ICSLure: Multi-Domain Approaches in Security

• ICSLure is a domain-specific label defining diverse methodologies across code-intelligence attacks, industrial honeynet frameworks, and high-redshift intracluster light pipelines.
• In code intelligence, ICSLure refers to adversarial in-context learning lures that subtly bias large language model outputs through minimal and stealthy code edits.
• In industrial cybersecurity and astronomy, ICSLure supports realistic PLC honeynets and robust modeling pipelines to capture adversary behaviors and diffuse light characteristics.

ICSLure is a label that has been used in multiple unrelated research settings. In code-intelligence security, it denotes malicious in-context learning demonstration lures that bias code LLMs toward incorrect outputs; in industrial cybersecurity, it names a modular, very high interaction honeynet for PLC-based industrial control systems; and in high-redshift cluster studies it appears as shorthand for an intracluster-light analysis pipeline informed by JWST observations (Ge et al., 2024, Pironti et al., 4 Sep 2025, Joo et al., 3 Mar 2026). This suggests that ICSLure functions as a domain-specific label rather than a single unified framework.

1. Terminological scope

The principal usages of ICSLure in the supplied literature are distinct in object, method, and evaluation regime.

Usage of ICSLure	Domain	Source
Malicious ICL lure attacks based on adversarial demonstrations	Code intelligence security	(Ge et al., 2024)
Modular, very high interaction honeynet framework	PLC-based industrial control systems	(Pironti et al., 4 Sep 2025)
High-$z$ intracluster-light pipeline shorthand	Observational cosmology	(Joo et al., 3 Mar 2026)

The code-security usage is framed around the vulnerability of few-shot prompting pipelines, where demonstrations are selected and formatted as context for a model. The industrial-cybersecurity usage concerns a physically grounded honeynet that blends real PLC hardware with a simulated plant and a virtualized OT/IT network. The astrophysical usage concerns robust extraction of diffuse intracluster light from deep HST and JWST imaging.

A common misconception is to assume that the acronym “ICS” in all three cases refers to the same subject matter. It does not. In the honeynet paper, ICS means industrial control systems. In the intracluster-light study, “ICL” refers to intracluster light, and the details describe practical guidance for pipelines “such as ICSLure.” In the code-LLM synthesis, ICSLure is an attack-class label attached to malicious in-context learning content rather than the title of the underlying paper.

2. ICSLure in code intelligence: malicious in-context learning lures

In the code-intelligence setting, ICSLure is the attack class in which an attacker supplies bad ICL content $C_{\mathrm{adv}}$: curated demonstrations that look plausible but are constructed to bias $f_\theta$ toward incorrect outputs. The underlying model is an LLM $f_\theta$ operating on a fixed user query $x$ and a context $C$ of $k$ demonstrations, $C = \{(x_i, y_i)\}_{i=1}^k$, with prediction $\hat{y} = f_{\theta}(x; C)$. The attacker’s objective can be untargeted, maximizing a loss relative to the ground truth $y^*$, or targeted, driving the output toward a specific wrong answer $C_{\mathrm{adv}}$0 (Ge et al., 2024).

The threat model is explicitly tied to third-party ICL agencies or providers such as plugins, agents, or MSP services that recommend or inject demonstrations. The malicious agency may provide ICL content that is correct most of the time, but flips to bad content when triggers are detected, including specific identifiers or method names. The attacker can read queries and deliver or modify demonstrations, can interact with $C_{\mathrm{adv}}$1 via input-output queries, and typically has no parameter-level access to $C_{\mathrm{adv}}$2. Constraints are central: the query $C_{\mathrm{adv}}$3 is fixed, the attacker controls only $C_{\mathrm{adv}}$4, and the attack must respect context length, token budget, syntactic validity, and language-specific scoping and identifier rules.

Stealth is a defining property. Demonstrations must appear relevant and plausible; code edits should be minimal and natural, maintain syntactic validity, and retain surface-level semantic similarity. The demonstrations are often drawn from a repository and bounded by retrieval criteria, which makes the attack look like ordinary few-shot example selection rather than overt prompt injection. The paper’s positioning explicitly distinguishes this scenario from prompt injection, data poisoning in training, and jailbreaks. Prompt injection attacks the instruction layer, whereas ICSLure manipulates demonstrations; training-data poisoning requires control of training data, whereas ICSLure acts at inference time; jailbreaks target general dialogue safety constraints, whereas ICSLure targets task-specific code outputs.

3. DICE and BOOST: construction procedure, transfer, and empirical behavior

The construction procedure is called DICE in the synthesis and is stated to be equivalent to BOOST in the paper. It is a two-stage pipeline: Demonstration Selection and Bad ICL Construction, with a transferable variant that generalizes across multiple queries and can transfer to closed-source LLMs (Ge et al., 2024).

Demonstration Selection chooses a set $C_{\mathrm{adv}}$5 of size $C_{\mathrm{adv}}$6 from a repository $C_{\mathrm{adv}}$7 of code-answer pairs. Query code and candidate code are embedded with a pretrained code encoder such as UniXcoder or a CoCoSoD-derived encoder, and similarity is computed by

$C_{\mathrm{adv}}$8

The selection objective maximizes relevance and may incorporate diversity, ordering preferences, and adversarial potential. The top-$C_{\mathrm{adv}}$9 demonstrations are attached to their answers in conversation format to form the ICL skeleton.

Bad ICL Construction then minimally edits the selected demonstration code to form $f_\theta$0. Trigger detection can activate attack mode for specific tasks or identifiers. The procedure uses tree-sitter to parse demonstration code and extract local variables, excluding fields to avoid semantic conflicts and filtering out substitutes that collide with existing names. Substitute generation proceeds by masking a variable, asking the LLM or masked language prediction function for top-$f_\theta$1 candidate tokens, embedding the candidates and original variable, ranking them by cosine similarity, and keeping the top-$f_\theta$2 candidates to maintain plausibility. Greedy Mutation prioritizes edits using

$f_\theta$3

where $f_\theta$4 is the victim LLM and $f_\theta$5 is a task-appropriate confidence or utility. For classification, success is a label flip; for generation, success is defined as an average decrease of more than $f_\theta$6 in BLEU, METEOR, and ROUGE-L relative to the baseline. The transferable variant replaces single-query mutation with batched optimization over a query set $f_\theta$7, stopping when the demo-code embeddings converge below a threshold $f_\theta$8.

The evaluation covers code classification and code generation. Classification tasks are defect detection on Devign for C and clone detection on BigCloneBench for Java. Generation tasks are code summarization on CodeSearchNet for Java and Python, and code translation on CodeXGLUE for Java$f_\theta$9C#. Metrics for classification are Accuracy, F1, Attack Success Rate, and Query Time, with

$f_\theta$0

Generation is evaluated with BLEU, METEOR, ROUGE-L, BERTScore, and Avg_Drop, the average percentage decrease across BLEU, METEOR, and ROUGE-L. The targets are CodeLlama-7b-Instruct-hf and StarChat-16B, with transfer experiments on GPT-3.5-turbo-instruct and GPT-4-turbo; temperature is set to $f_\theta$1 and generation max tokens to $f_\theta$2.

The reported degradation is substantial. For defect detection, StarChat with 5 demos dropped ACC by $f_\theta$3 and reached ASR $f_\theta$4; CodeLlama with 5 demos dropped ACC by $f_\theta$5. For clone detection, StarChat with 5 demos dropped ACC by up to $f_\theta$6 with ASR approximately $f_\theta$7, and CodeLlama with 5 demos dropped ACC by $f_\theta$8. For summarization, Avg_Drop reached $f_\theta$9 on StarChat for Java with 5 demos and $x$0 on CodeLlama for Python with 3 demos. For translation, CodeLlama reached Avg_Drop up to $x$1 with 7 demos, while StarChat drops ranged about $x$2–$x$3 for 7 demos. Transfer to GPT-4 yielded Java summarization Avg_Drop approximately $x$4 with 3 demos and Python approximately $x$5; GPT-3.5 yielded approximately $x$6 for Java and $x$7 for Python.

The defense study evaluates ONION and STRIP. On StarChat defect detection, ONION reduced ASR from $x$8 to $x$9 at 1 demo, from $C$0 to $C$1 at 3 demos, and from $C$2 to $C$3 at 5 demos; STRIP showed similar behavior. The effectiveness decreased as the number of malicious demonstrations increased, which is consistent with the attack’s emphasis on stealthy edits and plausible retrieval. The synthesis further states that human evaluation found the edits more natural, similar, and relevant than MHM and CodeAttack, reinforcing the claim that minimal variable renaming and scoped local edits can evade simple filters.

4. ICSLure as a very high interaction honeynet for PLC-based industrial control systems

In industrial cybersecurity, ICSLure is a modular, very high interaction honeynet for PLC-based industrial control systems. It blends real hardware PLCs with physics-aware process simulation and a virtualized OT/IT network, and is designed to capture realistic adversary behavior at the cyber-physical boundary, where timing, protocol idiosyncrasies, and I/O determinism matter (Pironti et al., 4 Sep 2025).

The motivation is the expansion of Industry 4.0 and IIoT connectivity and the resulting attack surface. The paper frames malware families such as Stuxnet, BlackEnergy, Havex, Industroyer(2), Pipedream, and FrostyGoop as evidence that adversaries can move from IT into OT, discover ICS components, and manipulate physical processes. Software-only ICS honeypots are described as limited by shallow protocol stacks, missing timing behaviors and real PLC I/O semantics, lack of realistic ladder logic and register dynamics, and detectability by tools such as HoneyJudge, PLCScan, Nmap, and TIA Portal.

The system goal is “very high interaction,” defined as a level above high interaction by using real PLC hardware coupled to a physics-aware simulator that drives PLC I/O through actual analog and digital signals. Realism is achieved through a real Siemens SIMATIC S7-1200 (CPU 1211C) PLC with 12 I/O ports, a Raspberry Pi 3 Model B+ interface board, a Microchip MCP4811 DAC, and Philips UA741CN operational amplifiers configured non-inverting with gain approximately $C$4 to lift DAC output to $C$5–$C$6 V for PLC analog inputs. The virtualized side uses Proxmox VE as the type-1 hypervisor, an OPNsense VM as router, switch, and firewall, an Nginx reverse proxy on a Debian 12 container to forward and mirror PLC traffic, and a Windows 10 VM with Siemens TIA Portal and an exposed noVNC service on TCP 5900.

The exposed ICS services are PLC web admin on TCP 80, Modbus TCP on port 502, and S7/RFC1006 on port 102. The workstation exposes noVNC on TCP 5900 with password disabled to simulate frequent misconfigurations. The physical process is not a real plant: the PLC is placed behind transparent proxies inside virtual segments, and the field I/O terminates on an interface board and simulator rather than actuators. This safety isolation is a core design principle, along with modularity, Infrastructure-as-Code through Terraform, configuration management through Ansible, and comprehensive passive logging via transparent proxies, PCAP collection, and host/application monitoring.

The case study implements a wind farm process in Matlab/Simulink. Base wind speed is sourced live via the Open-Meteo Free Weather API at 50 m altitude and perturbed to emulate sensor noise. The PLC ladder logic is a 4-state Moore machine with guard functions $C$7 and $C$8: ParkBrake, Startup, Generating, and PitchBrake. Analog inputs encode anemometer wind speed and rotor angular velocity as 10-bit values converted to $C$9–$k$0 V, while digital outputs include parkBrake, pitchBrake, and generatorTrip. The simulator injects faults if component states exceed $k$1 of maximum allowed operating range.

The deployment was publicly exposed via a GARR academic network IP for 30 days. The environment was identified by Shodan and Censys as a genuine ICS component, and more than 2 GB of PCAP were captured. The observations include numerous automated scans and fingerprinting attempts, as well as targeted engagements: unauthorized CPU state change via web admin on port 80; Modbus TCP Write Multiple Coils attacks via Function Code 15 on port 502; unauthenticated read/write of memory and potential code upload/download via S7/RFC1006 on port 102; compromise of the engineering workstation through the unprotected noVNC service on port 5900; and deployment of FrostyGoop through remote workstation access and zip-based delivery, with the honeynet capturing the full attack lifecycle. The paper does not report quantitative detection rates or latencies, but it includes standard formulas for detection rate, precision, recall, F1-score, and mean time to detect for potential future analyses.

Compared with low- and medium-interaction honeypots such as Conpot, HoneyPLC, ICSpot, CryPLH, Mimepot, and HoneyICS, ICSLure is positioned as improving realism through real PLC hardware and dynamic I/O driven by a plant simulator. Compared with prior high-interaction honeynets, it emphasizes modularity and scalability through Terraform and Ansible, and it reduces cost and risk by coupling to a digital twin rather than extensive real hardware while preserving fidelity at the PLC I/O boundary.

5. ICSLure in high-$k$2 intracluster-light analysis

In the observational-cosmology usage, ICSLure appears as shorthand for a high-$k$3 intracluster-light pipeline informed by a JWST and HST study of XLSSC 122 at $k$4. The study establishes an end-to-end framework for detecting and characterizing intracluster light at $k$5, with systematic control, PSF-convolved multi-component Sérsic modeling, color-profile analysis, wavelet decomposition, and mass-light comparison (Joo et al., 3 Mar 2026).

The observational setup combines HST/WFC3 F814W, F105W, and F140W with JWST/NIRCam F090W, F200W, F277W, and F356W, all resampled to $k$6 arcsec pixel$k$7. The systematics mitigation is detailed: custom 1/f noise removal, NIRCam wisp removal using JWST Wisp Templates v3, large-scale flat-field control, per-exposure sky-gradient fitting with

$k$8

masking with source-specific radius $k$9 and expansion width $C = \{(x_i, y_i)\}_{i=1}^k$0, and background estimation outside the 1 Mpc ellipse in 20 azimuthal sectors. The measured limiting surface brightness reaches approximately $C = \{(x_i, y_i)\}_{i=1}^k$1 mag arcsec$C = \{(x_i, y_i)\}_{i=1}^k$2. For calibrated images in Jy arcsec$C = \{(x_i, y_i)\}_{i=1}^k$3,

$C = \{(x_i, y_i)\}_{i=1}^k$4

and for JWST images in MJy sr$C = \{(x_i, y_i)\}_{i=1}^k$5,

$C = \{(x_i, y_i)\}_{i=1}^k$6

The decomposition requires three Sérsic components—BCG core, BCG envelope, and ICL—and this is favored by Bayesian evidence in all seven bands. The model is

$C = \{(x_i, y_i)\}_{i=1}^k$7

with $C = \{(x_i, y_i)\}_{i=1}^k$8. Bayes factors from PyMultiNest give $C = \{(x_i, y_i)\}_{i=1}^k$9 values of $\hat{y} = f_{\theta}(x; C)$0 in F814W, $\hat{y} = f_{\theta}(x; C)$1 in F105W, $\hat{y} = f_{\theta}(x; C)$2 in F140W, $\hat{y} = f_{\theta}(x; C)$3 in F090W, $\hat{y} = f_{\theta}(x; C)$4 in F200W, $\hat{y} = f_{\theta}(x; C)$5 in F277W, and $\hat{y} = f_{\theta}(x; C)$6 in F356W, indicating a strong preference for three components. The fitted indices are stable across bands: core $\hat{y} = f_{\theta}(x; C)$7, envelope $\hat{y} = f_{\theta}(x; C)$8, and ICL $\hat{y} = f_{\theta}(x; C)$9.

The color profiles beyond approximately 10 kpc are described as remarkably flat within uncertainties, implying minimal radial gradients in age and metallicity across the BCG envelope and ICL. The ICL fraction is defined within the measured surface-brightness support as

$y^*$0

with no extrapolation beyond $y^*$1.

Filter	$y^*$2	Radius
F814W	$y^*$3	21.9 kpc
F105W	$y^*$4	68.5 kpc
F140W	$y^*$5	177.6 kpc
F090W	$y^*$6	267.2 kpc
F200W	$y^*$7	319.4 kpc
F277W	$y^*$8	460.7 kpc
F356W	$y^*$9	557.4 kpc

The median across the seven bands is approximately $C_{\mathrm{adv}}$00, reported as $C_{\mathrm{adv}}$01 in the summary. The fraction peaks near rest-frame $C_{\mathrm{adv}}$02–$C_{\mathrm{adv}}$03 Å, closest to F140W, and is comparatively lower blueward of approximately $C_{\mathrm{adv}}$04 Å rest. A southern ICL excess remains after subtracting the global 2D Sérsic ICL component; wavelet quantification with DAWIS indicates that the excess accounts for approximately $C_{\mathrm{adv}}$05 of the total ICL flux in the three reddest JWST bands. The BCG+ICL light strongly traces the strong-lensing mass within approximately 100 kpc, with weighted overlap coefficient approximately $C_{\mathrm{adv}}$06 and mean modified Hausdorff distance approximately $C_{\mathrm{adv}}$07 kpc.

The practical guidance for pipelines “such as ICSLure” follows directly from these results. It recommends SExtractor-based segmentation with mask expansion, explicit modeling rather than masking of the BCG, PSFs from TinyTim and WebbPSF, three-component PSF-convolved Sérsic fits with priors informed by cross-band stability, wavelet decomposition for asymmetric substructure, and preference for rest-optical bands sampling roughly $C_{\mathrm{adv}}$08–$C_{\mathrm{adv}}$09 Å at $C_{\mathrm{adv}}$10. F140W is singled out as the best sampler of the $C_{\mathrm{adv}}$11–$C_{\mathrm{adv}}$12 Å peak, while F200W and F277W extend diffuse-light detection to larger radii. Rest-UV bands such as F814W and F090W are explicitly described as poor choices for tracing ICL growth because the diffuse light is faint there.

6. Related extensions, limitations, and recurrent misconceptions

The term has also been used analogically in Android ICC security. The paper "Security Code Smells in Android ICC" defines twelve ICC smells, including Unauthorized Intent, Unprotected Broadcast Receiver, Implicit PendingIntent, Custom Scheme Channel, and Broken Service Permission, and a later synthesis describes an “ICSLure-like” methodology that turns such static detections into dynamic probes (Gadient et al., 2018). In that usage, ICSLure is not a formal system name in the paper itself; rather, it denotes an attack-testing workflow that begins with static triage, proceeds to synthesized lures, performs permission-boundary tests, and evaluates results through explicit exploitability oracles.

Several misconceptions recur across the different usages. In the code-LLM literature, a frequent confusion is to treat ICSLure as prompt injection; the source material distinguishes it from prompt injection because it manipulates demonstrations rather than the instruction layer. In the industrial-cybersecurity literature, another confusion is to equate very high interaction with an unsafe live plant; the framework is explicitly isolated, with field signals terminating at an interface board and simulator rather than physical actuators. In the intracluster-light literature, an equally common oversimplification is to reduce ICL detection to deeper imaging alone; the study instead emphasizes systematics control, PSF handling, conservative sky estimation, and band selection as necessary conditions for robust measurement.

The limitations are domain-specific. For code-intelligence attacks, Greedy Mutation and iterative querying can require minutes to hours per instance, and strict black-box settings reduce ASR because DICE relies on embeddings and masked-token predictions. For the honeynet, real PLC hardware and I/O wiring increase cost and complexity, the current case emphasizes web, S7, and Modbus rather than the full ICS protocol space, and university IP space may deter some adversaries. For the high-$C_{\mathrm{adv}}$13 intracluster-light pipeline, the conclusions are tied to XLSSC 122 and to the achieved control of 1/f noise, wisps, and PSF mismatch.

Taken together, the three main usages of ICSLure represent distinct technical programs: an inference-time demonstration attack surface in code intelligence, a physically grounded OT deception platform, and a high-$C_{\mathrm{adv}}$14 intracluster-light analysis workflow. Their coexistence under one label is terminological rather than conceptual, and precise interpretation depends entirely on disciplinary context.