A Cyber-Twin Based Honeypot for Gathering Threat Intelligence

2025-09-11

AI Summary

To address the scarcity of threat intelligence for critical infrastructure (e.g., wastewater treatment plants) and the low fidelity of conventional honeypots, this paper proposes a high-fidelity industrial control system (ICS) honeypot based on network twin technology. The approach pioneers the deep integration of network twin principles into honeypot design, enabling precise modeling and real-time synchronization of operational technology (OT) environments to actively lure and monitor real-world attacks at fine-grained resolution. The system incorporates attack traffic analysis, log-based forensic tracing, and ransomware detection and response capabilities, while supporting structured threat intelligence generation and sharing. Deployed in an operational water treatment facility, it successfully captured and fully recorded multiple real-world intrusion incidents—including representative ransomware campaigns—demonstrating its effectiveness and novelty in enhancing threat visibility, enabling proactive defense, and facilitating collaborative threat intelligence.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Intelligent Robots: Multi-Robot Systems
• Cognitive Modeling & Cognitive Systems: Social Cognition And Interaction

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Experiences and lessons learnt from Web-based algorithms and system deployments
• Security and Privacy: Data transparency and provenance
• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems

Abstract

Critical Infrastructure (CI) is prone to cyberattacks. Several techniques have been developed to protect CI against such attacks. In this work, we describe a honeypot based on a cyber twin for a water treatment plant. The honeypot is intended to serve as a realistic replica of a water treatment plant that attracts potential attackers. The attacks launched on the honeypot are recorded and analyzed for threat intelligence. The intelligence so obtained is shared with the management of water treatment plants, who in turn may use it to improve plant protection systems. The honeypot used here is operational and has been attacked on several occasions using, for example, a ransomware attack that is described in detail.

Problem

• Developing a cyber-twin honeypot for critical infrastructure protection
• Gathering threat intelligence from realistic water treatment plant replica
• Analyzing recorded attacks to improve plant protection systems

Innovation

• Cyber-twin based honeypot for threat intelligence
• Realistic replica of water treatment plant
• Records and analyzes attacks for protection improvement