HoneyCar: A Framework to Configure Honeypot Vulnerabilities on the Internet of Vehicles

The Internet of Vehicles (IoV), whereby interconnected vehicles that communicate with each other and with road infrastructure on a common network, has promising socio-economic benefits but also poses new cyber-physical threats. To protect these entities and learn about adversaries, data on attackers...

Full description

Saved in:
Bibliographic Details
Published in:IEEE access 2022, Vol.10, p.104671-104685
Main Authors: Panda, Sakshyam, Rass, Stefan, Moschoyiannis, Sotiris, Liang, K., Loukas, George, Panaousis, Emmanouil
Format: Article
Language:English
Subjects:
Computer security
Configurations
Connected vehicles
cyber deception
cybersecurity investment
Game theory
Honeypots
Intelligence gathering
Internet of Vehicles
Investment
Investment strategy
optimisation
Optimization
Privacy
Threat evaluation
Vehicles
Zero sum games
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The Internet of Vehicles (IoV), whereby interconnected vehicles that communicate with each other and with road infrastructure on a common network, has promising socio-economic benefits but also poses new cyber-physical threats. To protect these entities and learn about adversaries, data on attackers can be realistically gathered using decoy systems like honeypots. Admittedly, honeypots introduces a trade-off between the level of honeypot-attacker interactions and incurred overheads and costs for implementing and monitoring these systems. Deception through honeypots can be achieved by strategically configuring the honeypots to represent components of the IoV to engage attackers and collect cyber threat intelligence. Here, we present HoneyCar, a novel decision support framework for honeypot deception in IoV. HoneyCar benefits from the repository of known vulnerabilities of the autonomous and connected vehicles found in the Common Vulnerabilities and Exposure (CVE) database to compute optimal honeypot configuration strategies. The adversarial interaction is modelled as a repeated imperfect-information zero-sum game where the IoV network administrator strategically chooses a set of vulnerabilities to offer in a honeypot and a strategic attacker chooses a vulnerability to exploit under uncertainty. Our investigation examines two different versions of the game, with and without the re-configuration cost, to empower the network administrator to determine optimal honeypot investment strategies given a budget. We show the feasibility of this approach in a case study that consists of the vulnerabilities in autonomous and connected vehicles gathered from the CVE database and data extracted from the Common Vulnerability Scoring System (CVSS).
ISSN:2169-3536
2169-3536
DOI:10.1109/ACCESS.2022.3210117