Journal article
ICSHIve: A Framework for Measurable and High-Interactive Honeypots in Industrial Control Systems
IEEE Transactions on Industrial Informatics, Vol.Advanced access
05-Jun-2026
Abstract
Existing industrial control systems (ICS) honeypots primarily focus on simulating programmable logic controllers (PLCs). However, these honeypots are mostly considered "low-interaction" honeypots, resulting in ineffective tracing of attacker tactics, techniques, and procedures. From existing literature, we observed a lack of metrics and frameworks to guide "high-interaction" ICS honeypot development. In this article, we propose metrics to measure ICS honeypot interactivity and apply them to assess existing honeypots. Using our metrics, we design ICSHIve, a novel framework to build high-interaction honeypots across PLC models and vendors. Guided by our framework, we implement honeypots supporting prominent vendors: Allen-Bradley and Schneider-validating ICSHIve's generalizability and device-independent benefits. ICSHIve is evaluated using MITRE ATT&CK to showcase its realism against state-of-the-art reconnaissance tools and accurate physical process simulation. We deployed ICSHIve on Amazon Web Services where it demonstrated high interactivity, accuracy, and realistic responses and significant effectiveness in attracting attackers. ICSHIve's source code is available online.
Details
- Title
- ICSHIve: A Framework for Measurable and High-Interactive Honeypots in Industrial Control Systems
- Authors
- Wenlu Zhang - The University of QueenslandNaipeng Dong - The University of QueenslandTaejun Choi - The University of QueenslandAbigail Koay - University of the Sunshine CoastRyan K. L. Ko - The University of Queensland
- Publication details
- IEEE Transactions on Industrial Informatics, Vol.Advanced access
- Publisher
- Institute of Electrical and Electronics Engineers
- DOI
- 10.1109/TII.2026.3694947
- ISSN
- 1941-0050
- Copyright note
- © 2026 The Authors.This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0
- Grant note
- UQ Cyber Research Centre
- Organisation Unit
- Healthy Ageing Research Cluster; School of Science, Technology and Engineering
- Language
- English
- Record Identifier
- 991245199702621
- Output Type
- Journal article
Metrics
1 Record Views