What we know
The authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.
Evidence limits
This entry is based solely on the available title and abstract; the full text has not been reviewed and the authors' reported findings have not been independently verified.
Reviewed: author abstract. Full-text results were not analyzed.
Sources and provenance
- Time-to-Lie: Identifying Industrial Control System Honeypots Using the Internet Control Message Protocol
abstract · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.