Honeypots for Threat Intelligence in Building Automation Systems

Direct Digital Controls (DDCs) are components of building automation systems that have a network interface. In this paper we describe how to create a honeypot for such a device. We have replicated the individual services available on the device with extensive logging mechanisms. To do this, we dealt with both protocol-specific as well as operating system-specific properties. We then conduct an experiment in which the honeypots are made publicly accessible on the Internet in order to check whether existing vulnerabilities are already being exploited in the examined devices. While analysing the data we didn't find any specific attacks for this device. Finally, we suggest possible improvements for future experiments.