead required to maintain them. Additionally, an attacker could potentially use the honeyports/pots/nets to gain access to the target network.