Talos：从双控制器 OT 蜜罐中提取攻击者情报
Stinging the Swarm: Extracting Attacker Intelligence from a Twin-Controller OT Honeypot
AI 导读
arXiv 论文提出 Talos，一个毫秒级判定每个语言模型智能体请求的工业控制器内联闸门，将被判定为敌意的智能体路由到与真实工控环境一致的镜像诱饵，使攻击无害化并提取情报。在 2,400 个自主攻击智能体（四层各 600 个）的测试中，任何层级都没有写操作抵达真实工控系统，且决策全部由模型驱动、无推理超时。闸门、镜像与测试框架以 Apache 2.0 开源并附合成设备族。
正文 · 原文
Abstract:Autonomous language-model agents can drive industrial controllers over fieldbus protocols, probing a plant at machine speed and in coordinated swarms. We present Talos, an inline gate that judges every agent request to a controller in milliseconds and routes agents it flags as hostile to a device-faithful decoy -- a mirror twin of the real plant -- where their attack continues harmlessly and is read for intelligence. We evaluate the full pipeline (detect -> quarantine -> mirror -> extract) against 2,400 autonomous attacker agents, 600 in each of four tiers that escalate the attacker's effort to stay hidden, from no concealment to an explicit non-disclosure rule and a trained cover story. No write reached the real plant in any tier: the gate denies the damage path and a device-level envelope check backstops it, while unmapped registers are denied without exception and the gate still permits safe-direction stop commands. Decisions are model-driven in every tier with no inference timeouts, closing a common objection to small on-device judges. Beyond blocking, the pipeline reads the attacker. We find a behavioral structure along two axes -- how persistently an agent attacks and how much it discloses -- and show that the system has a capture channel for three of the four resulting regions: hardened, silent attackers escalate most and are read on the mirror; compliant, talkative attackers volunteer their identity to a diagnostic form before they are ever quarantined; only the paranoid, low-yield region resists both. Attacker identity fields are self-authored cover stories, but involuntary tells -- the self-reported toolchain fingerprint and the attacker's own list of targeted registers -- accumulate across the swarm into a high-confidence profile drawn from agents under explicit orders to stay silent. The gate, mirror, and harness are released under Apache 2.0 with a synthetic device family.
| Comments: | 11 pages, 6 figures, 2 tables |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| ACM classes: | K.6.5; I.2.11 |
| Cite as: | arXiv:2611.13406 [cs.CR] |
| (or arXiv:2611.13406v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2611.13406 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: J.P Voltani [view email]
[v1]
Tue, 10 Nov 2026 00:38:48 UTC (17 KB)
来源：arXiv cs.AI · arxiv.org