Multi-stage attack detection and signature generation with ICS honeypots
Honeycomb: creating intrusion detection signatures using honeypots