Evaluating ICS Honeypot Attractiveness: The Role of Interaction Level, Network Type, and Geolocation

Honeypots are employed in Industrial Control Systems (ICSs) to detect and analyze attacker behavior, but their deployment involves trade-offs between realism, operational cost, and exposure environment. Despite increasing interest in ICS threat monitoring, there is limited empirical evidence on how deployment choices influence the effectiveness of ICS honeypots in attracting meaningful interactions. This work investigates the effect of interaction level, network type, and geographic location on the attractiveness of ICS honeypots. We deploy 16 honeypots, a mix of low- and high-interaction emulations and a physical PLC, across a corporate network and cloud networks in multiple geographic regions, and collect HTTP, S7Comm, and Modbus traffic over a three-month period. Analyzing multiple protocols allows us to capture differences in attacker behavior across web-based and ICS-specific traffic and to assess how protocol diversity influences the volume, complexity, and nature of observed interactions. To evaluate traffic nature, we fingerprint recurring Modbus and S7Comm interactions using protocol-specific features and associate them with known tools or actors. Our results show that, for ICS traffic, network type has the largest influence, while interaction level and geographic location have a limited impact. We also find that low-interaction honeypots capture traffic comparable to high-interaction setups, supporting their use for general threat intelligence collection. While most traffic consists of automated reconnaissance, filtering it reveals more complex activities, such as multi-stage campaigns, cross-environment scans, and device manipulation.