Surveying cyber-physical honeynets: Realism, attractiveness, and emerging applications

Cyber-physical systems play a central role in critical infrastructures, particularly in power plants, factories, and water treatment facilities. These systems face increasingly sophisticated threats that can have severe operational and societal consequences. A Cyber-Physical Honeynet (CPHoneynet) is a network of honeypots designed to replicate the operation of a real cyber-physical environment. When attackers interact with it, a CPHoneynet enables the collection of valuable threat intelligence regarding attacker methods, tools, and attack vectors. The domain lacks a recent and comprehensive structuring. Therefore, this survey identifies, reviews, and analyzes the central publications published between 2010 and June 2026 through a Systematic Literature Review methodology. The survey analyzes 451 publications and focuses on three major themes: realism, attractiveness, and emerging applications of CPHoneynets. The analysis reveals that IoT and ICS are the dominant application domains, realism remains the primary research challenge, and attractiveness remains comparatively underexplored despite its direct impact on threat-intelligence collection. The survey synthesizes a reference architecture, proposes a comprehensive taxonomy, and identifies evaluation metrics for both realism and attractiveness. It further highlights emerging directions such as Artificial Intelligence, Digital Twins, and Large Language Models, while showing that standardized evaluation frameworks remain largely absent from the literature. Finally, the survey identifies open challenges and research gaps related to scalability, deployment complexity, operational safety, and adaptive cyber-deception, providing a structured foundation for future research and practical deployment of CPHoneynets.