LLMPot: Dynamically Configured LLM-based Honeypot for Industrial Protocol and Physical Process Emulation

Abstract: Industrial Control Systems (ICS) are extensively used in critical infrastructures ensuring efficient, reliable, and continuous operations. However, their increasing connectivity and addition of advanced features make them vulnerable to cyber threats, potentially leading to severe disruptions in essential services. In this context, honeypots play a vital role by acting as decoy targets within ICS networks, or on the Internet, helping to detect, log, analyze, and develop mitigations for ICS-specific cyber threats. Deploying ICS honeypots, however, is challenging due to the necessity of accurately replicating industrial protocols and device characteristics, a crucial requirement for effectively mimicking the unique operational behavior of different industrial systems. Moreover, this challenge is compounded by the significant manual effort required in also mimicking the control logic the PLC would execute, in order to capture attacker traffic aiming to disrupt critical infrastructure operations. In this paper, we propose LLMPot, a novel approach for designing honeypots in ICS networks harnessing the potency of LLMs. LLMPot aims to automate and optimize the creation of realistic honeypots with vendor-agnostic configurations, and for any control logic, aiming to eliminate the manual effort and specialized knowledge traditionally required in this domain. We conducted extensive experiments focusing on a wide array of parameters, demonstrating that our LLM-based approach can effectively create honeypot devices implementing different industrial protocols and diverse control logic.

• The paper presents LLMPot, a framework that automates honeypot creation by using LLMs to emulate industrial protocols and control logic.
• The methodology integrates iterative dataset generation and model finetuning, enabling realistic emulation of both network traffic and physical processes.
• Evaluation with metrics like BCA and RVA proves the framework’s scalability and effectiveness in enhancing cybersecurity for ICS environments.

LLMPot: Dynamically Configured LLM-Based Honeypot for Industrial Protocol and Physical Process Emulation

Introduction

Industrial Control Systems (ICS), which encompass technologies like Programmable Logic Controllers (PLCs), serve as the backbone for managing essential operations within industrial sectors, such as power generation, manufacturing, and water treatment facilities. The integration of advanced features in ICS raises their susceptibility to cyber threats, thereby highlighting the necessity for robust cybersecurity measures. Honeypots, which act as decoy targets, play a pivotal role in safeguarding ICS networks by attracting cyber threats and enabling security professionals to analyze attacks and develop countermeasures.

The deployment of honeypots in ICS environments, however, presents significant challenges. Accurate emulation of industrial protocols and device characteristics is essential to convincingly mimic the operational behavior of various systems. Additionally, emulating the control logic executed by PLCs is critical for capturing attacker traffic. Traditional honeypots often require extensive manual effort to replicate these characteristics accurately, limiting their adaptability and scalability.

In this context, the paper introduces LLMPot, a novel framework leveraging LLMs to automate honeypot creation within ICS networks. LLMPot aims to optimize the development of realistic honeypots with vendor-agnostic configurations while eliminating the manual expertise traditionally needed. The framework's primary objective is to emulate different industrial protocols and diverse control logic automatically.

Figure 1: High-level diagram of LLMPot. The aim of LLMPot is to be able to "copy" an industrial protocol and process running on a PLC port and "paste" it to an LLM: 1. A client that automatically probes the PLC and captures responses. 2. Captured traffic forms a training dataset. 3. Finetuning of the LLM using the dataset. 4. Generated LLM-based Honeypot with supportive components.

Methodology

LLMPot is designed to leverage LLMs for the dual purpose of emulating ICS network protocols and physical processes. The methodology incorporates the following key components:

• Dataset Generation: A client probes the PLC to capture network responses, which form the input for the LLM's training dataset. This process ensures the dataset reflects real-world interactions, enhancing honeypot realism.
• Finetuning LLMs: Pre-trained LLMs are adapted to emulate protocol-specific requests through continuous feedback and validation. The finetuning phase employs iterative dataset sizing to achieve optimal performance without overfitting.
• Emulating Physical Processes: The framework employs LLMs to emulate control logic within ICS, validating the ability to capture variable states across diverse processes effectively.

  Figure 2: Dataset generation and LLM finetuning process used in LLMPot.

Evaluation Metrics

LLMPot's performance is assessed using three metrics: Byte-to-byte Comparison Accuracy (BCA), Response Validity Accuracy (RVA), and Response Validity Accuracy - Epsilon (RVA-$\epsilon$). These metrics evaluate the accuracy and validity of the LLM's responses to ensure they resemble authentic device interactions.

Protocol and Process Emulation

The framework exhibits a high degree of generalizability, demonstrating the capability to emulate both Modbus and S7Comm protocols across different PLC configurations. The iterative dataset generation method markedly improves performance by reducing dataset size while maintaining precision.

For physical processes, LLMPot evaluates the model's ability to emulate various control logics associated with typical industrial scenarios like aircraft control and chemical processing. The exploratory experiments emphasize the LLM's proficiency in modeling discrete and continuous functions, thereby substantiating its emulation effectiveness.

Figure 3: The BCA and RVA per epoch of the byt5-small model when using different dataset sizes and protocols to finetune.

Honeypot Development and Implications

Operating on a robust infrastructure set up with Docker and Honeyd, the honeypot exhibits effective emulation of real network devices. Comprehensive interaction analysis using tools such as Nmap and Shodan has validated its resilience against network reconnaissance attempts.

The implications of LLMPot are extensive, offering a versatile and scalable solution to honeypot deployment in ICS networks that meets the evolving demands of cybersecurity. Its application can significantly mitigate risks of cyber threats targeting critical infrastructures.

Conclusion

LLMPot represents a significant advancement in the development and deployment of honeypots for ICS networks through the innovative application of LLMs. By automating protocol and process emulation, LLMPot enhances honeypot realism and scalability, reducing the manual effort typically required. This framework provides a robust platform for cybersecurity professionals to better safeguard ICS environments from emerging threats. As LLM technology continues to evolve, LLMPot stands poised to integrate further improvements and expand its applicability across various industrial domains.