Intrusion detection and prevention system for network using Honey pots and Honey token method

King Saud University
Electrical Engineering Department
EE: 524
Project Report on
Intrusion Detection & Prevention system for network
security
Submitted to
Dr. Yahya Subhi Al-Harthi
Name: Mohammed Ahmed Hussain Siddiqui
ID: 436107960
Date: 14/1/2017

2
Abstract
In this research work an Intrusion Detection System (IDS) and Intrusion Prevention
System (IPS) will be implemented to detect and prevent critical networks
infrastructure from cyber-attacks. To strengthen network security and improve the
network's active defense intrusion detection capabilities, this project will consist of
intrusion detection system using honey token based encrypted pointers and intrusion
prevention system which based on the mixed interactive honeypot. The Intrusion
Detection System (IDS) is based on the novel approach of Honey Token based
Encrypted Pointers. This honey token inside the frame will serve as a trap for the
attacker. All nodes operating within the working domain of critical infrastructure
network are divided into four different pools. This division is based per their
computational power and level of vulnerability. These pools are provided with
different levels of security measures within the network. IDS use different number
of Honey Tokens (HT) per frame for every different pool e.g. Pool-A contains 4
HT/frame, Pool-B contains 3 HT/frame, Pool-C contains 2 HT/frame and Pool-D
contain 1 HT/frame. Moreover, every pool uses different types of encryption
schemes (AES-128,192,256). Our critical infrastructure network of 64 nodes is
under the umbrella of unified security provided by this single Network Intrusion
Detection System (NIDS). After the design phase of IDS, we analyze the
performance of IDS in terms of True Positives (TP) and False Negatives (FN).
Finally, we test these IDS through Network Penetration Testing (NPT) phase. The
detection rate depends on the number of honey tokens per frame. Our proposed IDS
are a scalable solution and it can be implemented for any number of nodes in critical
infrastructure network. However, in case of Intrusion Prevention System (IPS) we
use Virtual honeypot technology which is the best active prevention technology
among all honeypot technologies. By using the original operating system and virtual
technology, the honeypot lures attackers in a pre-arranged manner, analyzes and
audits various attacking behavior, tracks the attack source, obtains evidence, and
finds effective solutions.

3
Table of Contents
Chapter 1 ............................................................................................................... 5
Introduction to IDS................................................................................................ 5
1.1 Approach of Honey tokens for Intrusion Detection Systems ............................ 7
1.2 Problem Statement........................................................................................... 7
1.3 Project Contribution......................................................................................... 8
1.4 Working of Intrusion Detection Systems.......................................................... 8
1.5 Types of Intrusion Detection Systems............................................................ 10
1.6 Network Intrusion Detection Systems (NIDS) ............................................... 10
1.7 Host Intrusion Detection Systems (HIDS)...................................................... 11
1.8 Techniques of Intrusion Detection ................................................................. 11
1.9 Signature based Intrusion Detection Technique ............................................. 11
Chapter 2 ............................................................................................................. 12
2.1 Designing IDS using Honey Token (HT) based Encrypted Pointers for Critical
Infrastructure Networks ....................................................................................... 12
2.2 DNP3 Synthetic Traffic Generator................................................................. 14
2.3 Honey Token based Encrypted Pointers......................................................... 16
2.4 System Design ............................................................................................... 17
2.5 Intrusion Detection System Primary Module.................................................. 18
2.6 Intrusion Detection System Secondary Module.............................................. 20
Chapter 3 ............................................................................................................. 21
Results and Discussions....................................................................................... 21
3.1 DNP3 Synthetic Traffic Generator................................................................. 21
3.2 Alarm Analysis of Intrusion Detection System .............................................. 22
3.4 Network Penetration Testing.......................................................................... 25
Chapter 4 ............................................................................................................. 26
Introduction to Intrusion Prevention System (IPS)............................................... 26
4.1 Honeypot definition and development............................................................ 26

4
4.2 Existing types of honeypot............................................................................. 27
4.3 Low-interaction honeypot system .................................................................. 27
4.4 Middle-interaction honeypot system .............................................................. 27
4.5 High-interaction honeypot system.................................................................. 28
4.6 Mixed-interaction honeypot system ............................................................... 28
4.7 System simulation.......................................................................................... 30
Conclusion Future Work...................................................................................... 31
Reference............................................................................................................. 33

5
Chapter 1
Introduction to IDS
Network Security challenges of 21st century is enormous for both commercial sector
and military. With the evolution of Internet, security became a major concern for
everybody. We can better understand the security technologies if we look at the
history of Internet itself. The basic structure of Internet is vulnerable to many
security threats but if the attack method is known then it is easy to deploy certain
security measures which help in making our networks more secure. The world today
is more interconnected than ever before and there is large amount of information on
different networking infrastructures that belong to government, private sector,
military organization and our daily personal information. Security of intellectual
property makes the importance of cyber security greater than ever before. In the
recent past, we witness that critical infrastructures become the prime target for major
cyber-attacks and the security of these critical infrastructure networks emerge as one
of the biggest challenge of the time.
Critical infrastructure networks commonly have command and control system for
smooth and efficient running of their operations. Supervisory Control and Data
Acquisition (SCADA) is mostly used for these purposes. It collects data from all
systems using wide range of sensors and then issue commands to run the operations
of critical infrastructures. The brief overview of the typical SCADA architecture is
shown in Figure 1.1. These SCADA systems are widely used in industrial
installations for the operational control and management of field sensors and
actuators. The typical components of SCADA architecture are described as follows:
Operator: The one who monitors the SCADA system running operations in 24x7
routine. Mostly the operator of SCADA system is a human being keeping an eye on
all important functional parameters of the network that comprises of motors, sensors,
actuators and PLC etc.
Human Machine Interface (HMI): The system which presents process data to the
human operator is known as HMI and through this HMI the human operator can
control all the processes of critical infrastructure.
Master Terminal Unit (MTU): The unit presents data to the human operator
through the HMI interface. It gathers data from the remote PLCs, sensors, motors
and actuator sites, and control signals (commands) are then transmitted by MTU.
Remote Terminal Unit (RTU): This unit acts as a slave in the master/slave
architecture of SCADA system. It receives control signals (commands) from the
MTU and it then forwards these commands to the devices (sensors, motors etc.)
under its control. RTU acquires data from these devices and then transmits the
gathered data to the MTU. An RTU may be a PLC.

6
Communication Links: For communication between Master Terminal Unit (MTU)
and Remote Terminal Unit (RTU) we have communication channels (links) that may
be wired links or wireless links. For protocols that carry the traffic for SCADA
systems (DNP3, IEC 60870-5) any link that provides the bandwidth above 1200 bps
is workable. Distributed Network Protocol-3 (DNP3) is the backbone protocol for
SCADA systems and used by almost all the vendors as their primary protocol for
SCADA command and control architecture.
Figure 1.1: Typical SCADA Architecture
SCADA systems possess a strategic importance because they are used in critical
infrastructure networks for command and control. SCADA based cyber-attacks
disrupt the monitoring and controlling parameters of industrial control
communication protocols and thus capable of causing serious system failures or in
some cases cause physical damage to the critical infrastructure networks. There are
many real world documented cyber-attacks on critical infrastructures in last few
years which clearly prove the vulnerability of these networks. Number of countries
including Russia and Taiwan are involved in DNP-3 port scanning activities on the
critical infrastructure networks of many western countries. This port scanning is
strong evidence that attackers are searching for potential vulnerabilities in SCADA
command and control networks and trying to get that piece of information which
will later help in launching a massive attack on the critical infrastructure sensor
networks. The forensic systems for the detection of cyber-attacks on these SCADA
based networks are not common. SCADA based cyber-attacks are mostly directed
towards those devices which are used in critical infrastructure environment e.g.,
Programmable Logical Controllers (PLC), Intelligent Electronic Devices (IED),
Programmable Automation Controllers (PAC), Remote Terminal Units (RTU) and
Master Terminal Units (MTU). Critical infrastructure communication networks are

7
vulnerable to command injection attacks, reconnaissance class attacks and response
injection attacks. Command injection attacks inject malicious codes and commands
in the payload area of the packets carrying traffic for SCADA based critical
infrastructures, the malicious codes and commands when successfully executed on
the RTU devices will causes massive damages to the industrial control system
operations e.g., in case of Stuxnet, the worm monitors the communication between
WinCC tool and RTU. When a specific signature related to the RTU operation
(possible command) is found, worm immediately replaced that command signature
by the malicious code and thus causing physical damages in critical infrastructure
control systems. Reconnaissance attacks gather important information about the
critical infrastructure network devices and their configurations e.g., manufacturer of
devices (PLC, RTU, MTU), deployed industrial network support protocol, memory
type, system serial number, system model numbers etc. All this information is used
to design the SCADA based cyber-attack. Response injection attacks are used to
present incorrect sensor information. Out of all these categories the most dangerous
is command injection attack. In our research work we are focused on command
injection attacks in SCADA based critical infrastructure networks and our research
work is focused between HMI/MTU and RTU/PLC because this is the most
vulnerable area of SCADA based critical infrastructure network.
1.1 Approach of Honey tokens for Intrusion Detection Systems
Honey token is the security tool used for intrusion detection. Its concept is derived
from honeypots and honeynets. A honey token is a honeypot that is not a computer
system but just a piece of data. The core value of honey tokens lies not in their use,
but in their abuse. So, a honey token is a piece of data which is used to trap an
attacker, it appears to be the part of the data and alerts system administrator when it
is accessed by an attacker [9]. In our approach of IDS, a honey token is nothing but
a DNP3 packet which we embed inside the transmission frame along with regular
DNP3 packets that carry normal network traffic.
1.2 Problem Statement
The security of critical infrastructure network becomes a key issue after recent
cyber-attacks especially attacks like ―Stuxnet‖ that destroy and disrupt the
operations of these networks. Moreover, there are many hidden vulnerabilities in the
existing industrial protocols like DNP3 and IEC 60870.5 that can easily be exploited
by the attackers. Firewall scanning is only outwards and it is not a complete solution
for a network of critical infrastructure facilities whereas IDS seems to be a good
choice. Our future intrusion detection systems must be able to protect our networks
despite of all these vulnerabilities that exist in running SCADA networks. Future
IDS must also be capable enough to counter the external as well as internal threats.

8
Online connectivity is increasing nowadays and for enhancing the overall
production, these critical infrastructure networks relate to other networks as well as
with Internet. This massive connectivity provides attackers with much more
opportunities and imposes a greater threat for the security of critical infrastructure
networks.
1.3 Project Contribution
The aim of this work is to design and develop an Intrusion Detection System (IDS)
that specifically counters the security challenges of industrial networks. This ID uses
a new and different approach and perform all its functions per the industrial
standards and practices of SCADA networks. In this project, our main contributions
are focused on:
 Design an Intrusion Detection System (IDS) specifically for the security of
critical infrastructure networks, which work using the approach of Honey
token based Encrypted Pointers to detect cyber-attacks.
 Derive a new strategy for intrusion detection which will improve the overall
security of critical infrastructure network particularly focusing on the security
of field area (RTU, PLC etc.) by detecting attacks more efficiently and
enhance the real-time detection capability. Introduce such approach that all
the systems under the working domain of critical infrastructure network will
be divided into four different pools, the division is based on the computational
power and vulnerability level of each individual system. Different pools are
provided with different levels of security but entire network is under the
umbrella of unified security provided by a single network based IDS.
 Develop a mechanism for intrusion detection that will use AES encryption
schemes, honey tokens and pointers for achieving better security against
attacks and thus provides us with the ability to respond fast to the adversarial
activities and get better understanding of the attacker’s behavior.
 Provide a scalable solution that can be implemented on the network of any
number of remote computational nodes.
1.4 Working of Intrusion Detection Systems
Intrusion Detection System (IDS) is a system that is used to identify and detect
malicious activities in the network. These types of systems emerged in the arena of
network security when this need was felt that all these advancements in network
technology bring some serious cyber threats with them and to successfully run the
operations of all these networks we must have some sort of security system which is
reliable and flexible. All computer systems and networks have vulnerabilities in
them and it is almost impossible to build a perfect computer system or a perfect
network that is free of all errors and vulnerabilities. So, there is no question of

9
modern network without any type of network security equipment e: g- firewall, IDS
etc. The main goal of intrusion detection system is to detect attempted network
breaches and in some cases, it is looking for open vulnerabilities that could result in
a potential breach of a network. If we study IDS at a very macroscopic level, we
came to know that it just acts as a detector that process information which is coming
from a client’s network. This detector can also send probes that are used to request
audit data from the Information system (network). Intrusion Detection Systems
commonly uses three kinds of information:
1. Long Term Information.
2. Configuration Information.
3. Audit Information.
Long term information is related to the mechanisms and techniques used for
intrusion detection, whereas configuration information is about the currents state of
the system and audit information describes the sequence of events happening on the
connected network or information system. The generic type IDS are shown in Figure
3.1. The function of detector is to filter the information coming from the information
system and eliminate all the unneeded information from audit trails and then decide
about the possible intrusion. The countermeasure unit takes preventive actions in
case of any possible intrusion and tries to save the network from any attempted
security breach.
Figure 3.1: Generic Intrusion Detection System
In Figure 3.1 the basic role of detector is to filter the useless information coming
from audit trails. Based on this crucial information decision is then taken about the
event (possible intrusion) and then preventive action is taken by the counter measure

10
component of Intrusion Detection System (IDS). Based on operational mechanisms
the Intrusion Detection Systems (IDS) are basically divided in two main categories
1. Passive Intrusion Detection Systems
2. Active Intrusion Detection Systems
1.5 Types of Intrusion Detection Systems
There are two main types of IDS that are used by the industry since last many years.
Even though the technique and the target differ but the basic purpose of both types
of systems is to provide security by performing detection functions. For several
years, there has been a debate that which of the two systems possesses a better
detection strategy. In the following the basic principles of these two types are
discussed. The two types of IDS are:
1. Network Intrusion Detection Systems (NIDS)
2. Host Intrusion Detection Systems (HIDS)
1.6 Network Intrusion Detection Systems (NIDS)
Network Intrusion Detection Systems (NIDS) are placed at critical and strategic
places in the network, these systems monitor the network for Internal as well external
threats. It checks the entire traffic of the network for any possible cyber-attacks.
When the attack is detected or any abnormal traffic behaviors are noticed, an alert
message is sent to the administrator. As it is clear by its name (NIDS) that these
intrusion detection systems are always deployed in a subnet where most probably
firewall is placed and network administrator keep a strong check on who is trying to
break the security policy of firewall and trying to detect an inside attacker. As shown
in Figure 3.2, there are two different companies and each company’s network is
connected to the internet. The network of one company is protected by firewall as
well as Intrusion Detection System (IDS) which is placed at the gateway of the
network whereas the network of second company is just protected by network
intrusion detection system placed at the gateway. Figure 3.2 gives a clear idea about
the importance of placement of Network Intrusion Detection Systems (NIDS) in the
network.

11
Figure 3.2: Network Intrusion Detection System
1.7 Host Intrusion Detection Systems (HIDS)
This type of intrusion detection system is designed for the security of single host
(machine) on the network. Host Intrusion Detection System (HIDS) detect all
packets that are coming out of the device and those going into the device and
continuously monitor for malicious activity. Once it found some type of intrusion it
will alert the administrator or the user of that machine. HIDS take the snapshot of
all the system files and compare them with the previous snapshot, if files are missing,
deleted or edited, HIDS will raise an alarm and go for further investigations. HIDS
is mostly installed on mission critical machines. The most common example of
HIDS is the anti-virus software installed on our daily use
computers.
1.8 Techniques of Intrusion Detection
The detection techniques used by IDS are as follows:
1. Signature based Intrusion Detection Technique.
2. Anomaly based Intrusion Detection Technique.
1.9 Signature based Intrusion Detection Technique
Intrusion Detection System (IDS) that uses this approach of signature based
detection scan all the packet on the network and compare them against the database
of signatures. For understanding we can think of signature as a unique digital thumb
prints, every digital signature is different from other and all the signatures in the

12
database are the attributes from known malicious cyber threats. IDS compare the
packets with all the signatures available in database and if it matches at any point of
time, that event is considered as an intrusion by the intrusion detection system.
Almost all anti-virus programs use this signature based intrusion detection approach.
Using this approach system will detect all the known attacks but at the same time it
completely misses all unknown signatures (zero day attacks). In Figure 3.3, we have
a complete basic model of a signature based Intrusion Detection System (IDS).
Packets are matched with malicious signatures and alert administrator in case of
matching.
Figure 3.3: Signature based Intrusion Detection System
Chapter 2
2.1 Designing IDS using Honey Token (HT) based Encrypted Pointers
for Critical Infrastructure Networks
Our approach towards the designing of Intrusion Detection System (IDS) is novel
and simple, we use honey token based encrypted pointers for the detection of
network attacks on critical infrastructure network. We embed these honey tokens
inside the transmission frame and an encrypted pointer keeps record for locations of
all these honeytokens. This encrypted pointer is sent to the destination within the
same transmission frame where honey token packets were embedded earlier. At the
receiver side, we extract all the honey tokens from the frame with the help of
encrypted pointer and compare them with the database of honey tokens already
present at every Remote Terminal Unit (RTU) for verification of changes made in
it. Critical infrastructure is the term mostly used for those national assets which are
very important for operational stability of economy and society, and without them

13
there is no concept of running nation state successfully in 21st
century. In today’s
modern times all these critical infrastructure operations run using smart and
sophisticated networks called critical infrastructure networks. There are
large numbers of these critical infrastructures but few most common are electric
power grid, oil and gas sector, nuclear power plants, water supply systems, air traffic
control systems, water treatment plants, railway traffic systems, industrial
manufacturing etc. Critical infrastructure networks commonly have command and
control system for smooth and efficient running of their operations. Supervisory
Control and Data Acquisition (SCADA) is mostly used for these purposes. It collects
data from all systems using wide range of sensors and then issues commands from
its Master Terminal Station (MTU) for operating industrial control systems. The
common topology of critical infrastructure
sensor network is shown in Figure 2.1.
Figure 2.1 The common topology of critical infrastructure sensor network
SCADA (MTU) system relates to a network of nodes commonly known as
Remote Terminal Unit (RTU) and sensors relate to these RTU. The IDS shown in
Figure 4.1 is Network based Intrusion Detection System (NIDS) and thus serves the
entire critical infrastructure sensor network with its security services. RTU may be
a PLC and it collects data from all the sources which include sensors, actuators,
motors, pressure valves and centrifuges etc. RTU then send this data back to MTU
for monitoring tasks. MTU send commands to RTU for controlling these assets

14
(motors, sensors and actuators). RTU receives these set of commands from MTU
and direct them towards their target devices.
2.2 DNP3 Synthetic Traffic Generator
Distributed Network Protocol-3 (DNP3) is a set of communications protocols
used between components in process automation systems. It is the backbone protocol
for SCADA systems and used by almost all the vendors as their primary protocol for
SCADA command and control software. Our adopted approach for solving the
problem is very simple, we generate DNP3 synthetic traffic, and we designed DNP3
traffic generator capable of producing millions of DNP3 packets. DNP-3 is an open
protocol which means that the complete technical documentation associated with
this protocol is available to the public. The core elements that define DNP3 protocol
are datalink layer protocol description, application layer protocol description and
data object library. In the start of the packet we have data link layer information that
includes start bytes, length bytes, control bytes, destination address, source address
and CRC (Cyclic Redundancy Check) bytes for data link layer, and after this we
have application layer headers. In the end, we have data area where we have actual
data (payload) and object header which carries control information associated with
this data area. Object header contains the fields of function control bytes, internal
information bytes, object type bytes, variation bytes, qualifier bytes, range bytes,
data object bytes, CRC bytes. DNP3 is a robust and flexible protocol as compared
to other conventional communication protocols.
DNP3 was originally designed based on a three-layer model which includes
application layer, datalink layer and physical layer. The application layer provides
objects for most generic data formats, the datalink layer provides methods for
retrieving data and physical layer defines most common RS-232, RS-485 or radio
interfaces. DNP3 uses 3-layer Enhanced Performance Architecture (EPA) stack for
its specifications. The 3 layer EPA stack provides simpler way of data
communication over the industrial control systems where there is no need of many
features that are required on IP networks for communication. Figure 2.3 shows the
comparison of Enhanced Performance Architecture (EPA) stack with 7-layer model.

15
Figure 2.3: Comparison of EPA Stack with 7 Layer Reference Model [63]
Although DNP3 was designed as reliable protocol but it was not designed as a secure
protocol. It is vulnerable against attacks which are designed to disrupt control system
operations to disable critical infrastructure networks. So, enhanced level of security
must be required in the form of IDS to protect such important assets as critical
infrastructure networks. Honey tokens used by IDS are normal DNP3 packets
generated using the same synthetic traffic generator. These honey token packets are
similar as compared to real DNP3 packet and it is impossible for a human being to
differentiate between real token and honey token.

16
2.3 Honey Token based Encrypted Pointers
Our approach for IDS used a technique called Honey Token based Encrypted
Pointers. Honey tokens are artificial digital data items planted deliberately into a
genuine system resource to detect unauthorized attempts to use or disrupt original
information. The honey tokens are characterized by properties which make them
appear as genuine data items. Honey tokens used by our IDS are normal DNP3
packets planted deliberately into a transmission sequence to detect cyber-attack. We
generate these honey tokens once at the start of simulation and make their encrypted
database. All the Remote Terminal Units (RTUs) in the critical infrastructure
network hold a copy of this encrypted honey token database which they later use for
comparison and correlation of honey tokens at RTU for the detection of any changes
made in the sequence by the attacker during transmission from Master Terminal Unit
(MTU) to RTU. The transmission sequence consists of a total of number of packets.
In the first step the IDS will use the length of packets as process length. In other
words, IDS will embed honey tokens in the real traffic at random locations and make
the sequence of length. This sequence of length N-1 is known as process length of
the sequence and is shown in Figure 2.4.
Figure 2.4: Process Length
The last packet contains the locations of all these honey tokens which were
embedded earlier in the process length by the IDS. This last packet is known as the
pointer and after encryption it becomes an Encrypted Pointer (EP). The pointer itself
is also a normal DNP3 packet and all these locations of honey tokens are stored
inside the payload area of this packet, where all empty space in the payload area (if
any) are filled using zero padding technique. It is shown in Figure 4.5 that after
inserting the locations of all the honey tokens inside the payload area of packet,
empty spaces are filled using zero padding.
Figure 2.5: Pointer Structure

17
The entire formation process is shown below in Figure 2.6 where single sequence
has N packets and process length has (N-1) packets, the last packet of the sequence
is the pointer that contains the locations of honey tokens.
Figure 2.6: Formation Process
2.4 System Design
We adopted a modular approach in the system design and IDS consist of two
separate modules working at separate physical locations within the critical
infrastructure network. The two modules of IDS are:
1. IDS Primary Module.
2. IDS Secondary Module.
IDS primary module work in collaboration with MTU and IDS secondary module
work in collaboration with RTU. We divide critical infrastructure sensor network
into four different categories or pools as shown in Figure 2.7. This division of nodes
among four different pools is based on the computational power and level of
vulnerability of that system (node) which is working in critical infrastructure sensor
network.

18
Figure 2.7: Segmentation of Pools in Critical Infrastructure Network
Pool-A contains those systems having greater computational power and higher
vulnerability levels, it uses 4 honey tokens per frame and use encryption scheme of
AES- 256 e.g. - Data Centers etc. whereas Pool-D contain those systems having least
computational power, it uses one honey token per frame and use encryption scheme
of AES-128 e.g. - Tsunami warning system for open ocean etc. Other two Pools (B
and C) contain systems that fall between above defined categories, Pool-B uses 3
honey tokens per frame and use encryption scheme of AES-192 e.g. - Oil rigs and
Pool-C uses 2 honey tokens per frame and use encryption scheme of AES-192 e.g.-
Remote operating station etc. All the encryption schemes assigned to the different
pools are basically used for two basic tasks, at first used for encryption of pointer
and secondly encryption of honey token database (present at RTU’s) for that pool.
2.5 Intrusion Detection System Primary Module
IDS primary module works in collaboration with MTU. It starts with embedding
honeytokens inside the normal DNP3 traffic frame at random locations. First, the
transmission module in Figure 4.8 performs a check that the current frame is directed
towards which RTU in the critical infrastructure network. Then IDS check the pool
of that specific RTU, when the pool is confirmed the IDS perform its operation of

19
embedding honeytokens inside the transmission frame. For example, if the current
frame belongs to pool-A the IDS embed four honeytokens at the random positions
inside the frame. All the locations (addresses) of these four honeytokens are then
placed inside the last packet which is known as the pointer of the frame and empty
spaces are filled with zero padding inside this pointer. IDS then encrypt this pointer
using AES-256 encryption scheme so the only thing which is encrypted inside the
frame is the pointer which hold the locations of all those honeytokens. Encrypted
pointer is then attached to the frame and this frame is now ready for transmission
over the physical channel which may be wired or wireless. In case if the destination
RTU belongs to Pool-B, the IDS primary module embeds 3 honeytokens inside
frame and stores their locations in the pointer. AES-192 is used for the encryption
of the pointer if target RTU belongs to Pool-B. IDS primary module uses 2
honeytokens per frame if the target RTU belongs to Pool-C and AES-192 encryption
scheme is used for Pool-C pointer. In case of Pool-A the IDS use only one
honeytoken per frame and stores its location inside the pointer, all empty spaces are
filled with zero padding and AES-128 is used for pointer encryption.
Figure 2.8: Flow Chart of IDS Primary Module at Master Terminal Unit
(MTU)

20
2.6 Intrusion Detection System Secondary Module
At the receiver side of RTU the IDS secondary module receives the
transmission frame and extract Encrypted Pointer (EP) out of the frame. If the
local RTU falls in the Pool-A of critical infrastructure network the EP is
decrypted using AES-256 encryption schemes and after the successful
decryption of pointer the IDS secondary module opens the pointer and
removes all the zero padding inside the pointer. IDS then extract honeytokens
from the transmission frame using the locations available inside pointer. In
case of Pool-B the EP is decrypted using AES-192 encryption scheme and
zero padding is removed for successful recovery of honeytoken locations at
RTU side. Same process is used for other two pools but the only difference is
that Pool-C is decrypted using AES-192 and Pool-D is decrypted using AES-
128 encryption schemes. After the successful recovery of honeytokens at the
RTU side, the IDS secondary module performs the process of scanning as
shown in Figure 4.9. HT Database contains the entire database of honeytokens
which IDS is using for detection mechanism. Moreover, this HT Database is
also encrypted using AES-256 for Pool-A, AES-192 for Pool-B and Pool-C
and AES- 128 for Pool-D. IDS secondary module perform the operation of
scanning in which it compares all the honeytokens bit by bit with their copies
present in HT Database. The
honeytoken scanning process
detects any tampering with the
honeytokens during the entire
process of transmission from
MTU to RTU. If any
tampering is detected the IDS
immediately raise the alarm
for networks administrator and
consider this event as a
possible intrusion otherwise if
all the honeytokens are
matched with their
counterparts in HT Database
and there is no mismatch in the
bits, the IDS consider this
event as normal and continue
its operations.
Figure 2.9: Flow Chart of IDS Secondary Module at Remote Terminal Unit
(RTU)

21
Chapter 3
Results and Discussions
3.1 DNP3 Synthetic Traffic Generator
Figure 3.1 shows the output of DNP3 synthetic traffic generator which is designed
in MATLAB, this traffic generator can generate millions of packets of DNP3
protocol (synthetic traffic). The start two bytes of every DNP3 packet is always 0564
(defined standard for DNP3 packet) is clearly highlighted. In the Figure 3.1 there are
total 34 packets of DNP3 protocol out of which 10 packets are honeytokens. It is
almost impossible to distinguish between real packet and honeytoken packet.
Figure 3.1: DNP3 synthetic traffic generator output

22
3.2 Alarm Analysis of Intrusion Detection System
We are using the test network of 64 nodes, each pool contains 16 nodes. Here we are
assuming about the length of the attack vector. From the detailed study of Stuxnet
and other related attacks the malicious attacks that are used to disrupt the operations
of critical infrastructure networks comprise of complex and lengthy codes and
commands. These attacks consist of hundreds and sometimes thousands of frames,
but here in our simulation we are if our attack signature which is generated by
MATLAB must be greater than half of the length of the frame. All the results are
average values. Secondly, the reason why we are not using False Positive (FP) and
True Negative (TN) in our alarm analysis is due to the nature of DNP3 protocol
itself. DNP3 is not a general protocol, it is different from SMTP, FTP, HTTP etc. It
is intended for SCADA applications and is designed as a reliable protocol but not as
a secure protocol. It uses CRC (Cyclic Redundancy Check) both for header and
payload, so it discards all corrupted packets (corrupted because of channel noise and
bit errors) and requests for the retransmission of corrupted packets. For our IDS, it
will only happen when honey tokens are corrupted because of channel noise and
mismatches with HT database at RTU. This scenario is not possible because
corrupted frames are discarded by DNP3 protocol. So, FP is not included in our
alarm analysis since honey tokens discarded by RTU due to channel noise are
retransmitted by MTU. These SCADA networks run (24x7) over the period of years
and their operations are not affected by any disruption (bit errors and channel noise
etc.) and this is possible only because of their robust design giving extreme reliability
to these critical infrastructure networks. In Figure 3.6 shown result is the output of
system alarms. ―True Positive‖ means when attack occurs and system successfully
detects that attack and ―False Negative‖ means when attack occurs but system fails
to detect that attack. On y-axis, we have the scale of alarm percentage and on x-axis
we have four different pools [A-B-C-D]. Maximum security is given to Pool-A
because these systems possess high computational power therefore it has very small
percentage of false negative, and from the results in Figure 3.2 it is shown that on
average false negative alarms are less than 2% for Pool-A.

23
Figure 3.2: IDS Performance (Alarm Analysis)
On the other hand, least amount of security is provided to pool-D because these
systems are constrained in computation power and other valuable resources, so the
false negative percentage is almost 12% for pool-D. From graphical results in Figure
3.2 which are also tabulated in Table 3.1 shows different pools with their True
Positive (TP) and False Negative (FN) alarm percentages for the attack vector of
70% the length of the frame, all these results are average values. Encryption schemes
are also listed along with different pools in Table 3.1.

24
Table 3.1: IDS Alarm Analysis for 70% attack vector
From Figure 3.2 and Table 3.1 Pool-A has 98% TP alarms and 2% FN alarms, it
uses 4HT/frame with AES-256 encryption scheme. Pool-B has 97% TP alarms and
3% FN alarms, it uses 3HT/frame with AES-192 encryption scheme, Pool-C has
93% TP alarms and 7% FN alarms, it uses 2HT/frame with AES-192 encryption
scheme and finally Pool-D has 88% TP alarms and 12% FN alarms, it uses only one
HT/frame with AES-128 encryption scheme.
Table 3.2: IDS Alarm Analysis Comparison Table

25
3.4 Network Penetration Testing
To test and verify our designed Intrusion Detection System (IDS) we use Network
Penetration Testing (NPT). Alongside our IDS we place another conventional
signature based IDS which contain signatures for some known attacks for the
security of node critical infrastructure test network as shown in Figure 3.13.
Figure 3.13: Network Penetration Testing Scenario (64 Node Network)
Then using MATLAB, we generate hexadecimal attack signatures (zero day attacks)
and few known attack signatures (hexadecimal signatures) which are already present
in the database of conventional IDS.
Finally, we launch all these attacks on
test network. Known attacks are
immediately stopped by conventional
IDS but all zero-day attack signatures
successfully penetrated in the 64-node
test network. In response, our IDS
successfully detected these pen
scanning process result is shown in
Figure 3.14, where cyber-attacks are
detected by the IDS on node 22, 24 and
penetrated attacks in 64 node network.
Snapshot of IDS
Figure 3.14: Intrusion Detection System scanning process

26
Chapter 4
Introduction to Intrusion Prevention System (IPS)
Virtual honeypot technology is the best active prevention technology among all
honeypot technologies. By using the original operating system and virtual
technology, the honeypot lures attackers in a pre-arranged manner, analyzes and
audits various attacking behavior, tracks the attack source, obtains evidence, and
finds effective solutions. Thereafter, legal means can be used to investigate the
responsibility of the attackers and technology and management tools can be
employed to improve actual system protection. A honeypot system can detect attack
behavior and redirect such attacks to a strictly controlled environment to protect the
practical running system. This system collects intrusion information to observe and
record the behavior of the attacker and examine the level, purpose, tools, and
intrusion methods of the attack such that evidence can be obtained and possible legal
actions can be taken.
4.1 Honeypot definition and development
A honeypot system is designed to attract hackers. Thus, after an intrusion, network
administrators and security specialists can determine how the attacker succeeded,
prevent subsequent attacks, and identify security gaps. In addition to identifying the
various tools used by hackers, honeypot technology can also identify the social
networks of intruders by determining the relationships among hackers.
Figure 4.1 Honeypot principle diagram

27
Honeypot technology is a security resource whose value lies in being scanned,
attacked, and captured. This characteristic indicates that honeypot technology does
not have other actual effects. Therefore, all network traffic that flows into or out of
the honeypot may prefigure being scanned, attacked, and captured. The core value
of this technology lies in monitoring, detecting, and analyzing intrusive activities.
The most popular honeypot tools are the Deception Tool Kit and Honeyd. Based on
traditional honeypot and honeynet technologies, active honeypot, honeyfarm,
honeyapp, honeyclient, and other new concepts have been proposed. Such
applications and concepts have also opened new research directions.
4.2 Existing types of honeypot
If we define the level of honeypot per the level of interactivity of its attackers and
allow a complicated degree of interaction between the operating system and
intruders, then honeypot systems can be divided into low-interaction honeypot
systems, middle-interaction honeypot systems, and high interaction honeypot
systems.
4.3 Low-interaction honeypot system
A low-interaction honeypot provides only specific analog services. In their basic
form, these services can be conducted by monitoring a specific port. Low-interaction
honeypot systems do not provide intruders with the actual operating system for
remote login. Thus, the risk is low. However, the function of this honeypot is highly
passive, like a unidirectional connection wherein limited information can be
collected. With the information flowing from outside to the machine and without
any response message to be sent, this type of honeypot fails to capture the
communication process behind complicated protocols. Low-interaction honeypot
systems have the following characteristics:
 Analog services and operating system
 Can capture only a small amount of information
 Easy to arrange, thus minimizing risk.
4.4 Middle-interaction honeypot system
A middle-interaction honeypot system does not provide the actual operating system
but provides intruders with a complicated decoy process. This type of honeypot
system imitates a specific service, thus causing intruders to believe that they are
attacking the real operating system. Such a mechanism enables the system to collect
high amounts of data. However, this mechanism also increases the risk of intrusion.
Therefore, middle-interaction honeypot systems should ensure that new security
holes could not be generated in the process of imitating the services and holes. By
using high-level interaction, honeypot technology can endure sophisticated attacks

28
while recording and analyzing such attacks. Under environments with increasing
levels of interaction, a honeypot system should be deployed in a manner wherein all
analog services are as safe as possible.
4.5 High-interaction honeypot system
Most high-interaction honeypot systems are placed in a controlled environment,
such as behind a firewall. A hacker is allowed by the firewall to attack the honeypot
but is not allowed to launch new attacks. This structure is difficult to deploy and
maintain because it does not let hackers know that they are being monitored. The
maintenance of a high interaction honeypot is time consuming. Thus, the firewall
capacity and IDS characteristic database should be frequently updated to enable
continuous monitoring. Any error in the system may allow a hacker to control the
full operating system, attack other systems, or intercept messages in the application
system [14]. However, if a high-interaction honeypot system can be maintained
properly, it can allow security specialists to obtain information on hackers that other
types of honeypots cannot obtain. The cost of deploying a high-interaction honeypot
system is extremely high because it requires the continuous monitoring of a system
administrator. An uncontrollable honeypot is meaningless for any organization and
may even pose high network security risks. A high-interaction honeypot system has
the following characteristics:
 Provides the actual operating system and services instead of analog data
 Captures rich information
 Complicated deployment and high security risks
4.6 Mixed-interaction honeypot system
This study aims to establish a mixed honeypot system to monitor various types of
data. The honeypot principle is adopted in data collection to judge if the data is
normal and to prevent attacks. The system maintains a daily record in the application
and virtual system. Furthermore, the system records the internal and exterior
gateways of a virtual control server and a virtual gateway on Debian. These data can
provide detailed tracking and attaching capacity. In turn, the data provided by the
exterior gateway can monitor the transmission of packets to the traffic attacking the
virtual gateway. The relative attacking data can be found in the backup data of the
virtual gateway, which allows security specialists to identify the attack type. The
mixed honeypot system discussed in this paper is a type of application honeypot.
Apache Web is the server used for honeypot testing, and Mozilla Firefox is used to
create log records. We run Apache and server deployment from the Apache Web
server and the Web server. When Debian detects any abnormal traffic to the
Honeypot Apache Web Server, data analysis is conducted. If traffic is suspicious but
legal in practice, then data are sent to the honeypot for treatment. If the system is

29
attacked and modified during operation, traffic will be cut off, thus causing data to
return to their source. The outer interface of the virtual gateway 192.168.10.6 is
connected to an external network. At the same time, the gateway has an internal
interface that provides the DNS server in the Web server and decoy server. The DNS
server is a resolution server that can resolve the overall domain name and forward
any request to the external gateway for treatment.
Figure 4.2 Mixed interactive honeypot system
Two interfaces for the decoy server can be defined as 10.0.2.3 and 10.0.3.3. Interface
10.0.3.0 can be defined as the subnet of the interfaces. The second interface is
connected to an application port in the gateway, thereby connecting the virtual Web
server, database, and specific server port link. If the application gateway detects a
data request that requires a direct connection to a specific network, any application
server, virtual Web server, or common user will produce data feedback that is like
receiving a NAT attack. If the virtual server capacity used in the large-scale network
decreases, the application of the small-scale network increases the cost.
Virtualization prompts the hardware to deploy originally such that the system
becomes a virtual machine. This condition significantly reduces the construction

30
cost of the network. The system we have constructed can help reduce false
information and enhance network stability and security. This system is designed as
an application level of the honeypot to enable the independent reestablishment of the
monitoring mechanism. In practice, if each application should be monitored, the
system must customize the required applications by using a large quantity of
customized codes. Therefore, we mainly monitor the attacks to Apache in a virtual
environment.
4.7 System simulation
In a lab environment, we use Honeyd. It can create virtual hosts, the hosts can be
configured to provide any services, the system is also compatible with it, that makes
it look like a real system running. In a local area network emulation, Honeyd enables
a single host with lots of IP (as many as 65,536). Network topologies are part of the
core configuration file:
create router
set router personality "Cisco 7206
running IOS 11.1(24)"
set router default tcp action reset
add router tcp port 23
"script/router-telnet.pl"
bind 10.0.2.3 router
bind 10.0.1.20 windows
Honeyd honeypot and log file records all the virtual host connection information,
including timestamps, protocol type, source address, destination address, port
number, operating system type and other information. Using the VI command view
is shown in Figure 4.3 Honeyd log:

31
Figure 4.3 Control system hardware structure diagram
In the above log, the attacking host to 11.64., the attacking host is shown in the red
box with the honeypot virtual hosts to establish a connection. Including TELNET,
FTP, HTTP. By querying this information, attacker intrusion evidence can be
collected, and because these virtual hosts are honeypots come out, it will not pose a
threat to the system.
Conclusion Future Work
In this project, we design an Intrusion Detection System (IDS) & Intrusion
Prevention System (IPS) that works on a technique known as ―Honey token based
Encrypted Pointers and Honey pot technology against sophisticated cyber threats
that target industrial networks. Honeypot technology has matured after a leap in its
development. This technology aims to lure hackers to a decoy system, thus delaying
the attack and providing network security specialists a window of opportunity to
prevent the threat. The technology allows system administrators to know the launch
address, verify if the security strategy is effective, and determine if the defense line
is solid. Existing networks are not always safe. IDS, firewall, encryption, and other
technologies have certain defects. Network security can be improved when such
technologies are combined with the honeypot system. We believe that honeypot
technology will play a crucial role in global network security. This ID is specifically
designed for the security of critical infrastructure sensor networks. We analyzed the
performance of IDS model on security and stability issues. The proposed IDS have
the capability of detecting SCADA based cyber-attacks and the use of encryption in
IDS make it more difficult for the attacker to launch a successful attack on critical
infrastructure networks. This type of IDS can also assist conventional signature
based IDS for improving their efficiency in detection of new attacks. Intrusion

32
detection is still a long way from being mature, there is a huge room for
improvements and modification. The signature based detection is reliable but it
completely misses the zero day attacks, while on the other hand anomaly detection
detects some zero day attacks but it produces large number of false alarm thus
reducing the overall efficiency of IDS. Cyber security experts believe that in future
we must have to introduce new methods and mechanisms for intrusion detection and
existing mechanisms will be discarded. Protocol analysis mechanism has a huge
potential in it where protocols are analyzed in depth details and used for intrusion
detection. Target detection method is also very useful because in this method
cryptographic algorithms are used to detect unauthorized changes in files. Rule
based intrusion detection should also be used along with honeypot technologies for
improving the detection efficiency. To enhance the process of intrusion detection
one of the most important tool is honeypots. The core value of this valuable tool not
lies in its use but in its abuse. It detects the intrusion far better than all the other
mechanisms if deployed smartly. Intrusion Prevention Systems (IPS) are becoming
more popular in the security industry because they not only detect the intrusion but
also take some preventive actions and defend the network by stopping the intruders.
So, integration of honeytoken with other key technologies will enhance our existing
IPS and the use of advance encryption methods provide us with more flexible
options against the intruders. Our proposed IDS are a scalable solution and thus
feasible for networks with large number of nodes. Management becomes easy when
you divide system nodes in different pools and it is easy to trap the attacker when
network is divided among different segments. In this research work we use honey
tokens for intrusion detection and found them useful against cyber-attacks on critical
infrastructure networks. Our research work is focused on command injection attacks
that disrupt the operations of critical infrastructure networks. The only limitation of
designed IDS is the length of attack vector, if the attack vector is too small to evade
the tampering of honey token the probability of detection is low. There is a huge
hidden potential in the use of honeypots, honey nets and honey tokens for intrusion
detection and there is a lot more to be done by future researchers and engineers in
the field of intrusion detection.

33
Reference
[1] M. Chemanol, L. Durante, and A. Valenzano, "Review of Security Issues in
Industrial Networks," IEEE Transactions on Industrial Informatics, vol. 9, no. 1,
pp. 277 - 293, 2013.
[2] M. Merabti, K. Michael, and W. Hurst. "Critical infrastructure protection: A
21st
century challenge," International Conference on Communications and
Information Technology (ICCIT), pp. 1 - 6, 2011.
[3] J. McHugh, "Intrusion and intrusion detection," International Journal of
Information Security, vol. 1, no. 1, pp. 14 – 35, 2001.
[4] B. Zhu, J. Anthony, and S. Shankar, "A taxonomy of cyber-attacks on SCADA
systems," 4th International Conference on Cyber, Physical and Social
Computing, pp. 380 - 388, 2011.
[5] J. P. Disso, J. Kevin, and B. Steven, "A Plausible Solution to SCADA Security
Honeypot Systems," In Eighth International Conference on Broadband and
Wireless Computing, Communication and Applications (BWCCA), pp. 443 - 448,
2013.
[6] P. Jain, and S. Anjali, "A hybrid honeyfarm based technique for defense against
worm attacks," World Congress on Information and Communication
Technologies (WICT), pp. 1084 - 1089, 2011.
[7] I. Kuwatly, S. Malek, A. Zaid, and A. Hassan, "A dynamic honeypot design for
intrusion detection," In International Conference on Pervasive Services (ICPS),
pp. 95 -104, 2004.
[8] Y. Yang, and M. Jia, "Design and implementation of distributed intrusion
detection system based on honeypot," In International Conference on Computer
Engineering and Technology (ICCET), vol. 6, pp. 260, 2010.
[9] R. Muraleedharan, and A. O. Lisa, "An intrusion detection framework for
sensor
networks using honeypot and Swarm Intelligence," In 6th Annual International
Mobile and Ubiquitous Systems: Networking & Services, pp. 1 - 2, 2009.
[10] Song LI, Qian Zou, Wei Huang, “A New Type of Intrusion Prevention
System” Guiyang University” Guiyang, China

Intrusion detection and prevention system for network using Honey pots and Honey token method

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Intrusion detection and prevention system for network using Honey pots and Honey token method

Similar to Intrusion detection and prevention system for network using Honey pots and Honey token method (20)

Recently uploaded

Recently uploaded (20)

Intrusion detection and prevention system for network using Honey pots and Honey token method