Paper2021
Material reviewed: AbstractThe paper proposes and investigates a botnet detection and classification model that combines honeypots with machine learning, aimed at smart factories. The study was carried out in a hardware configuration virtually mimicking a smart factory environment, as described by the authors.
IoTOT/ICSHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes an industrial Early Intrusion Detection System (EIDS) that combines honeypots with machine learning algorithms. The authors describe collecting data from honeypot and industrial device sensors, storing it in a database and analyzing it to alert on intrusions in industrial control networks.
OT/ICSNetworkHoneypot
Paper2020
Material reviewed: AbstractIsrael Barak's article concerns attacks on critical infrastructure — energy, water supply, transport, election systems, government and health — and argues that operators should aim to minimise mean time to response when attacks occur and gain more visibility into their systems, particularly between the IT and OT environments. The author further argues that security needs to be an intrinsic element in all OT systems, right from the initial design.
OT/ICSNetwork
Paper2019
Material reviewed: AbstractThe authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.
OT/ICSHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.
IoTOT/ICSHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Open software2013
Material reviewed: Repository metadataRepository about industrial-system simulation; documentation and maintenance require further review.
OT/ICSHoneypot
Case study—
Material reviewed: Public pageIndustrial manufacturer story published by Acalvio; recorded as a vendor case.
OT/ICSDecoy
Product—
Material reviewed: Public pageCritical readingPrimarily a microsegmentation product whose documentation includes dynamic redirection into a deception environment; this related capability is recorded.
NetworkOT/ICSDecoyMoving target defense
Service—
Material reviewed: Public pageCritical readingACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.
NetworkCloudDecoyHoneytoken
Service—
Material reviewed: Public pageManaged IT and OT deception service published by MainDefense.
OT/ICSNetworkDecoy
Open software—
Material reviewed: Repository documentationProtocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.
NetworkOT/ICSDecoy
Product—
Material reviewed: Public pageCritical readingFortinet platform for deploying decoy assets and alerting on their use.
NetworkOT/ICSDecoyHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that emulates a Veeder-Root TLS-350/TLS-450 automatic tank gauge controller and logs connections and commands.
OT/ICSHoneypot
Open software—
Material reviewed: Repository documentationDocumented integration of Conpot with GridLAB-D for a demonstration using a power-grid model and the “gridpot” template. GridLAB-D supplies the simulation; it is not presented as a honeypot itself.
OT/ICS
Community or education—
Material reviewed: Repository documentationA curated GitHub list aggregating open-source honeypot resources (database, web, WordPress, service, ICS/SCADA honeypots), network and data analysis tools, and deployment guides, organized by category.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationScripts to install a server and multiple honeypots, process their logs, and display information about attack attempts. The documentation lists SSH, web, and industrial-system honeypots.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA script that uses Docker to quickly deploy several honeypots (Conpot, Cowrie, Heralding, Honeyaml, among others) exposing multiple services for research and reconnaissance.
NetworkOT/ICSHoneypot