A Ship Honeynet to Gather Cyber Threat Intelligence for the Maritime Sector

This article discusses the ongoing design and development of a ship Honeynet for the purpose of gathering Cyber Threat Intelligence (CTI) to assist the Maritime Sector to be more resilient in the face of increasing cyber-attacks. The critical and fragile nature of the Global Maritime Transportation System (GMTS) has been clearly shown during the COVID-19 Pandemic and in the ongoing impact of the Russian invasion of Ukraine. Unfortunately, at the same time the industry is highly vulnerable to cyber-attack, given ship fleets are aging and their technology is aging with them while at the same time, there is a low level of cyber security maturity within the industry. This article describes the overall research project aiming to gather information on current cyber-attacks on vessels using a Honeynet to develop CTI. This CTI will inform cyber security and maritime professionals to better respond to those threats. Additionally, the project will provide data for a broad range of future research. Honeypots are Internet systems deployed for the sole purpose of being compromised to observe adversaries. Networks of Honeypots are termed Honeynets. Honeypots/Honeynets have existed for more than 30 years however simulating all the different systems of a ship in a Honeynet to research cyber-attacks on maritime is a novel concept. A real ship consists of multiple digital systems which perform and assist in a range of necessary functions such as navigation, communication, safety, propulsion, cargo management, other IT standard office activities, and numerous other purposes. This article will explain the concept of Honeynets, its history, and a ship Honeynet in particular, as well as its design considerations, existing models, and benefits. This article will also look in detail at the data flows for the ship Honeynet and in a new concept how it can be integrated using MITRE Corporation’s STIX and TAXII methodologies for CTI purposes.