# A Generative Model Based Honeypot for Industrial OPC UA Communication

arXiv: https://arxiv.org/abs/2410.21574 · HTML: https://mlsanity.com/paper/2410.21574/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 12 references that are in the map.
- First posted on arXiv 28 Oct 2024.

## Builds on (most cited first, 5 of 5)

- [Evaluation of deep learning models for multi-step ahead time series prediction](https://mlsanity.com/paper/2103.14250/) (2021)
- [A Survey on Industrial Control System Testbeds and Datasets for Security Research](https://mlsanity.com/paper/2102.05631/) (2021)
- [A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems](https://mlsanity.com/paper/2108.02287/) (2021)
- [Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures](https://mlsanity.com/paper/2109.03945/) (2021)
- [An OPC UA-based industrial Big Data architecture](https://mlsanity.com/paper/2306.01418/) (2023)

## Built on by (most cited first, 1 of 1)

- [Federated Learning for Multivariate Time Series Anomaly Detection in Industrial Automation](https://mlsanity.com/paper/2605.27486/) (2026)

## Abstract (arXiv)

Industrial Operational Technology (OT) systems are increasingly targeted by cyber-attacks due to their integration with Information Technology (IT) systems in the Industry 4.0 era. Besides intrusion detection systems, honeypots can effectively detect these attacks. However, creating realistic honeypots for brownfield systems is particularly challenging. This paper introduces a generative model-based honeypot designed to mimic industrial OPC UA communication. Utilizing a Long ShortTerm Memory (LSTM) network, the honeypot learns the characteristics of a highly dynamic mechatronic system from recorded state space trajectories. Our contributions are twofold: first, we present a proof-of concept for a honeypot based on generative machine-learning models, and second, we publish a dataset for a cyclic industrial process. The results demonstrate that a generative model-based honeypot can feasibly replicate a cyclic industrial process via OPC UA communication. In the short-term, the generative model indicates a stable and plausible trajectory generation, while deviations occur over extended periods. The proposed honeypot implementation operates efficiently on constrained hardware, requiring low computational resources. Future work will focus on improving model accuracy, interaction capabilities, and extending the dataset for broader applications.