Honeypots act as a powerful security mechanism that diverts malicious actors from production systems while providing valuable insights into adversarial behaviors. Yet, the absence of a high-quality honeypot dataset has long impeded robust benchmarking and restricted the employment of advanced AI-driven honeypot defenses. In this work, we address these limitations by constructing a comprehensive shell request-response dataset from Cowrie honeypots. Such a dataset not only facilitates thorough, in-depth honeypot evaluations but also furnishes an essential research foundation for AI-based honeypot development. We analyzed tens of thousands of shell sessions collected during two distinct time frames. (2021-2022 and 2024). By systematically examining command-level usage, session behaviors, and tactics under the MITRE ATT&CK framework, we identified major shifts in adversary techniques, including mounting command complexity, shorter but more targeted infiltration sessions, a more balanced and diverse range of attack methods, and an intensified focus on circumventing defensive measures. These observations emphasize the evolving nature of shell-based intrusions and underscore the necessity for ongoing experimentation and iterative improvements in honeypot design. Through the collection and analysis of this dataset, our work highlights emerging threats in shell defense while also establishing a robust data foundation for the future development of AI-driven honeypots.

As a decoy for hackers, honeypots have been proved to be a very valuable tool for collecting real data. However, due to closed source and vendor-specific firmware, there are significant limitations in cost for researchers to design an easy-to-use and high-interaction honeypot for industrial control systems (ICSs). To solve this problem, it’s necessary to find a cost-effective solution. In this paper, we propose a novel honeypot architecture termed HoneyVP to support a semi-virtual and semi-physical honeypot design and implementation to enable high cost performance. Specially, we first analyze cyber-attacks on ICS devices in view of different interaction levels. Then, in order to deal with these attacks, our HoneyVP architecture clearly defines three basic independent and cooperative components, namely, the virtual component, the physical component, and the coordinator. Finally, a local-remote cooperative ICS honeypot system is implemented to validate its feasibility and effectiveness. Our experimental results show the advantages of using the proposed architecture compared with the previous honeypot solutions. HoneyVP provides a cost-effective solution for ICS security researchers, making ICS honeypots more attractive and making it possible to capture physical interactions.

Programmable logic controller (PLC) is an industrial digital computer that has been ruggedized and adapted for the control of manufacturing processes, such as automobile manufacture, or gas pipelines, or power generation. Due to closed source and vendor-specific proprietary firmware, it is difficult to develop a scalable high-interaction honeypot for PLCs. In this paper, we present and discuss a new scalable high-interaction PLC honeypot framework based on physical devices. This framework aims to solve the problems of existing physical honeypots while providing the advantages of virtual honeypots. Specially, we first introduce the main gap existing in virtual PLC honeypots. Then, we present a cheap, flexible, and large-scale-deployment solution for physical PLC honeypots according to the concrete problems. Finally, we evaluated our framework based on Siemens S7-300 PLCs. Our experiment shows that physical PLC honeypots have the absolute advantage in interaction capability and it is entirely feasible to extend the deployment scope with low response delay.