HoneyCar: A Framework to Configure Honeypot Vulnerabilities on the Internet of Vehicles

Abstract

The Internet of Vehicles (IoV), whereby interconnected vehicles that communicate with each other and with road infrastructure on a common network, has promising socio-economic benefits but also poses new cyber-physical threats. To protect these entities and learn about adversaries, data on attackers can be realistically gathered using decoy systems like honeypots. Admittedly, honeypots introduces a trade-off between the level of honeypot-attacker interactions and incurred overheads and costs for implementing and monitoring these systems. Deception through honeypots can be achieved by strategically configuring the honeypots to represent components of the IoV to engage attackers and collect cyber threat intelligence. Here, we present HoneyCar, a novel decision support framework for honeypot deception in IoV. HoneyCar benefits from the repository of known vulnerabilities of the autonomous and connected vehicles found in the Common Vulnerabilities and Exposure (CVE) database to compute optimal honeypot configuration strategies. The adversarial interaction is modelled as a repeated imperfect-information zero-sum game where the IoV network administrator strategically chooses a set of vulnerabilities to offer in a honeypot and a strategic attacker chooses a vulnerability to exploit under uncertainty. Our investigation examines two different versions of the game, with and without the re-configuration cost, to empower the network administrator to determine optimal honeypot investment strategies given a budget. We show the feasibility of this approach in a case study that consists of the vulnerabilities in autonomous and connected vehicles gathered from the CVE database and data extracted from the Common Vulnerability Scoring System (CVSS).

Cyber Risk Assessment and Optimization: A Small Business Case Study

“…An important direction for further research would be to combine the risk assessment and optimisation framework presented in this paper with the game-theoretic frameworks such as [25], [38], [42], and [43], to explore how strategic interactions impact the optimal choice of controls and support cyber security decisions. Additionally, the optimisation functionality of CENSOR could be extended in terms of its scope to allow for different objective functions, reflected in risk measures, such as the VaR and the CVaR.…”

Intrusion Detection Model for Internet of Vehicles Using GRIPCA and OWELM

“…Panda et al [23] proposed a new decision support framework for Internet of Vehicles honeypot deception, using decoy systems such as honeypots to truly collect attacker data. Haydari et al [24] proposed a statistical non-parametric intrusion detection system for the online detection of attacks, which has superior performance in fast and accurate detection.…”

Key parameters linking cyber-physical trust anchors with embedded internet of things systems

“…The potential for cyber attacks on vehicles, infrastructure, and autonomous networks has already yielded some protective actions: situation reviews (Chen et al, 2022;Sharma and Gillanders, 2022), policy recommendations (Girdhar et al, 2022;Khan et al, 2022;Kukkala et al, 2022;Benyahya et al, 2023), honey-pots (Panda et al, 2022;Anastasiadis et al, 2023;Baldo et al, 2023), and attack detection (Chen et al, 2021;Zelle et al, 2022;Zhang et al, 2023). This activity demonstrates a high level of concern for the cybersecurity of vehicles, infrastructure, and autonomous vehicles.…”