{ "framework": "Universal Honeypot Benchmarking Standard (UHBS) v4.0.1", "evaluation_type": "Full-Spectrum (Static Audit + Dynamic Sandbox)", "target": { "name": "conpot", "kind": "generic", "host": "conpot-lab", "port": 5020, "source_root": "/honeypot", "profile_class": "ICS-SCADA", "protocols": [ "modbus" ], "ports_map": { "modbus": 5020 } }, "baseline": null, "uhqs": { "target": "conpot", "S_A": 79.0, "S_B": 42.5, "S_C": 55.0, "C": 90.0, "S_E": 100.0, "S_F": 70.0, "delta_c": 0.81, "uhqs": 55.4, "weights": { "protocol": 0.35, "behavior": 0.2, "telemetry": 0.15, "scale": 0.1, "static": 0.2 }, "profile_class": "ICS-SCADA", "grade": "GRADE D (Needs Remediation)", "phase": "profile+static+sandbox+dynamic+score", "version": "4.0.1", "containment_measured": true }, "hqs": { "target": "conpot", "S_A": 79.0, "S_B": 42.5, "S_C": 55.0, "C": 90.0, "S_E": 100.0, "S_F": 70.0, "delta_c": 0.81, "uhqs": 55.4, "weights": { "protocol": 0.35, "behavior": 0.2, "telemetry": 0.15, "scale": 0.1, "static": 0.2 }, "profile_class": "ICS-SCADA", "grade": "GRADE D (Needs Remediation)", "phase": "profile+static+sandbox+dynamic+score", "version": "4.0.1", "containment_measured": true }, "modules": [ { "module": "SANDBOX", "dimension": "sandbox", "score": 85.0, "status": "PASSED", "checks": [ { "id": "sandbox.reach.modbus", "team": "blue", "passed": true, "detail": "conpot-lab:5020 open", "score": 25.0, "evidence": [], "critical": false }, { "id": "sandbox.airgap_attested", "team": "blue", "passed": true, "detail": "operator attested air-gapped sandbox (UHBS_AIRGAP_ATTESTED=1)", "score": 25.0, "evidence": [], "critical": false }, { "id": "sandbox.egress_deny_tooling", "team": "blue", "passed": false, "detail": "host-egress-deny.sh not found", "score": 10.0, "evidence": [], "critical": false }, { "id": "sandbox.gateway_log_configured", "team": "blue", "passed": true, "detail": "UHBS_EGRESS_GATEWAY_LOG=/telemetry/egress-gateway.log", "score": 25.0, "evidence": [], "critical": false } ], "metrics": { "reachable_protocols": 1 }, "notes": [ "Phase 3 preflight \u2014 does not replace real air-gap deployment" ], "error": null }, { "module": "F", "dimension": "static", "score": 70.0, "status": "PASSED", "checks": [ { "id": "white.static_private_keys", "team": "white", "passed": false, "detail": "2 static private keys: conpot/templates/default/ssl/ssl.key, conpot/templates/kamstrup_382/ssl/ssl.key", "score": 0.0, "evidence": [ "conpot/templates/default/ssl/ssl.key", "conpot/templates/kamstrup_382/ssl/ssl.key" ], "critical": false }, { "id": "white.hardcoded_ssh_banners", "team": "white", "passed": true, "detail": "0 hardcoded SSH banners", "score": 5.0, "evidence": [], "critical": false }, { "id": "white.predictable_seeds", "team": "white", "passed": true, "detail": "0 predictable PRNG seeds", "score": 5.0, "evidence": [], "critical": false }, { "id": "white.hardcoded_macs", "team": "white", "passed": true, "detail": "0 hardcoded MAC addresses", "score": 5.0, "evidence": [], "critical": false }, { "id": "white.prompt_corpus_present", "team": "white", "passed": true, "detail": "no prompt corpus (N/A for non-LLM)", "score": 5.0, "evidence": [], "critical": false }, { "id": "white.prompt_boundaries", "team": "white", "passed": true, "detail": "no weak delimiter/extract patterns", "score": 10.0, "evidence": [], "critical": false }, { "id": "white.fallback_strings", "team": "white", "passed": true, "detail": "no plain-text LLM fallback artifacts", "score": 10.0, "evidence": [], "critical": false }, { "id": "white.bandit", "team": "white", "passed": false, "detail": "bandit HIGH=9", "score": 0.0, "evidence": [], "critical": false }, { "id": "white.semgrep", "team": "white", "passed": false, "detail": "semgrep error/critical=2 total=17", "score": 6.0, "evidence": [], "critical": false }, { "id": "white.trivy", "team": "white", "passed": true, "detail": "trivy not installed (skipped)", "score": 4.0.1, "evidence": [], "critical": false }, { "id": "white.sast_gate", "team": "white", "passed": false, "detail": "11 high/critical findings", "score": 0.0, "evidence": [], "critical": false }, { "id": "white.vfs_posix_coverage", "team": "white", "passed": true, "detail": "POSIX coverage 43% (45/104)", "score": 10.82, "evidence": [ "adduser", "apt", "apt-get", "cd", "chmod", "chown", "clear", "date", "docker", "echo", "env", "file", "find", "free", "git", "head", "id", "ip", "kill", "less", "ln", "ls", "mkdir", "more", "mount", "passwd", "ping", "pip", "pwd", "python", "python3", "rm", "service", "sh", "sleep", "sort", "ss", "stat", "sudo", "tar" ], "critical": false }, { "id": "white.ot_register_coverage", "team": "white", "passed": true, "detail": "OT/Modbus coverage 78% (14/18)", "score": 19.44, "evidence": [ "coil", "diagnostic", "exception", "function_code", "holding", "input_register", "read_coils", "read_discrete_inputs", "read_holding_registers", "read_input_registers", "write_multiple_coils", "write_multiple_registers", "write_single_coil", "write_single_register" ], "critical": false }, { "id": "white.blocking_calls", "team": "white", "passed": true, "detail": "sleep/blocking markers in non-test code\u22481", "score": 5.0, "evidence": [], "critical": false } ], "metrics": { "source_root": "/honeypot" }, "notes": [ "Module F white-box audit (keys/prompts/SAST/VFS)" ], "error": null }, { "module": "A", "dimension": "protocol", "score": 79.0, "status": "PASSED", "checks": [ { "id": "modbus.fsm.illegal_function", "team": "blue", "passed": true, "detail": "resp=00010000000301ff01", "score": 100.0, "evidence": [], "critical": false }, { "id": "modbus.nego.read_holding", "team": "blue", "passed": false, "detail": "resp=000100000003018302", "score": 30.0, "evidence": [], "critical": false }, { "id": "modbus.timing.sample_size", "team": "blue", "passed": true, "detail": "n=1000 requested=1000 errors=0", "score": 100.0, "evidence": [], "critical": false }, { "id": "modbus.timing.iat_jitter", "team": "red", "passed": true, "detail": "median=0.191ms pstdev=0.119ms (target jitter often <2ms vs native)", "score": 100.0, "evidence": [], "critical": false }, { "id": "modbus.module_a.composite", "team": "blue", "passed": true, "detail": "fsm=100 nego=30 timing=100", "score": 79.0, "evidence": [], "critical": false } ], "metrics": { "per_protocol": { "modbus": 79.0 }, "protocols": [ "modbus" ], "timing_samples": 1000, "available_plugins": [ "ftp", "generic", "git", "http", "modbus", "mysql", "ntp", "rdp", "redis", "sip", "smb", "smtp", "snmp", "ssh", "telnet", "tftp", "vnc" ] }, "notes": [ "UHBS Module A \u2014 plugins=['modbus']", "class=ICS-SCADA strict_rfc=True" ], "error": null }, { "module": "B", "dimension": "behavior", "score": 42.5, "status": "PARTIAL", "checks": [ { "id": "modbus.state.write_read", "team": "blue", "passed": false, "detail": "write step (FC 0x06) failed/unacknowledged: resp=000200000003018602", "score": 0.0, "evidence": [], "critical": true }, { "id": "modbus.payload.unsupported", "team": "red", "passed": true, "detail": "no payload probe \u2014 skipped", "score": 50.0, "evidence": [], "critical": false }, { "id": "modbus.fuzz.binary", "team": "red", "passed": true, "detail": "survived binary blast", "score": 100.0, "evidence": [], "critical": false } ], "metrics": { "per_protocol": { "modbus": 42.5 }, "class": "ICS-SCADA" }, "notes": [ "UHBS Module B class=ICS-SCADA" ], "error": null }, { "module": "C", "dimension": "telemetry", "score": 55.0, "status": "PARTIAL", "checks": [ { "id": "modbus.fuzz.binary", "team": "red", "passed": true, "detail": "survived binary blast", "score": 100.0, "evidence": [], "critical": false }, { "id": "c1.json_parse_clean", "team": "blue", "passed": true, "detail": "0 malformed / 0 records", "score": 20.0, "evidence": [], "critical": false }, { "id": "c1.stix_2_1", "team": "blue", "passed": false, "detail": "no STIX objects found", "score": 0.0, "evidence": [], "critical": false }, { "id": "c1.otel_or_ecs", "team": "blue", "passed": false, "detail": "otel_docs=0 ecs_docs=0", "score": 5.0, "evidence": [], "critical": false }, { "id": "c1.payload_hashes", "team": "blue", "passed": false, "detail": "no md5/sha256 fields", "score": 0.0, "evidence": [], "critical": false }, { "id": "c1.mitre_mapping", "team": "blue", "passed": false, "detail": "no MITRE tags", "score": 0.0, "evidence": [], "critical": false } ], "metrics": {}, "notes": [ "UHBS C1 schema: STIX 2.1 / OTel / ECS best-effort validators" ], "error": null }, { "module": "D", "dimension": "containment", "score": 90.0, "status": "PARTIAL", "checks": [ { "id": "d1.shell_exec_unavailable", "team": "blue", "passed": true, "detail": "no explicit SSH listener (ports.ssh / ssh_port) \u2014 remote shell egress/LPE probes skipped for this protocol", "score": 0.0, "evidence": [], "critical": false }, { "id": "d1.egress_gateway_log", "team": "blue", "passed": true, "detail": "0 gateway canary hits", "score": 20.0, "evidence": [], "critical": false }, { "id": "d1.airgap_attested", "team": "blue", "passed": true, "detail": "UHBS_AIRGAP_ATTESTED=1 (operator attestation; not a substitute for shell probes on SSH decoys)", "score": 0.0, "evidence": [], "critical": false } ], "metrics": { "breakout": false, "allowed_outbound_traffic": false, "shell_exec": false, "protocols": [ "modbus" ] }, "notes": [ "Module D (protocol-agnostic): no SSH exec surface configured \u2014 Safety Gate cannot fully clear without shell probes or UHBS_EGRESS_GATEWAY_LOG evidence. Non-SSH decoys are graded on gateway/airgap attestation only." ], "error": null }, { "module": "E", "dimension": "scale", "score": 100.0, "status": "PASSED", "checks": [ { "id": "e1.p95_vs_tps", "team": "blue", "passed": true, "detail": "P50=1.0ms P95=1.6ms P99=1.9ms TPS_limit=100.0ms proto=modbus", "score": 45.0, "evidence": [], "critical": false }, { "id": "e1.error_rate", "team": "blue", "passed": true, "detail": "errors=0/50 rate=0.00%", "score": 20.0, "evidence": [], "critical": false }, { "id": "e2.exhaustion_input", "team": "red", "passed": true, "detail": "completed exhaustion/fuzz blast", "score": 15.0, "evidence": [], "critical": false }, { "id": "e2.circuit_breaker_alive", "team": "blue", "passed": true, "detail": "service alive after load (connect 0.6ms)", "score": 20.0, "evidence": [], "critical": false } ], "metrics": { "p50_ms": 0.99, "p95_ms": 1.62, "p99_ms": 1.95, "p95_limit_ms": 100.0, "errors": 0, "concurrency": 5, "requests": 50, "wall_s": 0.02, "protocol": "modbus" }, "notes": [], "error": null } ], "extras": { "target_scores": { "protocol": 79.0, "behavior": 42.5, "telemetry": 55.0, "containment": 90.0, "scale": 100.0, "static": 70.0 }, "uhqs_version": "4.0.1", "tps": { "name": "ICS-Modbus-Decoy", "class": "ICS-SCADA", "protocols": [ "modbus" ], "expected_p95_latency_ms": 100.0 } } }