AIセキュリティポータル K Program
LLMPot: Dynamically Configured LLM-based Honeypot for Industrial Protocol and Physical Process Emulation
Share
Abstract
Industrial Control Systems (ICS) are extensively used in critical infrastructures ensuring efficient, reliable, and continuous operations. However, their increasing connectivity and addition of advanced features make them vulnerable to cyber threats, potentially leading to severe disruptions in essential services. In this context, honeypots play a vital role by acting as decoy targets within ICS networks, or on the Internet, helping to detect, log, analyze, and develop mitigations for ICS-specific cyber threats. Deploying ICS honeypots, however, is challenging due to the necessity of accurately replicating industrial protocols and device characteristics, a crucial requirement for effectively mimicking the unique operational behavior of different industrial systems. Moreover, this challenge is compounded by the significant manual effort required in also mimicking the control logic the PLC would execute, in order to capture attacker traffic aiming to disrupt critical infrastructure operations. In this paper, we propose LLMPot, a novel approach for designing honeypots in ICS networks harnessing the potency of Large Language Models (LLMs). LLMPot aims to automate and optimize the creation of realistic honeypots with vendor-agnostic configurations, and for any control logic, aiming to eliminate the manual effort and specialized knowledge traditionally required in this domain. We conducted extensive experiments focusing on a wide array of parameters, demonstrating that our LLM-based approach can effectively create honeypot devices implementing different industrial protocols and diverse control logic.
Understanding the operation of industrial msf plants part i: Stability and steady-state analysis
E. Ali
Published: 2002
Towards high-interaction virtual ics honeypots-in-a-box
D. Antonioli, A. Agrawal, N. O. Tippenhauer
Published: 2016
Minicps: A toolkit for security research on cps networks
D. Antonioli, N. O. Tippenhauer
Published: 2015
Numerical Analysis
R. L. Burden, J. D. Faires, A. M. Burden
Published: 2016
Cryplh: Protecting smart energy systems from targeted attacks with a plc honeypot
D. I. Buza, F. Juhász, G. Miru, M. Félegyházi, T. Holczer
Published: 2014
Fieldfuzz: In situ blackbox fuzzing of proprietary industrial automation runtimes via the network
A. Bytes, P. H. N. Rajput, C. Doumanidis, M. Maniatakos, J. Zhou, N. O. Tippenhauer
Published: 2023
A survey of honeypot research: Trends and opportunities
R. M. Campbell, K. Padayachee, T. Masombuka
Published: 2015
Dipot: A distributed industrial honeypot system
J. Cao, W. Li, J. Li, B. Li
Published: 2018
Icspot: A high-interaction honeypot for industrial control systems
M. Conti, F. Trolese, F. Turrin
Published: 2022
Generative adversarial nets
I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y. Bengio
Published: 2014
Reducing the dimensionality of data with neural networks
G. E. Hinton, R. R. Salakhutdinov
Published: 2006
Phi-2: The surprising power of small language models
M. Javaheripi, S. Bubeck, M. Abdin, J. Aneja, C. C. T. Mendes, W. Chen, A. Del Giorno, R. Eldan, S. Gopi
Published: 2023
Scada honeypots: An in-depth analysis of conpot
A. Jicha, M. Patton, H. Chen
Published: 2016
Shape: A honeypot for electric power substation
K. Kołtys, R. Gajewski
Published: 2015
Rethinking the honeypot for cyber-physical systems
S. Litchfield, D. Formby, J. Rogers, S. Meliopoulos, R. Beyah
Published: 2016
Honeyplc: A next-generation honeypot for industrial control systems
E. López-Morales, C. Rubio-Medrano, A. Doupé, Y. Shoshitashvili, R. Wang, T. Bao, G.-J. Ahn
Published: 2020
Design principles and design patterns
R. C. Martin
Published: 2000
The cybersecurity landscape in industrial control systems
S. McLaughlin, C. Konstantinou, X. Wang, L. Davi, A.-R. Sadeghi, M. Maniatakos, R. Karri
Published: 2016
Detecting ransomware with honeypot techniques
C. Moore
Published: 2016
Nmap in the enterprise: your guide to network scanning
Orebaugh, A., Pinkard, B.
Published: 2011
Active defence using an operational technology honeypot
R. Piggin, I. Buffey
Published: 2016
Honeyd-a virtual honeypot daemon
N. Provos
Published: 2003
{ICSPatch}: Automated vulnerability localization and {Non-Intrusive} hotpatching in industrial control systems using data dependence graphs
P. H. N. Rajput, C. Doumanidis, M. Maniatakos
Published: 2023
Process-aware cyberattacks for thermal desalination plants
P. H. N. Rajput, P. Rajput, M. Sazos, M. Maniatakos
Published: 2019
A First Course in Probability
R. Sheldon
Published: 2018
Neuralpot: An industrial honeypot implementation based on deep neural networks
I. Siniosoglou, G. Efstathopoulos, D. Pliatsios, I. D. Moscholios, A. Sarigiannidis, G. Sakellari, G. Loukas, P. Sarigiannidis
Published: 2020
{ICSFuzz}: Manipulating {I/Os} and repurposing binary code to enable instrumented fuzzing in {ICS} control applications
D. Tychalas, H. Benkraouda, M. Maniatakos
Published: 2021
Icsquartz: Scan cycle-aware and vendor-agnostic fuzzing for industrial control systems
C. Villa, C. Doumanidis, H. Lamri, P. H. N. Rajput, M. Maniatakos
Published: 2025
Honeypots for distributed denial-of-service attacks
N. Weiler
Published: 2002
The gaspot experiment: Unexamined perils in using
K. Wilhoit, S. Hilt
Published: 2015
S7commtrace: A high interactive honeypot for industrial control system based on s7 protocol
F. Xiao, E. Chen, Q. Xu
Published: 2018
Byt5: Towards a token-free future with pre-trained byte-to-byte models
L. Xue, A. Barua, N. Constant, R. Al-Rfou, S. Narang, M. Kale, A. Roberts, C. Raffel
Published: 2022
Honeyvp: A cost-effective hybrid honeypot architecture for industrial control systems
J. You, S. Lv, Y. Sun, H. Wen, L. Sun
Published: 2021
Share