ICSLure: A very high interaction honeynet for PLC-based industrial control systems

he security of Industrial Control Systems (ICSs) is critical to ensuring the safety of industrial processes and personnel. The rapid adoption of Industrial Internet of Things (IIoT) technologies has expanded system functionality but also increased the attack surface, exposing ICSs to a growing range of cyber threats. Honeypots provide a means to detect and analyze such threats by emulating target systems and capturing attacker behavior. However, traditional ICS honeypots, often limited to software-based simulations of individual Pro- grammable Logic Controllers (PLCs), may provide limited device and process realism, facilitating fingerprinting by sophisticated adversaries. In this work, we introduce ICSLure, a modular honeynet framework designed to emulate realistic ICS environments. Our approach couples physical PLCs, driven in closed loop by a physics- aware process simulator, with a modular virtualized network environment that can include routers, switches, engineering workstations, and Remote Terminal Units (RTUs). We define a threat model for PLC-based ICSs that makes adversary capabilities and deployment scope explicit, and instantiate the framework in a wind- turbine case study based on a Siemens S7-1200 PLC and a MATLAB/Simulink process model. The prototype exposes HTTP, Modbus/TCP, and S7 services and is evaluated through controlled attack scenarios and a 30-day Internet-facing deployment. Results characterize the latency and resource overhead of the architecture and provide evidence that the prototype sustains genuine protocol-level and coherent process-level interactions while enabling extensive observation of attacker activity