Paper2026
Material reviewed: AbstractThe paper proposes a Deception Readiness Index (DRI) for ICS and OT cybersecurity programs. Using design science and qualitative analysis of public standards and guidance, it scores readiness across governance, architecture, monitoring, workforce, and operational safety domains, and applies the index to three synthetic critical-infrastructure profiles to identify gaps before deployment.
OT/ICSDecoy
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy
Dataset or lab2026
Material reviewed: Public pageCritical readingZenodo record of DICOM/PACS telemetry from medical-imaging honeypot research; it documents periods of data loss.
ApplicationOT/ICSHoneypot
Paper2026
Material reviewed: AbstractThe authors present HIVE-OT's design and implementation and evaluate the evidence supported by its process-coupled research core and historical exports, distinguishing the documented platform from a local implementation linking Modbus, a revised Rust water-treatment surrogate and SQLite. The study tests protocol behavior, command application and retained outcome representations, and audits two deployment exports containing 273978 and 842638 events.
OT/ICSNetworkHoneypot
Paper2026
Material reviewed: AbstractThe work presents HoneyPrompt, a multi-sensor fusion architecture for detecting and classifying autonomous AI agents that interact with industrial control systems. The authors deploy a maritime SCADA honeypot simulating a pipeline monitoring gateway across six protocols and instrument it with a graduated prompt injection acting as a sensor array.
OT/ICSNetworkHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe authors introduce ICSLure, a modular honeynet framework intended to emulate realistic industrial control system environments. It integrates physical PLCs with live data sources over industrial protocols and virtualized network components, with monitoring to log attacker interactions.
OT/ICSNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.
NetworkOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.
NetworkOT/ICSDecoyAdversary engagement
Case study2026
Material reviewed: Public pageCritical readingIBM X-Force and Deception.Pro recorded two incidents in simulated organizations, observing reconnaissance, malware deployment and fake-document exfiltration.
EndpointOT/ICSDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: Full textBibliographic record on honeypot integration in industrial IoT. The abstract and findings still require review.
OT/ICSHoneypot
Paper2025
Material reviewed: Public pageProposal describing the addition of a CamouflageNet honeynet and machine learning techniques into the SCADA architecture of an ICS system, aiming to improve defense and the ability to gather information about attackers.
OT/ICSHoneypot
Case study2025
Material reviewed: Public pageCritical readingInstitutional report on deception trials involving UK organizations and providers.
NetworkCloudHoneypotDecoy
Dataset or lab2025
Material reviewed: Public pageCritical readingRecord of access and attack data against a VSAT honeynet.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors present a generative model-based honeypot (using an LSTM network) designed to mimic industrial OPC UA communication in operational technology (OT) systems. The model learns the characteristics of a cyclic mechatronic system from recorded state space trajectories. The work proposes a proof-of-concept and publishes a dataset of a cyclic industrial process to support future research.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: AbstractThis work, according to its authors, addresses security in Advanced Metering Infrastructure (AMI) for smart grids using honeypots combined with federated learning. They propose FedPot, which includes a data quality measure and a fair incentive mechanism allowing small power suppliers to share locally trained models with traditional retailers without exposing confidential data. The authors report, via simulations on realistic microgrid log datasets, improvements over state-of-the-art techniques in both the security model and reward distribution.
OT/ICSIoTHoneypot
Paper2024
Material reviewed: Public pageThe review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.
NetworkOT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.
OT/ICSNetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this work proposes a reconfigurable and scalable honeynet for cyber-physical systems, focused on industrial control systems (ICS). The approach includes automatic generation of attacks to test and validate the honeynet, aiming to serve as a basis for producing datasets to train attack detection and classification algorithms.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.
OT/ICSNetworkHoneypot
Paper2023
Material reviewed: AbstractThe authors present HoneyEVSE, a honeypot designed to simulate Electric Vehicle Supply Equipment (EVSE) within the Vehicle-to-Grid paradigm. The system emulates the charging process and login pages with high fidelity to increase attacker engagement. They exposed the honeypot for 30 days on the Internet and report it successfully evaded the Shodan Honeyscore metric while attracting numerous interactions.
IoTOT/ICSHoneypotDecoy
Open software2023
Material reviewed: Repository metadataHigh-interaction Honeypot for PLCs and Industrial Control Systems
OT/ICSHoneypot