IEEE Consumer Electronics Magazine - May/June 2022 - 73

Figure 2. Honeynet design anddeployment diagram.
denotes the information exchange between HIW
and the Honeypot, and that Honeypot needs to
download the mirror image from HIW. The blue
line denotes the control information interaction
between the HCM and the honeypot. The HCM
issues the control instructions to the honeypot,
and the honeypot reports the sample collection
status to the HCM.
HoneyNet Design
In AIoT, we designed and deployed honeynets
to detect threats. The HoneyNet is an active
security defense system composed of multiple
honeypots and business hosts in the IIoT. It can
compensate for the poor defensive effect of a
single honeypot facing complex and changeable
network attack methodologies and multiple
attack targets in the attack-defense game. The
HoneyNet possesses strong interaction and collaboration
characteristics.
The detailed Honeynet design and deployment
diagram is shown in Figure 2. We deploy
honeypots to multiple physical nodes, and each
physical node deploys one ENH honeypot, one
CNH honeypot, and one FNH honeypot. Also, we
deploy the node controllers on the each physical
nodes so that the three honeypots and the node
controllers form a small honeynet. To coordinate
the honeynet on each physical node, we
deploy a master physical node. The master physical
node has a master controller, which is
responsible for communicating with each physical
node controller and can distribute files
and commands, realize tasks such as honeypot
opening and closing, node monitoring, obtain
honeypot response messages, and record them
in the output log, etc. As well, each physical
node connects to a remote container warehouse
May/June 2022
to download and run the required honeypot
images. Compared with traditional honeypots,
the honeypots in our scheme are based on
Docker technology, which greatly reduces the
deployment costs and offer better security, isolation,
flexibility, and scalability. Moreover, the
honeypots can form a dynamic HoneyNet system
with data control, data acquisition, and data
analysis functions. Using the Docker container
configuration file and shell scripts, it is easy to
set up the IP address of the honeypot and open
the corresponding port to build the normal HoneyNet
service.
Data Collection and Preprocessing
AIoT malicious samples refer to program files
or behaviors that can infect IoT devices and
carry out attacks such as distribution denial of
service (DDoS), mining, or steal device information.
First, we use the honeynet designed above
to capture malicious programs and behaviors in
a Sichuan power grid. We obtained 7000 malicious
instances and 5500 normal instances for
comparison. Second, considering the development
history, code characteristics, and the number
of samples actually captured, we divide the
IIoT malicious samples into nine representative
family categories, namely Rbot, ExploitKit, Stuxnet,
Qbot, Xor and Mirai, LuaBot, Elknot,
GoScanSSH, and Benign. When we classify these
samples into families, part of them is done manually
by reverse engineering and part of them is
scanned by vulnerability test. The judgment
results of each engine are integrated for marking.
Finally, to make the samples trainable, we use
Radare2, which is an open source reverse engineering
tool, to extract information from malicious
samples, including 38 different attributes,
such as file format, file type, system bitness, and
so on. For improving the recognition rate of the
model for cyberattacks, we want to use the CNN
model to automatically extract features for training.
We believe that it is necessary to convert
sample data into images, the specific reasons
are as follows: First, the data we obtained
through reverse engineering have noise in the
process of converting to an image, we can
remove the noise; second, it is more suitable to
use images as samples for CNN model training.
73
IEEE Consumer Electronics Magazine - May/June 2022

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May/June 2022
