Pith. sign in

REVIEW 3 major objections 5 minor 44 references

ICSLure: A Very High Interaction Honeynet for PLC-based Industrial Control Systems

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Real PLC plus plant simulator makes a wind-farm honeypot hard to detect.

desk verdict Genuine modular real-PLC honeynet with simulated plant, but the proxy design and anecdotal evaluation don't support the 'virtually indistinguishable' claim as written. read the letter →

arxiv 2509.04080 v1 pith:RXOFPV7G submitted 2025-09-04 cs.CR

Francesco Aurelio Pironti , Angelo Furfaro , Francesco Blefari , Carmelo Felicetti , Matteo Lupinacci , Francesco Romeo This is my paper · ORCID
classification cs.CR
keywords industrialcontrolsystemshoneypothoneynetprogrammablelogiccontrollerICSsecurityphysics-awaresimulationthreatintelligenceSCADA
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the usual trade-off in ICS honeypots—between cheap but easily detectable software simulations and expensive but convincing real hardware—can be broken by combining a real PLC with a physics-aware plant simulator. In the proposed framework, ICSLure, an attacker who probes a decoy wind farm talks to an actual PLC executing a real control program, while the plant it controls is a real-time turbine model whose inputs come from live weather data. Because the PLC generates genuine protocol responses, timing, and I/O behavior, the resulting honeynet is, the authors argue, nearly indistinguishable from an operational industrial system and collects richer attacker data than software-only honeypots. The claim matters: if correct, defenders could deploy modular, high-fidelity decoys that attract sophisticated ICS-targeting malware and expose attacker behavior that simpler honeypots never see.

What carries the argument

The transparent proxy and interface board pair. The proxy forwards traffic to the real PLC and copies it to logging, so the attacker speaks to genuine device firmware; the interface board (a microcontroller with a digital-to-analog converter and level shifting) maps the real PLC's field signals into a real-time plant simulator and feeds simulated sensor readings back into the PLC's analog inputs. This closed loop makes the PLC execute its control logic against a plausible plant instead of against nothing, which is what the paper identifies as the difference between a convincing honeynet and an idle or emulated PLC.

What would settle it

Run a red team with ICS network expertise against the deployed ICSLure wind farm and ask them to classify it as real or decoy under time pressure, or run the memory-testing procedure described in the paper's cited benchmark along with a timing analysis of the proxy on the PLC module; if the device is flagged as a honeypot or the team identifies the simulator's register behavior as synthetic, the central fidelity claim fails.

Watch

Extended reading notes

Core claim

ICSLure introduces a 'very high interaction' level of honeypot: real programmable logic controllers are placed inside a virtualized network and connected, through a transparent proxy, to a real-time physics simulator that plays the role of the physical plant. The connection is made by an interface board that converts the PLC's digital and analog I/O into signals the simulator understands and back, so the PLC runs its actual control program—in this case a wind-turbine state machine—against a plant that responds plausibly. The paper argues this hybrid removes the realism gap that lets sophisticated attackers recognize software-emulated decoys: real hardware supplies authentic timing, protocol,

Load-bearing premise

The load-bearing premise is that neither the transparent proxy nor the interface board leaves detectable traces, so an attacker cannot tell the decoy wind farm from a real one; the paper asserts this but never tests it against a sophisticated adversary or runs the memory-testing benchmark it cites.

Editorial extensions

If this is right

  • If the fidelity claim holds, security teams can deploy decoy wind farms, substations, or production lines that run real vendor firmware and still react to attacks with plant-level consequences.
  • Captured logs would include the full attack chain—initial scan, protocol abuse, workstation pivot, malware detonation—rather than isolated probe requests, supporting forensic reconstruction of ICS-specific tactics.
  • The modular design implies the same hybrid can be re-pointed at different plants and controllers by swapping the plant model and the interface board configuration, without rebuilding the honeynet.
  • Publicly exposed, the framework could serve as an early-warning sensor that lets analysts observe new ICS malware as it scans for control devices.
  • Integration with cyber-range platforms is presented as a next step, turning the decoy into a testbed for validating detection and response playbooks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The realism claim is only as strong as the simulator's dynamic model: an attacker who learns to probe field-network behavior (register transitions under abnormal inputs, or I/O timing) could still fingerprint the decoy; the paper does not test against such probing.
  • Timing analysis of the transparent proxy is a cheap, concrete test of the core premise: if proxy latency or packet-order changes are measurable, a sophisticated adversary could detect the decoy without any memory-based fingerprinting.
  • The memory-testing benchmark cited for validation is used as an analogy, not executed: the paper argues ICSLure goes beyond an 'idling PLC' that evades that benchmark, but the actual deception ceiling remains unmeasured until the benchmark is run on this system.
  • The approach suggests a cost trade-off: the hardware expense of real PLCs might be offset by reusing the same simulator across many deployments, making high-fidelity decoys affordable for smaller operators.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces ICSLure, a modular honeynet framework for PLC-based industrial control systems. The design combines a real Siemens S7-1200 PLC with a real-time Simulink wind-turbine model, connected through a custom Raspberry Pi interface board, and adds virtualized OPNsense routing, a Windows 10 engineering workstation, and application-layer 'transparent' proxies. Ports 80, 102, 502, and 5900 are exposed. The authors evaluate the system by launching their own attacks (CPU stop via web, Modbus coil write, S7 replay, noVNC access), testing a FrostyGoop sample, and exposing the deployment for 30 days on an academic network. They report that Shodan and Censys classified the device as an ICS component and claim, in §6.3 and §8, that the system is virtually indistinguishable from a real industrial plant, using an analogy to HoneyJudge's idling-PLC baseline because HoneyJudge was not run.

Significance. If established, the hardware-in-the-loop approach would be a meaningful step beyond software-only ICS honeypots: a real PLC with dynamic I/O from a physics simulator can produce more realistic register behavior and protocol responses than emulation, and the modular architecture is credible and reproducible from the paper. The detailed implementation is a strength, as is the use of real malware (FrostyGoop) as a test case. However, the evaluation does not support the strongest claims. The central assertion of indistinguishability is load-bearing and is not demonstrated; in fact, the Nginx reverse proxy introduces a TCP-layer artifact. There is also no quantitative comparison with existing honeypots and no independent adversary test. The contribution is therefore promising but needs substantial validation work before the realism claims can be accepted.

major comments (3)
  1. [§5.2 / §6.3] The 'transparent proxy' described in §5.2 is an Nginx reverse proxy. Nginx terminates the client TCP connection and opens a separate upstream connection to the S7-1200. This is transparent only at the application payload level; at the network and transport layer the remote client sees the Debian VM's TCP stack (TCP options, TTL, window scaling, timestamp handling) and Nginx's connection behavior, not the Siemens PLC's stack. An attacker running nmap -O or p0f, or measuring connection setup and RTT, can therefore detect the proxy. This directly contradicts the §6.3 claim that ICSLure is 'virtually indistinguishable from an operational industrial system'. Because this indistinguishability is the basis for the high-fidelity claim, it is load-bearing. The fix is to use a true layer-2 forwarding element or an S7-level relay without TCP termination, and to validate with active fingerprinting a
  2. [§6.3] The comparative evaluation does not actually run HoneyJudge. The paper states that no official public release exists and then argues by analogy that ICSLure resembles—or improves on—the idling PLC that HoneyJudge could not distinguish. This is an unmeasured inference. The idling PLC in [45] is directly connected with no proxy, so the analogy does not address the TCP-termination artifact of §5.2. Since HoneyJudge's documented procedure is available, the authors should either implement a memory-testing validation, or use publicly available identification tools (Nmap, PLCScan, TIA Portal) against their exposed endpoint and report the results. Absent that, the claim in §8 that the system is 'substantially harder for sophisticated adversaries to detect' is unsupported.
  3. [§6.1] The 30-day public exposure is reported only as 'over 2 GB of network traffic' and 'a substantial number of automated scans and fingerprinting attempts'. No quantitative breakdown is given: number of distinct source IPs, protocols probed, classification results of the scanners, or how the authors determined that scans 'were able to identify the environment as a genuine ICS'. All detailed attacks in §6.1 were launched by the authors, and the FrostyGoop test in §6.2 was also performed from the authors' workstation. This is anecdotal evidence. It cannot support the comparative and indistinguishability claims. The paper should either report the full scan statistics or label the evaluation as a functional demonstration rather than a validation of realism.
minor comments (5)
  1. [§5.5] RFC 1006 is an ISO transport-over-TCP mapping, not the Siemens S7 protocol. The text calls the S7 service 'S7 Connect (RFC 1006)'; this conflates the transport layer with the application protocol. Please correct.
  2. [Fig. 6] Typo: 'Trasparent Proxy' should be 'Transparent Proxy'.
  3. [§5.2.3] The fault thresholds are described as 'exceed the 25% of the maximum value of the operating range' for rotor/gearbox/generator faults. This is ambiguous: is it 25% above the maximum, or 25% of the maximum? Clarify and state the actual thresholds used in the experiment.
  4. [Table 1] The 'Data Realism' row reads 'Various Static Simulated', which appears to be a compressed list of values across the three interaction levels. Please format it as three separate entries so the comparison is readable.
  5. [§6.2] The FrostyGoop spelling is inconsistent (Frostygoop/FrostyGoop), and the description 'We downloaded a copy of the Frostygoop virus from Virus Total and configured to send various Modbus message' is unclear. As written, it is not evident whether the actual malware was executed or a custom Modbus script was used. Please describe the exact procedure.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ICSLure's claims are architectural/experimental assertions, not predictions forced by their own definitions or by self-citations.

full rationale

The paper contains no fitted parameters, no equations, and no derivation whose conclusion is equivalent to its premises. The central claim—high-fidelity emulation and difficulty of detection—rests on the chosen design (real S7-1200 PLC, Nginx proxy, Simulink plant model) and on direct observations (Shodan/Censys classification, captured Modbus/S7/noVNC interactions, FrostyGoop detonation). These are independent evidence, not circular reductions. The HoneyJudge validation is not executed; Section 6.3 substitutes an analogy: 'Although there is currently no official public release of the HoneyJudge tool, its documented evaluation procedures allow us to draw meaningful parallels. Given that our setup is based on real PLC hardware with dynamic I/O linked to a simulated plant, it closely resembles—or even improves upon—the idling PLC scenario described in [45]', and the conclusion that ICSLure is 'virtually indistinguishable from an operational industrial system' is asserted rather than demonstrated. That is a validation gap and a correctness risk, not a circularity. The transparency of the Nginx proxy is likewise an unverified premise: an attacker might fingerprint Linux or the proxy hop, but this goes to validity, not to circularity. The self-citations ([7] preliminary results, [29] HoneyICS) are background and prior-work comparisons; none is load-bearing for the paper's main claim, and the paper does not invoke a uniqueness theorem or import an ansatz from those works. No step reduces a predicted quantity to an input by construction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

ICSLure is an engineering system, so there are no fitted model parameters in the sense of a scientific derivation. The listed numbers are hand-chosen design constants in the PLC program and Simulink model. The load-bearing assumptions concern the fidelity of the hardware interface and the proxy, which are asserted rather than measured. No new physical entities, forces, or mediators are introduced.

free parameters (4)
  • fault threshold = 25% of component operating range
    Chosen by hand in the Simulink model modifications (Section 5.2.3) to trigger rotor, gearbox, and generator faults; not derived from physical data.
  • blade pitch angles = 1 degree (startup), 95 degrees (feathering)
    Design choices in the PLC state machine (Section 5.2.1); values are not validated against the original turbine or real operational data.
  • wind speed perturbation = unspecified
    Added to the live weather forecast to derive the vWind input (Section 5.2.3); the magnitude of the perturbation is not given.
  • operating range parameters = derived from original model
    The guard functions vWind_ok() and rotation_ok() use parameters 'derived from the original model' (Section 5.2.1), which are not independently verified for the claimed turbine location.
assumptions (4)
  • domain assumption The Simulink wind turbine model is representative of a real land-based gearbox turbine.
    The paper builds on the built-in Matlab model [42] and modifies it, but provides no validation against real turbine data (Section 5.2.3).
  • domain assumption The interface board and conversion circuit faithfully map simulated signals to the PLC analog inputs and back without artifacts an attacker could detect.
    The hardware chain (Raspberry Pi, DAC, op-amp, voltage converters; Section 5.2.2) is described but not characterized for latency, noise, or fidelity.
  • domain assumption An attacker interacting through the transparent Nginx proxy cannot detect that the PLC is not on a real field network.
    The proxy relays TCP ports 80, 102, and 502 (Section 5.2) and the paper claims transparency, but no adversarial detection test is performed.
  • domain assumption The deployed honeynet configuration matches realistic misconfigured ICS deployments.
    The authors choose exposed web portal, Modbus, S7, and noVNC with weak or no authentication (Section 5.5), asserting this is a typical bad configuration without systematic evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ICSLure: A Very High Interaction Honeynet for PLC-based Industrial Control Systems." pith.science (2026). https://pith.science/paper/RXOFPV7G

@misc{pith2026250904080,
  author       = {Pith},
  title        = {Pith review of: ICSLure: A Very High Interaction Honeynet for PLC-based Industrial Control Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RXOFPV7G}},
  note         = {Machine review of arXiv:2509.04080}
}
read the original abstract

The security of Industrial Control Systems (ICSs) is critical to ensuring the safety of industrial processes and personnel. The rapid adoption of Industrial Internet of Things (IIoT) technologies has expanded system functionality but also increased the attack surface, exposing ICSs to a growing range of cyber threats. Honeypots provide a means to detect and analyze such threats by emulating target systems and capturing attacker behavior. However, traditional ICS honeypots, often limited to software-based simulations of a single Programmable Logic Controller (PLC), lack the realism required to engage sophisticated adversaries. In this work, we introduce a modular honeynet framework named ICSLure. The framework has been designed to emulate realistic ICS environments. Our approach integrates physical PLCs interacting with live data sources via industrial protocols such as Modbus and Profinet RTU, along with virtualized network components including routers, switches, and Remote Terminal Units (RTUs). The system incorporates comprehensive monitoring capabilities to collect detailed logs of attacker interactions. We demonstrate that our framework enables coherent and high-fidelity emulation of real-world industrial plants. This high-interaction environment significantly enhances the quality of threat data collected and supports advanced analysis of ICS-specific attack strategies, contributing to more effective detection and mitigation techniques.

Figures

Figures reproduced from arXiv: 2509.04080 by the authors.

Figure 1
Figure 1. Example of a real industrial installation. [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. An example of the modular architecture of ICSLure [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. General architecture for a honeypot PLC. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Wind turbine schema Virtual Workstation Transparent Proxy Transparent Proxy Virtual Switch PLC Internet Matlab PLC module Workstation module [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: A ICSLure example targeting the control infrastructure of a wind farm, such as forcing a shutdown or causing unsafe operating conditions, could severely disrupt not only the local energy production but also destabilize the broader electrical grid to which the farm is c…
Figure 6
Figure 6. Figure 6: Overview of the employed infrastructure Manuscript submitted to ACM [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: A State diagram of the control logic 5.2.1 PLC program. To address the unavailability of a real PLC control program, we designed and implemented a simplified version tailored to our system requirements. The control logic is specified by the state machine illustrated in…
Figure 8
Figure 8. Figure 8: Hardware setup for interfacing a PLC with a plant simulator [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 39 canonical work pages

  1. [45]

    Hengye Zhu, Mengxiang Liu, Binbin Chen, Xin Che, Peng Cheng, and Ruilong Deng. 2024. HoneyJudge: A PLC Honeypot Identification Framework Based on Device Memory Testing. IEEE Transactions on Information Forensics and Security 19 (2024), 6028–6043. doi:10.1109/TIFS.2024.3407520 Manuscript submitted to ACM

    arXiv 2024

  2. [1]

    2025. Censys. https://search.censys.io/

    work page 2025

  3. [2]

    Exploit Database

    2025. Exploit Database. https://www.exploit-db.com/

    work page 2025

  4. [3]

    2025. Shodan. https://www.shodan.io/

    work page 2025

  5. [4]

    Shingo Abe, Yohei Tanaka, Yukako Uchida, and Shinichi Horata. 2018. Developing deception network system with traceback honeypot in ICS network. SICE Journal of Control, Measurement, and System Integration 11, 4 (2018), 372–379

    work page 2018

  6. [5]

    Samah Alshathri, Ayman El-Sayed, Walid El-Shafai, and Ezz El-Din Hemdan. 2023. An Efficient Intrusion Detection Framework for Industrial Internet of Things Security. Computer Systems Science and Engineering 46 (01 2023), 819–834. doi:10.32604/csse.2023.034095

    work page arXiv 2023

  7. [6]

    Giuseppe Bernieri, Mauro Conti, and Federica Pascucci. 2019. Mimepot: a model-based honeypot for industrial control networks. In 2019 ieee international conference on systems, man and cybernetics (smc) . IEEE, 433–438

    work page 2019

  8. [7]

    Francesco Blefari, Carmelo Felicetti, Francesco Aurelio Pironti, and Angelo Furfaro. 2024. Towards Very-High Interaction Honeypots for ICS: a Proof of Concept. In 2024 11th International Conference on Future Internet of Things and Cloud (FiCloud) . IEEE, 176–182. doi:10.1109/ficloud62933.2024.00034

    work page arXiv 2024

Show all 44 references
  1. [8]

    Francesco Blefari, Francesco Aurelio Pironti, and Angelo Furfaro. 2024. Toward a Log-based Anomaly Detection System for Cyber Range Platforms. In Proceedings of the 19th International Conference on A vailability, Reliability and Security (Vienna, Austria) (ARES ’24). Associati...

    2024

  2. [9]

    Michele Bombardieri, Salvatore Castano, Fabrizio Curcio, Angelo Furfaro, and Helen D. Karatza. 2016. Honeypot-Powered Malware Reverse Engineering. In 2016 IEEE International Conference on Cloud Engineering Workshop (IC2EW) . IEEE. doi:10.1109/ic2ew.2016.16

    2016 doi

  3. [10]

    Hugh Boyes, Bil Hallaq, Joe Cunningham, and Tim Watson. 2018. The industrial internet of things (IIoT): An analysis framework. Computers in Industry 101 (Oct. 2018), 1–12. doi:10.1016/j.compind.2018.04.015

    2018 doi

  4. [11]

    Dániel István Buza, Ferenc Juhász, György Miru, Márk Félegyházi, and Tamás Holczer. 2014. CryPLH: Protecting smart energy systems from targeted attacks with a PLC honeypot. In Smart Grid Security: Second International Workshop, SmartGridSec 2014, Munich, Germany, February 26, ...

    2014

  5. [12]

    Castellanos, Martin Ochoa, Alvaro A

    John H. Castellanos, Martin Ochoa, Alvaro A. Cardenas, Owen Arden, and Jianying ZHOU. 2021. AttkFinder: Discovering Attack Vectors in PLC Programs using Information Flow Analysis. In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defense...

    2021

  6. [13]

    Stephen Castellanos, Federico Maggi, Charles Perine, Lord Remorin, Martin Rösler, and Rainer Vosseler. 2020. Caught in the Act: Running a Realistic Factory Honeypot to Capture Real Threats. Trend Micro Research (2020)

    2020

  7. [14]

    Chamotra, J

    S. Chamotra, J. S. Bhatia, R. Kamal, and A. K. Ramani. 2011. Deployment of a low interaction honeypot in an organizational private network. In 2011 International Conference on Emerging Trends in Networks and Computer Communications (ETNCC) . IEEE, 130–135. doi:10.1109/etncc.20...

    2011

  8. [15]

    Nirmal Dagdee and Urjita Thakar. 2008. Intrusion Attack Pattern Analysis and Signature Extraction for Web Services Using Honeypots. 2008 First International Conference on Emerging Trends in Engineering and Technology (2008), 1232–1237. https://api.semanticscholar.org/CorpusID:31241405

    2008

  9. [16]

    Alessandro Di Pinto, Younes Dragoni, and Andrea Carcano. 2018. TRITON: The first ICS cyber attack on safety instrument systems. Proc. Black Hat USA 2018 (2018), 1–26

    2018

  10. [17]

    Simulink Documentation. 2024. Simulation and Model-Based Design. https://www.mathworks.com/products/simulink.html

    2024

  11. [18]

    Wenjun Fan, Zhihui Du, and David Fernández. 2015. Taxonomy of honeynet solutions. In 2015 SAI Intelligent Systems Conference (IntelliSys) . IEEE, 1002–1009. doi:10.1109/IntelliSys.2015.7361266

    2015

  12. [19]

    Peter Fritzson. 2011. Introduction to Modeling and Simulation of Technical and Physical Systems with Modelica . Wiley-IEEE Press

    2011

  13. [20]

    HashiCorp. 2025. Terraform: Automate Infrastructure on Any Cloud. https://developer.hashicorp.com/terraform

    2025

  14. [21]

    Lorin Hochstein. 2015. Ansible: Up and Running (1st ed.). O’Reilly Media, Inc

    2015

  15. [22]

    Henry Hui, Kieran McLaughlin, and Sakir Sezer. 2021. Vulnerability analysis of S7 PLCs: Manipulating the security mechanism. International Journal of Critical Infrastructure Protection 35 (2021), 100470. doi:10.1016/j.ijcip.2021.100470

    2021

  16. [24]

    Laverty, and Sakir Sezer

    Rafiullah Khan, Peter Maynard, Kieran Mclaughlin, David M. Laverty, and Sakir Sezer. 2016. Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid. In International Symposium for ICS & SCADA Cyber Security Research . doi:10...

    2016 doi

  17. [25]

    Ralph Langner. 2011. Stuxnet: Dissecting a Cyberwarfare Weapon. IEEE Security & Privacy 9, 3 (2011), 49–51. doi:10.1109/MSP.2011.67

    2011 doi

  18. [26]

    Heiner Lasi, Peter Fettke, Hans-Georg Kemper, Thomas Feld, and Michael Hoffmann. 2014. Industry 4.0. Business & Information Systems Engineering 6, 4 (June 2014), 239–242. doi:10.1007/s12599-014-0334-4 Manuscript submitted to ACM 26 Pironti F.A., et al

    2014 doi

  19. [27]

    Efrén López-Morales, Carlos Rubio-Medrano, Adam Doupé, Yan Shoshitaishvili, Ruoyu Wang, Tiffany Bao, and Gail-Joon Ahn. 2020. HoneyPLC: A Next-Generation Honeypot for Industrial Control Systems. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Se...

    2020

  20. [28]

    Efrén López-Morales, Carlos Rubio-Medrano, Adam Doupé, Yan Shoshitaishvili, Ruoyu Wang, Tiffany Bao, and Gail-Joon Ahn. 2020. Honeyplc: A next-generation honeypot for industrial control systems. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Se...

    2020

  21. [29]

    Marco Lucchese, Francesco Lupia, Massimo Merro, Federica Paci, Nicola Zannone, and Angelo Furfaro. 2023. HoneyICS: A High-interaction Physics-aware Honeynet for Industrial Control Systems. In Proceedings of the 18th International Conference on A vailability, Reliability and Se...

    2023

  22. [30]

    Matteo Lupinacci, Francesco Blefari, Francesco Romeo, Francesco Aurelio Pironti, and Angelo Furfaro. 2025. ARCeR: an Agentic RAG for the Automated Definition of Cyber Ranges. arXiv:2504.12143 [cs.CR] https://arxiv.org/abs/2504.12143

    2025 arXiv

  23. [31]

    Sam Maesschalck, Vasileios Giotsas, Benjamin Green, and Nicholas Race. 2022. Don’t get Stung, Cover your ICS in Honey: How do Honeypots fit within Industrial Control System Security. Computers & Security 114 (03 2022), 102598. doi:10.1016/j.cose.2021.102598

    2022

  24. [32]

    Microsoft. 2025. Playwright Trace Viewer. https://playwright.dev/docs/trace-viewer

    2025

  25. [33]

    Cardenas, and Nicanor Quijano

    Andrés Felipe Murillo, Luis Francisco Cómbita, Andrea Calderón Gonzalez, Sandra Rueda, Alvaro A. Cardenas, and Nicanor Quijano. 2018. A Virtual Environment for Industrial Control Systems: A Nonlinear Use-Case in Attack Detection, Identification, and Response. In Proceedings of...

    2018

  26. [34]

    Open-Meteo.com. 2025. Free Weather API. https://open-meteo.com/

    2025

  27. [35]

    Vern Paxson. 1998. Bro: A System for Detecting Network Intruders in Real-Time. In 7th USENIX Security Symposium (USENIX Security 98) . USENIX Association, San Antonio, TX. https://www.usenix.org/conference/7th-usenix-security-symposium/bro-system-detecting-network-intruders-real- time

    1998

  28. [36]

    Popek and Robert P

    Gerald J. Popek and Robert P. Goldberg. 1974. Formal requirements for virtualizable third generation architectures. Commun. ACM 17, 7 (jul 1974), 412–421. doi:10.1145/361011.361073

    1974

  29. [37]

    Niels Provos. 2004. A virtual honeypot framework. In Proceedings of the 13th Conference on USENIX Security Symposium - Volume 13 (San Diego, CA) (SSYM’04). USENIX Association, USA, 1

    2004

  30. [38]

    Will Reese. 2008. Nginx: the high-performance web server and reverse proxy. Linux Journal 2008, 173 (2008), 2

    2008

  31. [39]

    Rose and D

    M. Rose and D. Cass. 1987. ISO Transport Service on top of the TCP Version: 3. RFC 1006. doi:10.17487/RFC1006

    1987 doi

  32. [40]

    G. P. H. Sandaruwan, P. S. Ranaweera, and Vladimir A. Oleshchuk. 2013. PLC security and critical infrastructure protection. In 2013 IEEE 8th International Conference on Industrial and Information Systems . 81–85. doi:10.1109/ICIInfS.2013.6731959

    2013

  33. [41]

    Paulo Simões, Tiago Cruz, Jorge Gomes, and Edmundo Monteiro. 2013. On the use of honeypots for detecting cyber attacks on industrial control networks. In Proc. 12th Eur. Conf. Inform. Warfare Secur. ECIW , Vol. 2013

    2013

  34. [42]

    Simulink. 2025. Wind turbine model. https://www.mathworks.com/help/sps/ug/wind-turbine.html

    2025

  35. [43]

    https://github.com/0x0mar/smod

    smod 2024. https://github.com/0x0mar/smod

    2024

  36. [44]

    Pothamsetty Venkat and Franz Matthew. 2024. SCADA HoneyNet Project: Building Honeypots for Industrial Networks . https://scadahoneynet. sourceforge.net/

    2024

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.