H4PLC: Designing PLC Honeypoints Based on Invariants for Industrial Control System Security

Unlike traditional Programmable Logic Controller (PLC) honeypots, a PLC honeypoint is a lightweight, easily deployable decoy that emulates realistic Industrial Control System (ICS) services to deceive attackers and uncover their malicious intent. PLC honeypoints are an effective mechanism for enhancing ICS defense against cyber attackers. However, existing PLC honeypoints lack realism in their services, failing to sufficiently engage attackers during reconnaissance or interaction phases. To address this gap, we introduce H4PLC, a novel PLC honeypoint that employs an invariant-based approach to incorporate realistic ICS physical process properties. H4PLC overcomes challenges in characterizing and integrating these properties into PLC services by leveraging ICS log data to construct Physical Process Trees and control rule transitions, enabling dynamic and authentic responses to attacker reconnaissance and malicious code injections. To the best of our knowledge, H4PLC is the first PLC honeypoint to generate contextually variable, appropriate, and responsive ICS messages tailored to Advanced Persistent Threat (APT) attackers. Experimental evaluations demonstrate that H4PLC provides diverse realistic PLC services and effectively reports anomalies under malicious code injections.