Towards a grid-wide, high-fidelity electrical substation honeynet

After a number of real-world cyber incidents targeting power grid systems in the recent years, early detection of such cyber attacks and analysis of their attack vectors are in urgent need. One of the technologies that serve such purposes is honeypot. Although the concept of honeypot is not new, its use in a smart grid context is still nascent. Moreover, honeynet, a network of honeypots, is not yet systematically explored in a smart grid context. In this paper, we design and implement a smart grid honeynet system that can emulate an entire smart grid field communication infrastructure including multiple networked substations by taking advantage of virtualization technologies. Our honeynet system is tied to a simulated power grid to provide consistent and realistic view to deceive attackers for a prolonged period. Especially, our system can emulate high-fidelity power grid behavior when a sophisticated attacker launches grid-wide probing at his preparation phase, by changing settings in one substation and examining the expected changes in another. Finally, we present our proof-of-concept implementation and preliminary evaluation of its realism and scalability.