Honeypots have proven to be an effective defense method for industrial control systems (ICSs). However, as attacker skills become more sophisticated, it becomes increasingly difficult to develop honeypots that can effectively recognize and respond to such attacks. In this article, we propose a neural network-based ICS honeypot scheme named NeuPot that improves security from two aspects: 1) honeypot interaction; and 2) cyber threats detection capability. NeuPot can respond to attacker requests depending on a specific industrial scenario without constant communication with the ICS and detect malicious traffic. To create this honeypot scheme, a new seq2seq time-series forecast model guided by Huber loss is designed to simulate the long-term changes in actual ICS physical processes. Second, a Modbus honeypot framework is created to react to changes in these ICS physical processes in their interactions with attackers and to capture various cyber threats against the ICS. Further, a novel loss function for industrial protocol-level malicious traffic detection is devised to identify known and unknown threats. According to our experiments, the proposed honeypot scheme is highly effective and outperforms state-of-the-art schemes in terms of interactivity and in detecting cyber threats.

Industrial sensor systems are increasingly vulnerable to both physical anomalies and cyberattacks, while their collected time series typically present complex periodic and non-stationary characteristics, along with dynamic spatial dependencies among sensors. To address these issues, this paper proposes a dual-branch graph learning framework with frequency gating for simultaneous industrial sensor anomaly and cyberattack detection. The model first divides the input time series into multiple patches and decomposes each patch into periodic and non-stationary components via frequency analysis. Two graph isomorphism network branches, namely periodic GIN (P-GIN) and non-stationary GIN (NS-GIN), are designed to model the spatial dependencies of the two components separately, where the graph structure is adaptively learned using a Gaussian kernel-based mechanism. Furthermore, a frequency gating module is introduced in the non-stationary branch to enhance the representation of abnormal and attack-related features. Hierarchical temporal encoding is performed via intra-patch attention and inter-patch attention to capture both local and long-range temporal dependencies. Extensive experimental results on real-world industrial sensor datasets demonstrate that the proposed method achieves superior performance compared with state-of-the-art methods in both anomaly detection and cyberattack detection tasks.