用生成模型模拟工业通信，骗过黑客的蜜罐系统。
A Generative Model Based Honeypot for Industrial OPC UA Communication
- 用LSTM学习机械系统状态轨迹，生成逼真OPC UA通信
- 短期生成稳定，长期有偏差，但硬件资源占用极低
- 适合工业安全研究者，尤其关注真实场景防御
工业运营技术（OT）系统因与信息技术（IT）融合，在工业4.0时代日益成为网络攻击目标。除入侵检测系统外，蜜罐也可有效发现攻击。然而，为已有系统构建真实蜜罐尤为困难。本文提出一种基于生成模型的蜜罐，用于模仿工业OPC UA通信。利用长短期记忆（LSTM）网络，蜜罐从记录的状态空间轨迹中学习高度动态机电系统的特征。贡献有二：一是验证了基于生成式机器学习模型的蜜罐可行性；二是公开了一个循环工业过程的数据集。结果表明，该生成模型可可行地通过OPC UA通信复现循环工业过程。短期内，生成轨迹稳定且合理；长期则出现偏差。所提蜜罐实现高效运行于受限硬件，计算资源消耗低。未来工作将聚焦提升模型精度、交互能力，并扩展数据集以支持更广泛应用。
原文摘要 · Abstract (English)
Industrial Operational Technology (OT) systems are increasingly targeted by cyber-attacks due to their integration with Information Technology (IT) systems in the Industry 4.0 era. Besides intrusion detection systems, honeypots can effectively detect these attacks. However, creating realistic honeypots for brownfield systems is particularly challenging. This paper introduces a generative model-based honeypot designed to mimic industrial OPC UA communication. Utilizing a Long ShortTerm Memory (LSTM) network, the honeypot learns the characteristics of a highly dynamic mechatronic system from recorded state space trajectories. Our contributions are twofold: first, we present a proof-of concept for a honeypot based on generative machine-learning models, and second, we publish a dataset for a cyclic industrial process. The results demonstrate that a generative model-based honeypot can feasibly replicate a cyclic industrial process via OPC UA communication. In the short-term, the generative model indicates a stable and plausible trajectory generation, while deviations occur over extended periods. The proposed honeypot implementation operates efficiently on constrained hardware, requiring low computational resources. Future work will focus on improving model accuracy, interaction capabilities, and extending the dataset for broader applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。