A Novel High-Interaction Honeypot Network for Internet of Vehicles

Abstract

Along with the evolution of communication technologies, cybersecurity has evolved, and so have its new directions and demands. There is a wide range of tools to detect, analyse, or protect systems from malicious activity. Yet, as new technologies are emerging and maturing, the need for particular domain solutions arises. This paper proposes a methodology for a honeypot network organisation mimicking vital autonomous vehicle sensors inside the Internet of Vehicles (IoV) infrastructure, along with attack propagation patterns analysis based on the logs collected from the honeypots. The discovery of sequential patterns is based on Markov Chain models applied in the honey-farm data. Further, these trained models are applied with graph-based algorithms to discover the interaction patterns between honeypots targeting the discovery of segments that were attacked in series. The intelligence produced from the analysis is used to rank and estimate the relative importance of the honeypots in their framework. The results of our study allowed us to identify common attacks on the IoV system, detect the geolocation of each attacker, and specify the usage of each honeypot node from the attacker’s perspective.