Scalable ICS Honeypot Design by Description Files

A prototype honeypot system based on the Modbus/TCP protocol is designed for the protection of Industrial Control Systems (ICS). The proposed system operates under the control of a single server and enables multiple agents, each with several honeypot devices, to be deployed in different industrial environments. For each honeypot, the device characteristics are defined by JSON description files. The experimental results show that the interaction behavior of the proposed honeypot is closer to that of an authentic ICS device (a PLC) than that of the Conpot open-source ICS honeypot reported in the literature. Furthermore, the honeypot is awarded a perfect score by the honeypot scoring mechanism of Shodan Internet of Things (IoT) search engine.