A Novel Method for Honeypot Anti-Identification against Modbus Fuzz Testing in Industrial Control Systems

The increasing number of attacks on Industrial Control Systems (ICS) has brought greater attention to ICS honeypots, which act as decoy systems to gather data on attackers and detect threats. Attackers attempt to evade detection by identifying honeypots through countermeasures such as fuzz testing, where they send anomalous inputs to determine if the honeypot responds differently from a real device. In this paper, we present a method to identify fuzzy test behavior for Modbus protocol, allowing recognized fuzz testing traffic to be redirected to real devices to prolong the survival time of the honeypot. Our approach involves generating fuzzy test datasets by capturing raw data and enhancing samples based on multiple random seeds. We utilized various algorithms for recognition and conducted grid search hyperparameter tuning, ultimately achieving satisfactory experimental results.