{"id":"9e8a75b4-ed77-4b92-be95-c6e7b832eb05","arxiv_id":"2509.04080","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A hybrid honeynet that pairs real PLC hardware with a real-time physics simulator to lure and log ICS attackers.","lead":"ICSLure is a modular honeynet framework that combines real Programmable Logic Controllers with physics-based plant simulation to create realistic decoy industrial control systems. The paper describes a wind farm deployment and argues this hybrid setup captures more detailed attacker behavior than software-only honeypots.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Nginx reverse proxy terminates TCP in front of the real PLC, so attackers see a Linux network stack; the indistinguishability claim is undemonstrated.","rationale":"The paper has genuine strengths: a real S7-1200 PLC, a live Simulink plant model driving analog I/O through a custom interface board, public deployment, and Shodan/Censys classification. It is also honest about limitations: the PLC control program is explicitly simplified, HoneyJudge is not run because no public release is available, and the 30-day exposure drew no sophisticated attackers. Those limitations are why the reader's conditional verdict is appropriate. My stress-test focuses on one concrete mechanism that makes the central 'indistinguishable' claim especially fragile: the use of an Nginx reverse proxy in Section 5.2. A reverse proxy necessarily terminates the client TCP connection; the attacker therefore fingerprints the proxy's operating system and network stack, not the PLC's. This is not a matter of missing code or outside-consensus disagreement; it is a design-level artifact. The claimed authentic timing behavior and protocol responses of the real PLC apply only to the application layer, not to the transport layer the attacker actually observes. A layer-2 transparent bridge or TPROXY-based forwarding could avoid this, or the proxy could be treated as part of the decoy and tested for detectability. Until such a test is run, the paper's strongest claim should not be accepted as proven. This leaves the reader's CONDITIONAL verdict unchanged but sharpens the technical basis for it.","tokens_in":20542,"tokens_out":11550,"duration_ms":115584,"concrete_test":"From an external host, capture the TCP handshake (SYN/SYN-ACK) to port 102 and 502 on the deployed ICSLure; record TTL, TCP options, window size, and handshake RTT. Repeat the same capture against the same S7-1200 PLC connected directly (or an identical S7-1200 with the same services, no Nginx). If the TCP fingerprints differ (e.g., Linux SACK/timestamp options vs the Siemens stack) or if the proxied RTT shows bimodal/hop-inflated distribution, the 'transparent proxy' claim fails and the indistinguishability verdict should remain conditional.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Section 6.3) that ICSLure is 'virtually indistinguishable from an operational industrial system' rests on the premise that the transparent proxy and interface board introduce no detectable artifacts. Section 5.2 implements the 'transparent proxy' as an Nginx reverse proxy. Nginx terminates the attacker's TCP connection and opens a separate upstream connection to the S7-1200. Consequently, the remote client never touches the PLC's TCP/IP stack: it sees the Debian VM's kernel behavior (TCP options, TTL, initial window, timestamp handling) and Nginx's connection management. A sophisticated adversary can OS-fingerprint the endpoint (e.g., nmap -O or p0f) and observe Linux rather than a Siemens PLC, or detect the extra proxy hop through RTT/connection analysis. The paper's validation (Shodan/Censys classification, author-launched attacks, 30 days of automated scans) does not test this artifact; Section 6.3 explicitly substitutes an analogy to the idling PLC in HoneyJudge instead of running HoneyJudge. Thus the load-bearing fidelity premise is not merely unverified—the chosen design is non-transparent at the network layer by construction.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces ICSLure, a modular honeynet framework for PLC-based industrial control systems. The design combines a real Siemens S7-1200 PLC with a real-time Simulink wind-turbine model, connected through a custom Raspberry Pi interface board, and adds virtualized OPNsense routing, a Windows 10 engineering workstation, and application-layer 'transparent' proxies. Ports 80, 102, 502, and 5900 are exposed. The authors evaluate the system by launching their own attacks (CPU stop via web, Modbus coil write, S7 replay, noVNC access), testing a FrostyGoop sample, and exposing the deployment for 30 days on an academic network. They report that Shodan and Censys classified the device as an ICS component and claim, in §6.3 and §8, that the system is virtually indistinguishable from a real industrial plant, using an analogy to HoneyJudge's idling-PLC baseline because HoneyJudge was not run.","tokens_in":20812,"tokens_out":5927,"duration_ms":54817,"significance":"If established, the hardware-in-the-loop approach would be a meaningful step beyond software-only ICS honeypots: a real PLC with dynamic I/O from a physics simulator can produce more realistic register behavior and protocol responses than emulation, and the modular architecture is credible and reproducible from the paper. The detailed implementation is a strength, as is the use of real malware (FrostyGoop) as a test case. However, the evaluation does not support the strongest claims. The central assertion of indistinguishability is load-bearing and is not demonstrated; in fact, the Nginx reverse proxy introduces a TCP-layer artifact. There is also no quantitative comparison with existing honeypots and no independent adversary test. The contribution is therefore promising but needs substantial validation work before the realism claims can be accepted.","major_comments":[{"comment":"The 'transparent proxy' described in §5.2 is an Nginx reverse proxy. Nginx terminates the client TCP connection and opens a separate upstream connection to the S7-1200. This is transparent only at the application payload level; at the network and transport layer the remote client sees the Debian VM's TCP stack (TCP options, TTL, window scaling, timestamp handling) and Nginx's connection behavior, not the Siemens PLC's stack. An attacker running nmap -O or p0f, or measuring connection setup and RTT, can therefore detect the proxy. This directly contradicts the §6.3 claim that ICSLure is 'virtually indistinguishable from an operational industrial system'. Because this indistinguishability is the basis for the high-fidelity claim, it is load-bearing. The fix is to use a true layer-2 forwarding element or an S7-level relay without TCP termination, and to validate with active fingerprinting a","section":"§5.2 / §6.3"},{"comment":"The comparative evaluation does not actually run HoneyJudge. The paper states that no official public release exists and then argues by analogy that ICSLure resembles—or improves on—the idling PLC that HoneyJudge could not distinguish. This is an unmeasured inference. The idling PLC in [45] is directly connected with no proxy, so the analogy does not address the TCP-termination artifact of §5.2. Since HoneyJudge's documented procedure is available, the authors should either implement a memory-testing validation, or use publicly available identification tools (Nmap, PLCScan, TIA Portal) against their exposed endpoint and report the results. Absent that, the claim in §8 that the system is 'substantially harder for sophisticated adversaries to detect' is unsupported.","section":"§6.3"},{"comment":"The 30-day public exposure is reported only as 'over 2 GB of network traffic' and 'a substantial number of automated scans and fingerprinting attempts'. No quantitative breakdown is given: number of distinct source IPs, protocols probed, classification results of the scanners, or how the authors determined that scans 'were able to identify the environment as a genuine ICS'. All detailed attacks in §6.1 were launched by the authors, and the FrostyGoop test in §6.2 was also performed from the authors' workstation. This is anecdotal evidence. It cannot support the comparative and indistinguishability claims. The paper should either report the full scan statistics or label the evaluation as a functional demonstration rather than a validation of realism.","section":"§6.1"}],"minor_comments":[{"comment":"RFC 1006 is an ISO transport-over-TCP mapping, not the Siemens S7 protocol. The text calls the S7 service 'S7 Connect (RFC 1006)'; this conflates the transport layer with the application protocol. Please correct.","section":"§5.5"},{"comment":"Typo: 'Trasparent Proxy' should be 'Transparent Proxy'.","section":"Fig. 6"},{"comment":"The fault thresholds are described as 'exceed the 25% of the maximum value of the operating range' for rotor/gearbox/generator faults. This is ambiguous: is it 25% above the maximum, or 25% of the maximum? Clarify and state the actual thresholds used in the experiment.","section":"§5.2.3"},{"comment":"The 'Data Realism' row reads 'Various Static Simulated', which appears to be a compressed list of values across the three interaction levels. Please format it as three separate entries so the comparison is readable.","section":"Table 1"},{"comment":"The FrostyGoop spelling is inconsistent (Frostygoop/FrostyGoop), and the description 'We downloaded a copy of the Frostygoop virus from Virus Total and configured to send various Modbus message' is unclear. As written, it is not evident whether the actual malware was executed or a custom Modbus script was used. Please describe the exact procedure.","section":"§6.2"}],"recommendation":"major_revision","confidential_remarks":"To the editor: The stress-test concern about Nginx is well-founded and should be the anchor of the revision. I nevertheless recommend major revision rather than rejection: the architectural idea is sound, the transparency issue is testable and fixable, and the paper contains sufficient implementation detail to be useful after the claims are calibrated. One further point for editorial attention: the relationship to the authors' prior FiCloud paper [7] and to HoneyICS [29] should be clarified. The manuscript presents ICSLure as new, but [7] is described as 'preliminary results of this work,' and HoneyICS is co-authored by two of the same authors; the novelty boundary is not explicit."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a useful systems contribution that deserves serious refereeing, but the strongest fidelity claims outrun the evidence. The genuinely new bit is putting a real S7-1200 behind a proxy and feeding it live I/O from a Matlab/Simulink wind-turbine model via a custom Raspberry Pi DAC/op-amp interface, plus the modular honeynet scaffolding (OPNsense, Windows workstation, noVNC, logging). That combination extends HoneyICS and Hilt et al. in a real way: you get authentic PLC protocol responses and dynamic register values without building a whole fake factory. I'd want this in the literature so others can build on the interface design.\n\nWhat it does well: the architecture is described with enough detail to be reproducible (voltage conversion, SPI/DAC setup, Simulink modifications, the Moore state machine). The 30-day public deployment and Shodan/Censys classification are honest field data, even if the threat level was mostly scanners. Testing against FrostyGoop is a reasonable first demonstration. They also explicitly flag that no sophisticated attacks were observed and that HoneyJudge has no official public release. That openness is good.\n\nSoft spots. The 'transparent proxy' is an Nginx reverse proxy that terminates the attacker's TCP connections. Whether the paper admits it or not, remote clients never touch the PLC's TCP/IP stack; they see Debian's kernel and Nginx's connection handling. So the Section 6.3 claim that ICSLure is 'virtually indistinguishable from an operational industrial system' is not supported—it's arguably false at the network layer, and no OS-fingerprinting test (nmap -O, p0f) was done. That's the load-bearing issue. Second, the comparative evaluation is a parallel drawn from HoneyJudge's published results, not a run of the framework; the paper says so, but then uses the analogy to conclude superiority. Third, the known-attack evaluation is mostly the authors attacking their own system, so 'significantly enhanced threat data quality' is still a hypothesis, not a measured result.\n\nNone of this kills the paper. The framework stands on its own as a buildable, modular real-PLC honeynet. But the authors should either soften the indistinguishability claim or do the fingerprinting and HoneyJudge comparison properly, ideally with released code and data.\n\nBottom line: send it to peer review, expect major revision. Reading group: maybe. Cite: probably, for the interface design.","headline":"Genuine modular real-PLC honeynet with simulated plant, but the proxy design and anecdotal evaluation don't support the 'virtually indistinguishable' claim as written.","tokens_in":21309,"tokens_out":1798,"would_cite":true,"duration_ms":18589,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Real PLC plus plant simulator makes a wind-farm honeypot hard to detect.","keywords":["industrial control systems","honeypot","honeynet","programmable logic controller","ICS security","physics-aware simulation","threat intelligence","SCADA"],"falsifier":"Run a red team with ICS network expertise against the deployed ICSLure wind farm and ask them to classify it as real or decoy under time pressure, or run the memory-testing procedure described in the paper's cited benchmark along with a timing analysis of the proxy on the PLC module; if the device is flagged as a honeypot or the team identifies the simulator's register behavior as synthetic, the central fidelity claim fails.","tokens_in":20464,"feed_emoji":"🛡️","tokens_out":4946,"duration_ms":47672,"temperature":0.7,"pith_summary":"The paper claims that the usual trade-off in ICS honeypots—between cheap but easily detectable software simulations and expensive but convincing real hardware—can be broken by combining a real PLC with a physics-aware plant simulator. In the proposed framework, ICSLure, an attacker who probes a decoy wind farm talks to an actual PLC executing a real control program, while the plant it controls is a real-time turbine model whose inputs come from live weather data. Because the PLC generates genuine protocol responses, timing, and I/O behavior, the resulting honeynet is, the authors argue, nearly indistinguishable from an operational industrial system and collects richer attacker data than software-only honeypots. The claim matters: if correct, defenders could deploy modular, high-fidelity decoys that attract sophisticated ICS-targeting malware and expose attacker behavior that simpler honeypots never see.","feed_headline":"Real PLC plus plant simulator hides a wind-farm honeypot in plain sight","feed_subtitle":"ICSLure couples real controller hardware with live simulated turbine data, so attacker probing gets authentic plant behavior.","key_machinery":"The transparent proxy and interface board pair. The proxy forwards traffic to the real PLC and copies it to logging, so the attacker speaks to genuine device firmware; the interface board (a microcontroller with a digital-to-analog converter and level shifting) maps the real PLC's field signals into a real-time plant simulator and feeds simulated sensor readings back into the PLC's analog inputs. This closed loop makes the PLC execute its control logic against a plausible plant instead of against nothing, which is what the paper identifies as the difference between a convincing honeynet and an idle or emulated PLC.","core_discovery":"ICSLure introduces a 'very high interaction' level of honeypot: real programmable logic controllers are placed inside a virtualized network and connected, through a transparent proxy, to a real-time physics simulator that plays the role of the physical plant. The connection is made by an interface board that converts the PLC's digital and analog I/O into signals the simulator understands and back, so the PLC runs its actual control program—in this case a wind-turbine state machine—against a plant that responds plausibly. The paper argues this hybrid removes the realism gap that lets sophisticated attackers recognize software-emulated decoys: real hardware supplies authentic timing, protocol,","pith_inferences":["The realism claim is only as strong as the simulator's dynamic model: an attacker who learns to probe field-network behavior (register transitions under abnormal inputs, or I/O timing) could still fingerprint the decoy; the paper does not test against such probing.","Timing analysis of the transparent proxy is a cheap, concrete test of the core premise: if proxy latency or packet-order changes are measurable, a sophisticated adversary could detect the decoy without any memory-based fingerprinting.","The memory-testing benchmark cited for validation is used as an analogy, not executed: the paper argues ICSLure goes beyond an 'idling PLC' that evades that benchmark, but the actual deception ceiling remains unmeasured until the benchmark is run on this system.","The approach suggests a cost trade-off: the hardware expense of real PLCs might be offset by reusing the same simulator across many deployments, making high-fidelity decoys affordable for smaller operators."],"forward_implications":["If the fidelity claim holds, security teams can deploy decoy wind farms, substations, or production lines that run real vendor firmware and still react to attacks with plant-level consequences.","Captured logs would include the full attack chain—initial scan, protocol abuse, workstation pivot, malware detonation—rather than isolated probe requests, supporting forensic reconstruction of ICS-specific tactics.","The modular design implies the same hybrid can be re-pointed at different plants and controllers by swapping the plant model and the interface board configuration, without rebuilding the honeynet.","Publicly exposed, the framework could serve as an early-warning sensor that lets analysts observe new ICS malware as it scans for control devices.","Integration with cyber-range platforms is presented as a next step, turning the decoy into a testbed for validating detection and response playbooks."],"supporting_citations":[{"why":"Supplies the interaction-level taxonomy and identifies the realism gap that ICSLure's 'very high interaction' level is designed to close.","marker":"[31]"},{"why":"Provides the prior physics-aware honeynet approach that ICSLure extends by adding real PLC hardware to the simulation.","marker":"[29]"},{"why":"Provides the memory-testing evaluation approach the paper cites to argue that its real-hardware setup is indistinguishable from an idle PLC.","marker":"[45]"},{"why":"Demonstrates a real-PLC factory honeynet and establishes the practical baseline for hardware-based ICS deception that ICSLure compares against.","marker":"[13]"},{"why":"Reports the preliminary proof-of-concept results that this paper expands into the full modular framework and case study.","marker":"[7]"},{"why":"Supplies the wind-turbine dynamics model used as the simulated plant that the PLC controls in the case study.","marker":"[42]"}],"fun_headline_variants":["Real PLCs fool attackers with live wind-farm simulator","Honeynet uses real PLCs to simulate a wind farm","Real PLCs, simulated wind plant, very high interaction honeypot","Hybrid honeypot: real PLCs interact with simulated wind farm","PLC honeypot uses live wind-farm data to lure attackers"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The load-bearing premise is that neither the transparent proxy nor the interface board leaves detectable traces, so an attacker cannot tell the decoy wind farm from a real one; the paper asserts this but never tests it against a sophisticated adversary or runs the memory-testing benchmark it cites.","fun_headline_variants_meta":{"raw":{"variants":["Real PLCs fool attackers with live wind-farm simulator","Honeynet uses real PLCs to simulate a wind farm","Real PLCs, simulated wind plant, very high interaction honeypot","Hybrid honeypot: real PLCs interact with simulated wind farm","PLC honeypot uses live wind-farm data to lure attackers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000759,"raw_usage":{"total_tokens":3210,"prompt_tokens":746,"completion_tokens":2464,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":490,"completion_tokens_details":{"reasoning_tokens":2373}},"tokens_in":490,"tokens_out":2464,"duration_ms":16059,"temperature":1.0,"reasoning_tokens":2373,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T10:23:51.979304+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a red team with ICS network expertise against the deployed ICSLure wind farm and ask them to classify it as real or decoy under time pressure, or run the memory-testing procedure described in the paper's cited benchmark along with a timing analysis of the proxy on the PLC module; if the device is flagged as a honeypot or the team identifies the simulator's register behavior as synthetic, the central fidelity claim fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the interaction-level taxonomy and identifies the realism gap that ICSLure's 'very high interaction' level is designed to close."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the prior physics-aware honeynet approach that ICSLure extends by adding real PLC hardware to the simulation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Demonstrates a real-PLC factory honeynet and establishes the practical baseline for hardware-based ICS deception that ICSLure compares against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Reports the preliminary proof-of-concept results that this paper expands into the full modular framework and case study."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the wind-turbine dynamics model used as the simulated plant that the PLC controls in the case study."}],"review_version":1}