Advanced version of Full decoy Honeypot cloud configured

Building a honeypot that tricks a experienced hacker is hard. Open-source honeypots can fool some apprentice hacker, but when we inspect it closely we can easily find it is fake due to generic service banners, static responses, unrealistic network latency, and lack of contextual background noise.

I wanted to do a project that aims to build an open-source Industrial Control System (ICS) deceptive environment a full decoy system a virtual environment that closely resembles a real operational technology (OT) network. Rather than replaying pre recorded data, the system will simulate a living industrial process with continuously changing Modbus register values, changing sensor telemetry, periodic PLC to HMI communication, and realistic network traffic generated by multiple virtual devices.

Using Python, Scapy, Docker, and Linux, the project will create a safe virtual ICS environment that allows people to observe attackeror hackers  behavior without exposing real industrial infrastructure. Every interaction with the honeypot will be logged, this can later be used to anlayse the techniques, protocol usage, methods of exploitation, and movement within the simulated network.

The main focus is the extension, the project is expanded beyond traditional ICS honeypots into a cloud-native deception platform. Since modern attacks increasingly target cloud identities, API keys, and misconfigured services rather than physical servers which are mostly guarded , the same principles can be applied to create realistic cloud decoys that simulate enterprise infrastructure while monitoring attacker behavior in cloud environments.