LLMPot (momalab)¶
Status: Informative · evaluation proof
Upstream: https://github.com/momalab/LLMPot · commit 9568b5ffe6f3626c70078e53eacaac4a9fcf1b9e
Paper: arXiv:2405.05999 · HF sample: cv43/llmpot
LLM-based ICS honeypot (ByT5 Modbus/S7 emulation + WAGO PLC web decoy).
What this decoy is¶
LLM-assisted industrial/protocol honeypot; UHBS graded Modbus/S7comm/HTTP surfaces.
Protocol survey¶
| Surface | UHBS plugin? | Graded? | Quick | Full |
|---|---|---|---|---|
| Modbus TCP | yes | yes (HF CPU lab adapter) | 38.48 / F | 55.24 / D |
| S7comm | yes | yes (Snap7 NoLogic gold) | 45.53 / F | 65.41 / D |
| HTTP WAGO WBM | yes | yes | 45.84 / F | 63.11 / D |
Honeyd WAGO fingerprint (docker/) |
partial | no | — | — |
Named product is evaluation proof only — not a UHBS endorsement.
For CTI analysts¶
- ICS + HTTP mix supports intel on both OT scanners and web probes against the same lure family.
Primary signals: Modbus/S7/HTTP interactions per graded listeners.
For blue teams / detection engineering¶
- Isolate OT protocol listeners from real plants; LLM features may need egress — constrain tightly.
Trust & limitations¶
- Evaluation proof under UHBS 4.2.2 — not a certification or endorsement.
- Prefer full/ over quick/ for decisions.
- Reading guide: READING-UHQS.md.