HiFiPot: a High-Fidelity Emulation Framework for Internet of Things Honeypots - Inria - Institut national de recherche en sciences et technologies du numérique
Conference Papers Year : 2023

HiFiPot: a High-Fidelity Emulation Framework for Internet of Things Honeypots

Abstract

Internet of Things (IoT) devices are easy targets for attackers. Preventing and counter-fighting this threat impose to capture and analyze attackers' behaviors. Several IoT-oriented honeypots have been proposed recently while, in parallel, emulation techniques for IoT devices have been improved to allow firmware analysis of this type of devices. In this paper, our objective is to consolidate these two facets in a single framework called HiFiPot. It is capable of creating a highinteraction honeypot on-the-fly with a high fidelity, i.e. from a firmware image. Our technique improves the most recent stateof-the-art solution to emulate an IoT device without scarifying the furtiveness. It is based on an iterative learning procedure to automatically correct emulation errors and to ensure Internet connectivity while maintaining these corrections invisible to the attackers. Out of the 1,000 firmware images tested, 443 (44,3%) can be deployed as honeypot. More than 500 instances of HiFiPot were deployed in the wild, and received about 1,900 HTTP traversal attacks, and downloaded 31 distinct malware binaries (out of 909) among which eight were unknown.
Fichier principal
Vignette du fichier
noms.pdf (575.26 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-04180801 , version 1 (13-08-2023)

Licence

Identifiers

Cite

Pierre-Marie Junges, Jérôme François, Olivier Festor. HiFiPot: a High-Fidelity Emulation Framework for Internet of Things Honeypots. NOMS 2023 - IEEE/IFIP Network Operations and Management Symposium (NOMS), May 2023, Miami, United States. ⟨10.1109/NOMS56928.2023.10154359⟩. ⟨hal-04180801⟩
85 View
337 Download

Altmetric

Share

More