Logo image
ICSHIve: A Framework for Measurable and High-Interactive Honeypots in Industrial Control Systems
Journal article   Open access   Peer reviewed

ICSHIve: A Framework for Measurable and High-Interactive Honeypots in Industrial Control Systems

Wenlu Zhang, Naipeng Dong, Taejun Choi, Abigail Koay and Ryan K. L. Ko
IEEE Transactions on Industrial Informatics, Vol.Advanced access
05-Jun-2026
pdf
ICSHIve_A_Framework_for_Measurable_and_High-Interactive_Honeypots_in_Industrial_Control_Systems1.49 MBDownloadView
Published Version (Advanced Access) Open Access CC BY V4.0

Abstract

honeypot industrial control systems (ICS) interaction metrics
Existing industrial control systems (ICS) honeypots primarily focus on simulating programmable logic controllers (PLCs). However, these honeypots are mostly considered "low-interaction" honeypots, resulting in ineffective tracing of attacker tactics, techniques, and procedures. From existing literature, we observed a lack of metrics and frameworks to guide "high-interaction" ICS honeypot development. In this article, we propose metrics to measure ICS honeypot interactivity and apply them to assess existing honeypots. Using our metrics, we design ICSHIve, a novel framework to build high-interaction honeypots across PLC models and vendors. Guided by our framework, we implement honeypots supporting prominent vendors: Allen-Bradley and Schneider-validating ICSHIve's generalizability and device-independent benefits. ICSHIve is evaluated using MITRE ATT&CK to showcase its realism against state-of-the-art reconnaissance tools and accurate physical process simulation. We deployed ICSHIve on Amazon Web Services where it demonstrated high interactivity, accuracy, and realistic responses and significant effectiveness in attracting attackers. ICSHIve's source code is available online.

Details

Metrics

1 Record Views
Logo image