@conference{9850329,

title = {Protecting IEC 60870-5-104 ICS/SCADA Systems with Honeypots},

author = {Elisavet Grigoriou and Athanasios Liatifis and Panagiotis Radoglou Grammatikis and Thomas Lagkas and Ioannis Moscholios and Evangelos Markakis and Panagiotis Sarigiannidis},

url = {https://www.researchgate.net/publication/362744045_Protecting_IEC_60870-5-104_ICSSCADA_Systems_with_Honeypots},

doi = {10.1109/CSR54599.2022.9850329},

isbn = {978-1-6654-9952-1},

year  = {2022},

date = {2022-07-27},

booktitle = {2022 IEEE International Conference on Cyber Security and Resilience (CSR)},

pages = {345-350},

abstract = {Both signature-based and anomaly-based Intrusion Detection and Prevention System (IDPS) have already demonstrated their efficiency towards recognising and mitigating various intrusions. However, the first category cannot detect zero-day attacks, while the second one lacks the presence of appropriate datasets. Therefore, the presence of additional cybersecurity mechanisms is necessary, especially in the area of the Industrial Internet of Things (IIoT), including critical infrastructures, such as the smart electrical grid. Thus, honeypots are used to hide and protect critical assets. IEC 60870-5-104 (IEC104) is a widely used telemetry protocol in Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA). However, IEC104 lacks critical security features, such as encryption, integrity protection and authentication. This work presents the IEC104 honeypot, which is capable of hiding the actual IEC104 assets and detecting potential intrusions and anomalies. The experimental results demonstrate the effectiveness of our work.},

keywords = {Cybersecurity, Honeypots, ICS, SCADA},

pubstate = {published},

tppubtype = {conference}

}

@conference{9682162,

title = {Covert Distributed Training of Deep Federated Industrial Honeypots},

author = { Ilias Siniosoglou and Vasileios Argyriou and Thomas Lagkas and Apostolos Tsiakalos and Antonios Sarigiannidis and Panagiotis Sarigiannidis},

url = {https://www.researchgate.net/publication/358085083_Covert_Distributed_Training_of_Deep_Federated_Industrial_Honeypots},

doi = {10.1109/GCWkshps52748.2021.9682162},

isbn = {978-1-6654-2391-5},

year  = {2022},

date = {2022-01-24},

booktitle = {2021 IEEE Globecom Workshops (GC Wkshps)},

pages = {1-6},

abstract = {Since the introduction of automation technologies in the Industrial field and its subsequent scaling to horizontal and vertical extents, the need for interconnected industrial systems, supporting smart interoperability is ever higher. Due to this scaling, new and critical vulnerabilities have been created, notably in legacy systems, leaving Industrial infrastructures prone to cyber attacks, that can some times have catastrophic results. To tackle the need for extended security measures, this paper presents a Federated Industrial Honeypot that takes advantage of decentralized private Deep Training to produce models that accumulate and simulate real industrial devices. To enhance their camouflage, SCENT, a new custom and covert protocol is proposed, to fully immerse the Federated Honeypot to its industrial role, that handles the communication between the server and honeypot during the training, to hide any clues of operation of the honeypot other that its supposed objective to the eye of the attacker.},

keywords = {Autoencoder, Data Generation, Deep Learning, Honeypots, Industrial Control System, SCADA},

pubstate = {published},

tppubtype = {conference}

}

@conference{Siniosoglou2020,

title = {NeuralPot: An Industrial Honeypot Implementation Based On Deep Neural Networks},

author = { I. Siniosoglou and G. Efstathopoulos and D. Pliatsios and I.D. Moscholios and A. Sarigiannidis and G. Sakellari and G. Loukas and P. Sarigiannidis},

editor = { 2020 {IEEE} Symposium on Computers and Communications ({ISCC})},

url = {https://www.researchgate.net/publication/347267819_NeuralPot_An_Industrial_Honeypot_Implementation_Based_On_Deep_Neural_Networks},

doi = {10.1109/ISCC50000.2020.9219712},

year  = {2020},

date = {2020-07-01},

booktitle = {2020 IEEE Symposium on Computers and Communications (ISCC)},

journal = {Proceedings - IEEE Symposium on Computers and Communications},

publisher = {IEEE},

abstract = {Honeypots are powerful security tools, developed to shield commercial and industrial networks from malicious activity. Honeypots act as passive and interactive decoys in a network attracting malicious activity and securing the rest of the network entities. Since an increase in intrusions has been observed lately, more advanced security systems are necessary. In this paper a new method of adapting a honeypot system in a modern industrial network, employing the Modbus protocol, is introduced. In the presented NeuralPot honeypot, two distinct deep neural network implementations are utilized to adapt to network Modbus entities and clone them, actively confusing the intruders. The proposed deep neural networks and their generated data are then compared. © 2020 IEEE.},

keywords = {Autoencoder Network, Data Generation, GAN Network, Honeypots, Industrial Control System, SCADA},

pubstate = {published},

tppubtype = {conference}

}

@conference{Grammatikis2020450,

title = {Secure and private smart grid: The SPEAR architecture},

author = { P. Radoglou-Grammatikis and P. Sarigiannidis and E. Iturbe and E. Rios and A. Sarigiannidis and O. Nikolis and D. Ioannidis and V. Machamint and M. Tzifas and A. Giannakoulias and M. Angelopoulos and A. Papadopoulos and F. Ramos},

url = {https://www.researchgate.net/publication/343621502_Secure_and_Private_Smart_Grid_The_SPEAR_Architecture?_sg=ajSET8e8bb-KvKba1e9QHd7a7IFuKtI-72RhxDMcm-yozF1Q-5Jx4b8jAVrAhVncE1vtLBx2eVdgcx4},

doi = {10.1109/NetSoft48620.2020.9165420},

year  = {2020},

date = {2020-06-01},

booktitle = {2020 6th IEEE Conference on Network Softwarization (NetSoft)},

journal = {Proceedings of the 2020 IEEE Conference on Network Softwarization: Bridging the Gap Between AI and Network Softwarization, NetSoft 2020},

pages = {450-456},

publisher = {IEEE},

abstract = {Information and Communication Technology (ICT) is an integral part of Critical Infrastructures (CIs), bringing both significant pros and cons. Focusing our attention on the energy sector, ICT converts the conventional electrical grid into a new paradigm called Smart Grid (SG), providing crucial benefits such as pervasive control, better utilisation of the existing resources, self-healing, etc. However, in parallel, ICT increases the attack surface of this domain, generating new potential cyberthreats. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) architecture which constitutes an overall solution aiming at protecting SG, by enhancing situational awareness, detecting timely cyberattacks, collecting appropriate forensic evidence and providing an anonymous cybersecurity information-sharing mechanism. Operational characteristics and technical specifications details are analysed for each component, while also the communication interfaces among them are described in detail. © 2020 IEEE.},

keywords = {Anomaly Detection, Anonymity, Cybersecurity, Forensics, Honeypots, Intrusion detection, Privacy, Smart Grid},

pubstate = {published},

tppubtype = {conference}

}