Adaptive MQTT Honeypots for IIoT Security Using Extended Mealy Machines
摘要
The existing MQTT honeypots often lack scalability, semantic fidelity, and data-flow awareness, thereby limiting interaction realism and detection depth. To address these limitations, we propose an Extended Finite State Machine (EFSM) based MQTT honeypot that enforces guarded control and data-flow transitions while integrating adaptive deception to ensure protocol compliant realism. Unlike conventional honeypots, the EFSM based design captures field level dependencies through variable updates and guard conditions, enabling stateful, context aware emulation. In an 80 day Internet deployment, the proposed system achieved 23% more connections, \(1.5\times \) higher topic diversity, and 40% greater detection coverage than RIoTPot and ThingPot, successfully detecting QoS abuse, Last-Will manipulation, and replay attacks. These results establish EFSM-based protocol modeling as a compact, extensible foundation for next-generation IIoT honeypots.