DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure
Cryptography and Security
Summary
The authors created DICOMHawk, a tool that pretends to be medical imaging systems to trick hackers. It uses realistic fake patient data and interactions to lure attackers and hide itself better than older tools. Over months, DICOMHawk caught more attacks and helped understand threats aimed at medical imaging in healthcare. This shows that realistic and long-lasting fake systems can improve security insights.
Authors
Karina Elzer, Alberto Mongardini, Ricardo Yaben, Georgios Theodoridis, Alexandra Babanuta, Nawras Mouala, Emmanouil Vasilomanolakis
Abstract
Cyber-attacks against exposed healthcare infrastructure threaten sensitive patient data and clinical operations, yet existing defensive tools for DICOM-based medical imaging systems provide limited interaction and are easily fingerprinted. We introduce DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services using realistic interactions, dynamically populated medical records, and embedded honeytokens. In an 86-day comparison and a 347-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 49 medical-related attacks. The results show that realistic, long-term, multi-location deception improves visibility into threats targeting medical imaging systems.