Extending Imunes Simulator with Support for Control System Honeynets

U ovom radu opisan je postupak korištenja Imunes i Conpot alata kako bi se simulirala mreža Conpot mamaca definirana Imunes topologijom. U sklopu rada su virtualni čvorovi Imunes alata izmijenjeni su kako bi se na njima mogli pokrenuti Conpot mamci. Na virtualne čvorove su također dodani i OSSEC i Postfix alati kako bi se pojednostavio proces nadgledanja virtualne mreže. U radu je potom opisan postupak spajanja virtualne mreže s vanjskom mrežom kako bi joj se moglo pristupiti s interneta. Za pokretanje Imunes mreže i alata na virtualnim čvorovima korištena je skripta kojom se podešava i prosljeđivanje pristupa između virtualne mreže i interneta. Uz to je definirana i skripta koja služi za dohvaćanje zapisa pristupa Conpot mamcima. U slučaju pristupa mamcima korištenjem OSSEC i Postfix alata korisnik će biti obaviješten preko zadane e-mail adrese da se dogodio pristup mamcu. U sklopu rada je proveden eksperiment pokretanja jedne simulirane mreže. Ispravnost simulirane mreže prvo je ispitana korištenjem PLCScan alata za skeniranje upravljačkih sklopova, a potom je mreža postavljena da radi 2 dana u toku kojih su zabilježena 2 pristupa mamcima mreže.In this paper the process of modifying Imunes and Conpot tools so that they can be used to simulate a network of Conpot honeypots is described. First part of the paper describes how the Imunes virtual nodes have been modified so that Conpot can be installed on them. OSSEC and Postfix were also installed on the nodes in order to make monitoring the virtual network simpler. After that, it is explained how the virtual network is connected to the external network so that it can be accessed from the internet. The process of initializing the Imunes network and starting the necessary services on the nodes was done with a script that was also used to configure data forwarding between the virtual network and the internet. A script used to collect Conpot logs from the virtual nodes was also defined in this paper. OSSEC and Postfix tools were used on the virtual nodes to send e-mail notifications to the user when Conpot honeypots would be accessed. The final part of the paper describes the results of running a virtual network for 2 days. Once the network was initialized the Conpot honeypots were tested with the PLCScan tool to check if they are working properly and then left to run. During the experiment, two attempts of scanning the honeypots were recorded