HiFiPot: a High-Fidelity Emulation Framework for Internet of Things Honeypots - Inria - Institut national de recherche en sciences et technologies du numérique
Communication Dans Un Congrès Année : 2023

HiFiPot: a High-Fidelity Emulation Framework for Internet of Things Honeypots

Résumé

Internet of Things (IoT) devices are easy targets for attackers. Preventing and counter-fighting this threat impose to capture and analyze attackers' behaviors. Several IoT-oriented honeypots have been proposed recently while, in parallel, emulation techniques for IoT devices have been improved to allow firmware analysis of this type of devices. In this paper, our objective is to consolidate these two facets in a single framework called HiFiPot. It is capable of creating a highinteraction honeypot on-the-fly with a high fidelity, i.e. from a firmware image. Our technique improves the most recent stateof-the-art solution to emulate an IoT device without scarifying the furtiveness. It is based on an iterative learning procedure to automatically correct emulation errors and to ensure Internet connectivity while maintaining these corrections invisible to the attackers. Out of the 1,000 firmware images tested, 443 (44,3%) can be deployed as honeypot. More than 500 instances of HiFiPot were deployed in the wild, and received about 1,900 HTTP traversal attacks, and downloaded 31 distinct malware binaries (out of 909) among which eight were unknown.
Fichier principal
Vignette du fichier
noms.pdf (575.26 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04180801 , version 1 (13-08-2023)

Licence

Identifiants

Citer

Pierre-Marie Junges, Jérôme François, Olivier Festor. HiFiPot: a High-Fidelity Emulation Framework for Internet of Things Honeypots. NOMS 2023 - IEEE/IFIP Network Operations and Management Symposium (NOMS), May 2023, Miami, United States. ⟨10.1109/NOMS56928.2023.10154359⟩. ⟨hal-04180801⟩
85 Consultations
337 Téléchargements

Altmetric

Partager

More