# Tailoring polarisation of attosecond pulses via co-rotating bicircular laser
fields

Rambabu Rajpoot ID<EMAIL_ADDRESS>Department of Physics, Birla
Institute of Technology and Science - Pilani, Rajasthan, 333031, India.  Amol
R. Holkundkar ID<EMAIL_ADDRESS>Department of Physics, Birla Institute of
Technology and Science - Pilani, Rajasthan, 333031, India.  Navdeep Rana
Department of Physics, Indian Institute of Technology Bombay, Powai, Mumbai,
400076, India.  Gopal Dixit  Department of Physics, Indian Institute of
Technology Bombay, Powai, Mumbai, 400076, India.

###### Abstract

The present work introduces a robust way to generate attosecond pulses with
tunable ellipticity via high-order harmonic generation by co-rotating
$\omega-2\omega$ bicircular laser fields. The total electric field of the
laser fields exhibits an absence of rotational symmetry, which leads to the
generation of high harmonics of the same helicity across a broad range of
spectral bandwidth. High-harmonics with the same helicity offer the
opportunity to synthesize attosecond pulses with tunable ellipticity. The
polarisation properties of the generated harmonics are robust against the
variations in driving fields’ parameters, such as wavelength, intensity ratio,
and the sub-cycle phase between $\omega-2\omega$ fields. Our work opens an
avenue to study chiral-sensitive light-matter ultrafast processes on their
intrinsic timescale.

##  I Introduction

High-harmonic generation (HHG) is one of the non-perturbative nonlinear
processes of laser-matter interaction. HHG has been intensively used for a
tabletop coherent light source in extreme ultraviolet and soft x-ray energy
regimes with attosecond temporal resolution [1]. HHG in a gaseous medium
proceeds via a three-step process [2, 3], wherein an intense laser pulse
librates an electron via tunnel ionisation as a first step. The liberated
electron gains energy in the presence of driving laser as it propagates in the
continuum and, eventually, is driven back to recollide with the parent ion.
The kinetic energy acquired by the electron is emitted in the form of higher-
order harmonics of the driving laser field. HHG not only plays a paramount
role in producing attosecond pulses, but also offers a wide array of
applications by unraveling ultrafast electron dynamics in matter with atomic-
scale spatialtemporal resolutions [4, 5, 6, 7, 8, 9, 10].

Owing to the rapid development on both the theoretical and experimental
fronts, researchers have focused on controlling the polarization of the
emitted harmonics. Usually, the polarization of the emitted harmonics is
controlled by utilizing various forms of the counter-rotating $\omega-2\omega$
bicircular fields configuration, such as fields having different intensity
ratios, relative phase, and ellipticities [11, 12, 13, 14, 15, 16, 17, 18, 19,
20], non-collinear mixing of combining pulses [21, 22], adding a seed pulse
[23], as well as utilizing the plasmonic field enhancement [24], to name a
few. However, due to the three-fold symmetry restriction enforced by the
counter-rotating $\omega-2\omega$ fields, harmonics with alternating helicity
are generated. Such circularly polarized harmonics with alternating helicity
could generate linearly polarized attosecond pulses with each subsequent pulse
rotated by 120∘ in space [25]. Thus, it is crucial to desire harmonics of the
same helicity across a range of spectral bandwidths to produce attosecond
pulse with tunable ellipticity.

In this work, we introduce a robust scheme to generate attosecond pulse with
tunable ellipticity using co-rotating $\omega-2\omega$ circularly polarized
fields. In the following, we will demonstrate that the harmonics with the same
helicity are produced owing to the absence of rotational symmetry in the
driving co-rotating $\omega-2\omega$ bicircular fields. The robustness of our
scheme is tested with respect to the variations in the driving fields’
parameters. It is found that highly elliptical attosecond pulse can be
generated as the scheme is insensitive to any variations in the parameters.
The generated attosecond pulses with circular or elliptical polarization are
desirable to probe various chiral-sensitive light-matter phenomena [26, 27,
28, 29, 30, 31, 32]. Recently, Lu and co-workers have applied corotating
bicircular field configurations with 1:3 ratio to discuss the role of
Coriolis-force effect in the generation of high harmonics [33]. Moreover, the
superiority of the molecular target over atomic in the context of corotating
bicircular fields setup is discussed in Ref. [34]. Solids and plasma targets,
apart from gaseous systems, have also attracted attentions for HHG via co-
rotating driving fields [35, 36, 37].

The paper is organized as follows. Details of the numerical methods are
discussed in Sec. II, followed by the results and discussion in Sec. III. The
concluding remarks and future directions are discussed in Sec. IV.

##  II Numerical Methods

Figure 1: High-harmonic spectrum of helium driven by co-rotating
$\omega-2\omega$ fields. $D_{+}$ harmonic component (blue line) is co-rotating
with the $\omega$ field, whereas the red line represents the counter-rotating
$D_{-}$ harmonic component.. Inset shows Lissajous figure corresponding to the
total co-rotating $\omega-2\omega$ electric fields for one cycle of
$\omega_{1}$ field. $\lambda_{1}$ = 1064 nm, $I_{1}=I_{2}=5\times 10^{13}$
W/cm2, and $\phi=0^{\circ}$ are used to simulate the spectrum.

Time-dependent Schrödinger equation in two-dimensions, within single-active-
electron approximation, for helium is numerically solved as discussed in Refs.
[16, 38]. The harmonic spectrum is obtained by performing the Fourier
transform of the dipole acceleration as

$S_{\kappa}(\Omega)=\Big{|}\frac{1}{\sqrt{2\pi}}\int a_{\kappa}(t)e^{-i\Omega
t}dt\Big{|}^{2}=\big{|}a_{\kappa}(\Omega)\big{|}^{2},$ (1)

where $\kappa$ stands for the $x$ or $y$ components of the time-dependent
dipole acceleration. To describe the polarization of the harmonics, the
intensity of the left- and right-rotating components is obtained as
$D_{\pm}=\big{|}a_{\pm}(\Omega)\big{|}^{2}$ with
$a_{\pm}(\Omega)=[a_{x}(\Omega)\pm ia_{y}(\Omega)]/\sqrt{2}$. Ellipticity of
the emitted harmonics is calculated using

$\epsilon=\frac{|a_{+}(\Omega)|-|a_{-}(\Omega)|}{|a_{+}(\Omega)|+|a_{-}(\Omega)|}.$
(2)

The parameter $\epsilon$ varies in the interval from $-1$ to $+1$, and the
sign of $\epsilon$ defines the helicity of the harmonics. The harmonics
rotating in a counter-clockwise direction have positive helicity while those
rotating in a clockwise direction have negative helicity [39, 40].

The temporal profile of an attosecond pulse is constructed by filtering the
desired frequency range with an appropriate window function $w(\Omega)$ and
then performing an inverse Fourier transform as [41]:

$\mathcal{E}_{\kappa}(t)=\frac{1}{\sqrt{2\pi}}\int
a_{\kappa}(\Omega)w(\Omega)e^{i\Omega t}d\Omega.$ (3)

Here, $w(\Omega)=\Theta(\Omega-\Omega_{1})\Theta(\Omega_{2}-\Omega)$, wherein
$\Omega_{1}\leq\Omega\leq\Omega_{2}$ is the frequency range to be filtered,
and $\Theta(x)$ is standard step function.

The total electric field corresponding to the $\omega-2\omega$ co-rotating
configuration is written as

$\begin{split}\mathbf{E}(t)=f(t)\big{\\{}&E_{1}\
[\cos(\omega_{1}t)\mathbf{\hat{e}}_{x}+\sin(\omega_{1}t)\mathbf{\hat{e}}_{y}]+\\\
&E_{2}\
[\cos(\omega_{2}t+\phi)\mathbf{\hat{e}}_{x}+\sin(\omega_{2}t+\phi)\mathbf{\hat{e}}_{y}]\big{\\}},\end{split}$
(4)

where $\omega_{j}$ and $E_{j}$ are the frequency and the electric field
amplitude of the $j^{\textrm{th}}$ component of the bicircular field,
respectively. $\phi$ defines the sub-cycle phase between the two fields. The
temporal pulse envelope $f(t)=\sin^{2}(\pi t/\tau)$ with total duration
$\tau=5T_{1}$, where $T_{1}=2\pi/\omega_{1}$ is the period of the fundamental
field.

We have considered the spatial simulation domain of $\pm 150$ a.u. along both
$x$ and $y$ directions. The value of parameter $r_{\text{abs}}=\pm 142$ a.u.
is considered. The spatial step $\Delta x=\Delta y\approx 0.29$ a.u. is used
and the simulation time step $\Delta t=0.01$ a.u. is considered, which is well
within the criteria $\Delta t\lesssim 0.5(\Delta x)^{2}$. The convergence is
tested with respect to the spatial grid as well as space and time steps. Our
simulation utilizes widely used Armadillo library for linear algebra purpose
[42].

In the following sections, we discuss the harmonic generation by co-rotating
bicircular laser pulses and the production of highly elliptically polarized
attosecond pulses.

##  III Results and Discussions

Figure 2: Same as Fig. 1 with different wavelengths, and intensity ratios. The
wavelength is considered $1064$ nm in (a-b) and $1200$ nm in (c-d). Here,
value $1$ corresponds to the intensity $5\times 10^{13}$ W/cm2.

The harmonic spectra of helium driven by co-rotating $\omega-2\omega$ fields
is presented in Fig. 1. Absence of the dynamical rotational symmetry of the
total electric field results in the generation of even and odd-order harmonics
with a regular plateau structure as evident from the figure. Additionally, the
harmonic component co-rotating with the driving field has higher contrast,
dominates in the cutoff region. The present observations are consistent with
the propensity rules as discussed in Ref.[ [43]]. This is in contrast with
counter-rotating $\omega-2\omega$ configuration, which results in harmonic
doublets with alternating helicity.

Before we discuss the generation of attosecond pulses with tunable ellipticity
from the spectrum shown in Fig. 1, let us explore the robustness of the
features in the spectrum with respect to various laser parameters. Figure 2
presents harmonic spectra corresponding to co-rotating $\omega-2\omega$
configuration having different fundamental wavelengths and intensity ratios.
The overall nature of the spectrum remains insensitive with respect to the
changes in the intensity ratio as the ratio is tuned from 1:1 to 1:1.25 and
1.25:1, as evident from Figs. 2(a) and 2(b), respectively. A similar
observation can be made when the wavelength is increased from 1064 nm to 1200
nm with the same intensity ratios [see Figs. 2(c) and 2(d)]. Thus, the higher
yield of the co-rotating harmonic component in blue is insensitive with
respect to the variations in the wavelength as well as intensity ratio of the
co-rotating fields. In all cases, the subcycle phase between $\omega-2\omega$
fields, $\phi$, is zero. At this juncture, it is natural to envision how
different values of $\phi$ affect the nature of the harmonic spectra discussed
so far.

Figure 3: Sensitivity of the harmonic spectra with respect to the sub-cycle
phase, $\phi$, between $\omega-2\omega$ fields. (a) $30^{\circ}$, (b)
$45^{\circ}$, (c) $60^{\circ}$, and (d) $90^{\circ}$. Insets show Lissajous
figures corresponding to co-rotating driving fields (solid purple line) with
the Lissajous figure for $\phi=0^{\circ}$ in a black dotted line for
comparison purposes. $\lambda_{1}$ = 1200 nm, and $I_{1}=I_{2}=5\times
10^{13}$ W/cm2 are used to simulate the spectra.

Figure 3 presents harmonic spectra for different values of $\phi$ for 1200 nm
wavelength of $\omega$-field with 1:1 intensity ratio. As the value of $\phi$
is tuned from $\phi=0^{\circ}$ to $\phi=30^{\circ}$, spectrum shown in Fig.
3(a) displays high contrast of the $D_{+}$ harmonic component, co-rotating
with the driving field, compared to the counter-rotating $D_{-}$ harmonic
component in the cutoff region. The insensitivity of the features of the
harmonic spectra can be understood by analysing the Lissajous figure. The
orientation of the Lissajous figure rotates by changing $\phi$ value, but
dynamical rotational symmetry is still absent, as visible from the inset. As a
result, the polarization and intensity of the emitted harmonics remain
unaffected for different values of $\phi$, as evident from the spectra shown
in Figs. 3(b) - 3(d).

We have also simulated the harmonic spectra when the helicity of the co-
rotating driving fields is reversed. In this case, the co-rotating harmonic
component dominates in the cutoff region regardless of the rotation direction
of the driving field as can be seen in Fig. 4. This offers the possibility of
generating attosecond pulses with desired handedness by simply changing the
rotation direction of the driving laser pulses.

From the analysis of Figs. 1 \- 3, it is established that the essential
features of the harmonic spectra, such as domination of the co-rotating
$D_{+}$ component, are robust with respect to the variations in the laser
parameters. This eliminates the need for precise adjustments of the intensity
ratio or the relative phase between the driving fields or a specific choice of
wavelength. Thus, co-rotating $\omega-2\omega$ scheme can be utilized to
synthesize attosecond pulse with controlled polarization.

To illustrate the feasibility of generating attosecond pulses with tunable
polarization via HHG driven by co-rotating $\omega-2\omega$ fields
configuration, let us focus on the harmonic spectra in the energy range
$44-51$ eV. Figure 5 shows the temporal profile of the synthesized attosecond
pulse with its $x$-component, $y$-component and the Lissajous figure of the
total electric field. The pulse shown in Fig. 5(a) has ellipticity as high as
$0.88$ with $\sim 630$ attoseconds pulse duration. This elliptical pulse is
synthesized by superposing the harmonics in the energy range $44-51$ eV from
the spectra shown in Fig. 1. The high ellipticity is a direct consequence of
unequal intensities of the two co- and counter-rotating harmonic components,
i.e., $D_{+}$ and $D_{-}$. In contrast to the co-rotating driving fields, if
one considers the counter-rotating driving fields to generate high-harmonics,
the resultant attosecond pulse exhibits ellipticity as low as $\sim 0.13$ [see
Fig. 6]. Thus, co-rotating $\omega-2\omega$ bicircular fields is a potential
way to generate highly elliptical attosecond pulses.

Figure 4: Same as Fig. 2(b) except the rotation direction of combining fields
is reversed. This implies that the $D_{-}$ harmonic component represented by
the red line is now co-rotating with the driving field, while the blue line
representing the counter-rotating $D_{+}$ harmonic component. Figure 5:
Temporal profile of the synthesized attosecond pulse (blue line) with its $x$
component (magenta line), $y$ component (yellow line), and Lissajous figure
(red line) of the total electric field. Different attosecond pulses are
generated by superposing the harmonics near the cutoff region of the harmonic
spectra presented in the following figures: (a) Fig. 1, (b) Fig. 2(a), (c)
Fig. 2(b), and (d) Fig. 2(d). The synthesized pulses have pulse duration $\sim
550-600$ attoseconds, and ellipticity $\sim 0.77-0.88$.  Figure 6: Temporal
profile of synthesized attosecond pulses using counter-rotating
$\omega-2\omega$ driving fields. All other parameters are similar to those
used in Fig. 5(a). The synthesized attosecond pulses have ellipticity $\sim
0.13$.

To demonstrate the robustness and universality, we have also synthesized
pulses from the spectra shown in Figs. 2(a), 2(b), and 2(d); and the
corresponding attosecond pulses are displayed in Figs. 5(b) - 5(d),
respectively. The filtered harmonic window is considered near the cutoff
region of the respective harmonic spectrum. In all cases, the range of the
pulse duration and the ellipticity of the synthesized pulses are $\sim
550-600$ attoseconds and $\sim 0.77-0.88$, respectively. As expected from the
harmonic spectra, the helicity of the generated attosecond pulses is same as
the driving laser field. The high ellipticity of the synthesized attosecond
pulses proves the potential of the co-rotating $\omega-2\omega$ fields scheme.
Moreover, the absence of rotational symmetry in the co-rotating field
configuration translates into the robustness of the generated HHG spectra,
wherein small changes in the parameters of the driving fields leave the
spectra unaltered.

##  IV Summary and Conclusions

In summary, we have successfully demonstrated the generation of attosecond
pulses with tunable ellipticity via HHG driven by co-rotating $\omega-2\omega$
bicircular fields. The absence of the dynamical rotational symmetry in the co-
rotating $\omega-2\omega$ fields translates into the generation of the
harmonics with same helicity, which leads to elliptically polarised attosecond
pulses. It is found that the essential features of the generated harmonics,
via co-rotating $\omega-2\omega$ fields configuration, remain insensitive
against variations in laser parameters, such as fundamental driving
wavelength, intensity ratio, and the subcycle phase between two fields.
Moreover, the effect of the focal averaging is expected to negligible as the
attosecond pulses are synthesised using harmonics in near-cutoff region [33].
Thus, it avoids the need for precise adjustments of laser parameters from the
experimental perspective. Moreover, the reliance of the polarization
properties of the harmonics on driving fields’ parameters provides
opportunities to shape the polarization of the generated attosecond pulses.
The generated chiral attosecond pulses can be employed to study chiral-
sensitive dynamics on its intrinsic timescales [26, 27, 28, 29, 30].
Furthermore, our work can extend to various scenarios, such as current-
carrying molecular states, which can further increase the ellipticity of the
pulse [44, 45] or different pulse shaping techniques to extend the harmonic
cutoffs [46, 47, 48].

## Acknowledgments

A. R. H. acknowledges support from Science and Engineering Research Board
(SERB) India (CRG/2020/001020). G. D. acknowledges support from SERB India
(Project No. MTR/2021/000138).

## References

  * Midorikawa [2022] K. Midorikawa, Nat. Photon. 16, 267 (2022).
  * Schafer  _et al._ [1993] K. J. Schafer, B. Yang, L. F. DiMauro, and K. C. Kulander, Phys. Rev. Lett. 70, 1599 (1993).
  * Corkum [1993] P. B. Corkum, Phys. Rev. Lett. 71, 1994 (1993).
  * Krausz and Ivanov [2009] F. Krausz and M. Ivanov, Rev. Mod. Phys. 81, 163 (2009).
  * Corkum and Krausz [2007] P. B. Corkum and F. Krausz, Nat. Phys. 3, 381 (2007).
  * Chini  _et al._ [2014] M. Chini, K. Zhao, and Z. Chang, Nat. Photon. 8, 178 (2014).
  * Baykusheva  _et al._ [2016] D. Baykusheva, M. S. Ahsan, N. Lin, and H. J. Wörner, Phys. Rev. Lett. 116, 123001 (2016).
  * Reich and Madsen [2016] D. M. Reich and L. B. Madsen, Phys. Rev. Lett. 117, 133902 (2016).
  * Bredtmann  _et al._ [2014] T. Bredtmann, M. Ivanov, and G. Dixit, Nat. Commun. 5, 5589 (2014).
  * Dixit  _et al._ [2012] G. Dixit, O. Vendrell, and R. Santra, Proc. Natl. Acad. Sci. U.S.A. 109, 11636 (2012).
  * Neufeld and Cohen [2018] O. Neufeld and O. Cohen, Phys. Rev. Lett. 120, 133206 (2018).
  * Dorney  _et al._ [2017] K. M. Dorney, J. L. Ellis, C. Hernández-García, D. D. Hickstein, C. A. Mancuso, N. Brooks, T. Fan, G. Fan, D. Zusin, C. Gentry, P. Grychtol, H. C. Kapteyn, and M. M. Murnane, Phys. Rev. Lett. 119, 063201 (2017).
  * Long  _et al._ [1995] S. Long, W. Becker, and J. K. McIver, Phys. Rev. A 52, 2262 (1995).
  * Eichmann  _et al._ [1995] H. Eichmann, A. Egbert, S. Nolte, C. Momma, B. Wellegehausen, W. Becker, S. Long, and J. K. McIver, Phys. Rev. A 51, R3414 (1995).
  * Frolov  _et al._ [2018] M. V. Frolov, N. L. Manakov, A. A. Minina, N. V. Vvedenskii, A. A. Silaev, M. Y. Ivanov, and A. F. Starace, Phys. Rev. Lett. 120, 263203 (2018).
  * Rajpoot  _et al._ [2021] R. Rajpoot, A. R. Holkundkar, and J. N. Bandyopadhyay, J. Phys. B: At. Mol. Opt. Phys. 54, 225401 (2021).
  * Milošević  _et al._ [2000] D. B. Milošević, W. Becker, and R. Kopold, Phys. Rev. A 61, 063403 (2000).
  * Fleischer  _et al._ [2014] A. Fleischer, O. Kfir, T. Diskin, P. Sidorenko, and O. Cohen, Nat. Photon. 8, 543 (2014).
  * Kfir  _et al._ [2015] O. Kfir, P. Grychtol, E. Turgut, R. Knut, D. Zusin, D. Popmintchev, T. Popmintchev, H. Nembach, J. M. Shaw, A. Fleischer, _et al._ , Nat. Photon. 9, 99 (2015).
  * Milošević and Becker [2020] D. B. Milošević and W. Becker, Phys. Rev. A 102, 023107 (2020).
  * Hickstein  _et al._ [2015] D. D. Hickstein, F. J. Dollar, P. Grychtol, J. L. Ellis, R. Knut, C. Hernández-García, D. Zusin, C. Gentry, J. M. Shaw, T. Fan, K. M. Dorney, A. Becker, A. Jaroń-Becker, H. C. Kapteyn, M. M. Murnane, and C. G. Durfee, Nat. Photon. 9, 743 (2015).
  * Huang  _et al._ [2018] P.-C. Huang, C. Hernández-García, J.-T. Huang, P.-Y. Huang, C.-H. Lu, L. Rego, D. D. Hickstein, J. L. Ellis, A. Jaron-Becker, A. Becker, S.-D. Yang, C. G. Durfee, L. Plaja, H. C. Kapteyn, M. M. Murnane, A. H. Kung, and M.-C. Chen, Nat. Photon. 12, 349 (2018).
  * Dixit  _et al._ [2018] G. Dixit, A. Jiménez-Galán, L. Medišauskas, and M. Ivanov, Phys. Rev. A 98, 053402 (2018).
  * Ansari  _et al._ [2021] I. N. Ansari, C. Hofmann, L. Medišauskas, M. Lewenstein, M. F. Ciappina, and G. Dixit, Phys. Rev. A 103, 013104 (2021).
  * Milošević and Becker [2000] D. B. Milošević and W. Becker, Phys. Rev. A 62, 011403 (2000).
  * Fan  _et al._ [2015] T. Fan, P. Grychtol, R. Knut, C. Hernández-García, D. D. Hickstein, D. Zusin, C. Gentry, F. J. Dollar, C. A. Mancuso, C. W. Hogle, O. Kfir, D. Legut, K. Carva, J. L. Ellis, K. M. Dorney, C. Chen, O. G. Shpyrko, E. E. Fullerton, O. Cohen, P. M. Oppeneer, D. B. Milošević, A. Becker, A. A. Jaroń-Becker, T. Popmintchev, M. M. Murnane, and H. C. Kapteyn, Proc. Natl Acad. Sci. USA 112, 14206 (2015).
  * Cireasa  _et al._ [2015] R. Cireasa, A. E. Boguslavskiy, B. Pons, M. C. H. Wong, D. Descamps, S. Petit, H. Ruf, N. Thiré, A. Ferré, J. Suarez, J. Higuet, B. E. Schmidt, A. F. Alharbi, F. Légaré, V. Blanchet, B. Fabre, S. Patchkovskii, O. Smirnova, Y. Mairesse, and V. R. Bhardwaj, Nat. Phys. 11, 654 (2015).
  * Tang and Cohen [2011] Y. Tang and A. E. Cohen, Science 332, 333 (2011).
  * Hendry  _et al._ [2010] E. Hendry, T. Carpy, J. Johnston, M. Popland, R. V. Mikhaylovskiy, A. J. Lapthorn, S. M. Kelly, L. D. Barron, N. Gadegaard, and M. Kadodwala, Nature Nanotechnol. 5, 783 (2010).
  * Baykusheva and Wörner [2018] D. Baykusheva and H. J. Wörner, Phys. Rev. X 8, 031060 (2018).
  * Giri  _et al._ [2021] S. Giri, J. C. Tremblay, and G. Dixit, Phys. Rev. A 104, 053115 (2021).
  * Giri  _et al._ [2020] S. Giri, A. M. Dudzinski, J. C. Tremblay, and G. Dixit, Phys. Rev. A 102, 063103 (2020).
  * Li  _et al._ [2022] W. Li, X. Zhu, P. Lan, and P. Lu, Phys. Rev. A 106, 043115 (2022).
  * Qiao  _et al._ [2019] Y. Qiao, D. Wu, J.-G. Chen, J. Wang, F.-M. Guo, and Y.-J. Yang, Phys. Rev. A 100, 063428 (2019).
  * Rana  _et al._ [2022] N. Rana, M. S. Mrudul, and G. Dixit, Phys. Rev. Appl. 18, 064049 (2022).
  * Chen  _et al._ [2022] Y. Chen, X. Shen, W. Lan, S. Li, F. Guo, and Y. Yang, Symmetry 14, 519 (2022).
  * Jia  _et al._ [2018] G.-R. Jia, X.-Q. Wang, T.-Y. Du, X.-H. Huang, and X.-B. Bian, J. Chem. Phys. 149, 154304 (2018).
  * Rajpoot  _et al._ [2020] R. Rajpoot, A. R. Holkundkar, and J. N. Bandyopadhyay, J. Phys. B: At. Mol. Opt. Phys. 53, 205404 (2020).
  * Zhang  _et al._ [2017] X. Zhang, X. Zhu, X. Liu, D. Wang, Q. Zhang, P. Lan, and P. Lu, Opt. Lett. 42, 1027 (2017).
  * Huo  _et al._ [2021] X.-X. Huo, Y.-H. Xing, T. Qi, Y. Sun, B. Li, J. Zhang, and X.-S. Liu, Phys. Rev. A 103, 053116 (2021).
  * Rajpoot and Holkundkar [2023] R. Rajpoot and A. R. Holkundkar, J. Phys. B: At. Mol. Opt. Phys. 56, 105402 (2023).
  * Sanderson and Curtin [2016] C. Sanderson and R. Curtin, J. Open Source Softw. 1, 26 (2016).
  * Alon  _et al._ [1998] O. E. Alon, V. Averbukh, and N. Moiseyev, Phys. Rev. Lett. 80, 3743 (1998).
  * Xie  _et al._ [2008] X. Xie, A. Scrinzi, M. Wickenhauser, A. Baltuška, I. Barth, and M. Kitzler, Phys. Rev. Lett. 101, 033901 (2008).
  * Zhang  _et al._ [2020] X. Zhang, X. Zhu, X. Liu, F. Wang, M. Qin, Q. Liao, and P. Lu, Phys. Rev. A 102, 033103 (2020).
  * Holkundkar and Rajpoot [2020] A. R. Holkundkar and R. Rajpoot, Phys. Scr. 95, 085607 (2020).
  * Lara-Astiaso  _et al._ [2016] M. Lara-Astiaso, R. E. F. Silva, A. Gubaydullin, P. Rivière, C. Meier, and F. Martín, Phys. Rev. Lett. 117, 093003 (2016).
  * Wang  _et al._ [2017] F. Wang, W. Liu, L. He, L. Li, B. Wang, X. Zhu, P. Lan, and P. Lu, Phys. Rev. A 96, 033407 (2017).


Luís Sousa, José Cecílio, Pedro Ferreira, Alan Oliveira††thanks: Corresponding
author.LASIGE, Faculdade de Ciências, Universidade de
Lisboafc60428@alunos.fc.ul.pt,{jmcecilio, pmferreira,
<EMAIL_ADDRESS>
35 1 March 2024

# Reconfigurable and Scalable Honeynet for Cyber-Physical Systems

###### Abstract

Industrial Control Systems (ICS) constitute the backbone of contemporary
industrial operations, ranging from modest heating, ventilation, and air
conditioning systems to expansive national power grids. Given their pivotal
role in critical infrastructure, there has been a concerted effort to enhance
security measures and deepen our comprehension of potential cyber threats
within this domain. To address these challenges, numerous implementations of
Honeypots and Honeynets intended to detect and understand attacks have been
employed for ICS. This approach diverges from conventional methods by focusing
on making a scalable and reconfigurable honeynet for cyber-physical systems.
It will also automatically generate attacks on the honeynet to test and
validate it. With the development of a scalable and reconfigurable Honeynet
and automatic attack generation tools, it is also expected that the system
will serve as a basis for producing datasets for training algorithms for
detecting and classifying attacks in cyber-physical honeynets.

Keywords: Industrial Control Systems, Cyber-Physical Systems,
Honepot/Honeynet, Dataset, Attack Capturing.

##  1 Introduction

Honeypots serve as tools designed to mislead attackers by creating an illusion
that they are targeting genuine infrastructure. In reality, these systems
gather valuable information about the ongoing attack, enabling the enhancement
of both the actual infrastructure and the honeypot. Additionally, they provide
insights into the attackers’ intentions and the origin of the attack[1].
Honeynets are multiple Honeypots working together in the same system[1] which
is the intended implementation of this work. A system like a CPS is typically
considered a honeynet because each component can be considered a honeypot.

Honeynets are important for Industrial Control Systems (ICS), as the impact of
a cyber-attack on these systems can cause significant harm to countries and
society. Examples of some of the most prolific attacks on CPS include the
Stuxnet [2], which attacked the nuclear enrichment facilities of Iran, or the
2015 attacks on the Ukrainian power grid [3]. Note that the difficulty of also
identifying the culprits and plausible deniability of the attacks makes it
attractive for governments to influence foreign opinion and cause unrest
without many consequences[4].

A ICS is a type of Cyber-physical System (CPS) that is typically composed of
actuators and sensors that interact with the physical world (called the
Plant), the control is composed of Programmable Logic Controllers (PLC) or
Remote Terminal Units (RTU) that control the Plant and Monitoring typically
done through a Human Machine Interface (HMI). This system is typically called
a Supervisory Control and Data Acquisition (SCADA). To develop a CPS honeynet
it is necessary to simulate all the components of a typical CPS so that it
provides realistic data to fool the attacker into thinking it is a real
system. For this, the use of real-time simulations to provide realistic data
and information about a physical system is required. For that, there needs to
be a complete simulation of the entire system from monitoring to the physical
world.

In this context, this work aims to implement a software-based scalable and
reconfigurable honeynet. This means that it should be able to add components
and reconfigure the existing components. This work also focuses on the
generation of dynamic and orchestrated attacks in the honeynet. The attack
generation capability is used to validate the system. For this, the work
includes the creation of a component called the Attack coordinator that using
attack modelling algorithms can attack the CPS dynamically. After having a
good implementation of the honeynet and the attack generator, an additional
goal is to use this setup to produce a data set for Machine Learning
(ML)-based intrusion detection systems (IDS) in cyber-physical honeynets.

With this, the main objectives of this work are:

  1. 1.

Develop a honeynet capable of being scalable and re-configurable.

  2. 2.

Produce an automatic attack generation tool to validate and test the honeynet.

  3. 3.

Using the results of objectives 1 and 2 create datasets for ML-based IDSs in
cyber-physical honeynets.

The rest of this work is organized as follows: Section 2 shows some of the
work related to the topics of honeynets. Section 3 describes the proposed
system design. In Section 4 discusses the results achieved so far and the work
that has to be done. Section 5 brings the conclusions.

Work | Year | Scalability |  LoI |  Attack Simulation |  Physical Interaction
---|---|---|---|---|---
Hilt et al.[5] | 2020 | None |  High |  - |  Real Hardware
HoneyVP[6] | 2021 | Limited |  High |  - |  PLC level
HoneyPLC[7] | 2020 | Good |  Medium |  - |  None
Pliatsios et al.[8] | 2019 | Limited |  Medium |  - |  Recorded data
ICSpot[9] | 2022 | Good |  Medium |  - |  MiniCPS[10]
PLCHoney[11] | 2023 | Limited |  High |  Data injection |  Matlab Simulation
MimePot[12] | 2019 | Limited |  High |  Integrity Attack |  Python Simulation
Table 1: Table representing the honeypots analyzed (LoI: Level of Interaction)

##  2 Related Work

The related works focus on similar implementations of honeynets to the
honeynet this work is going to implement.

Hilt et al.[5] goes into detail on the implementation of a honeynet using real
hardware in a real factory. Hilts implementation focuses on having a realistic
system so that an attacker will be fooled, but it also shows the costs that
are required for a honeynet with real hardware, and that’s why this work
implementation diverges from having real hardware and instead uses a simulated
environment.

HoneyVP [6] is a honeypot that uses a real PLC and routes the attack traffic
to it. This approach is capable of handling multiple requests and attacks
simultaneously by sending them to the same PLC. It uses Memoization[13] to
reduce the required interactions with the PLC, this implementation reduces the
cost compared to a traditional full hardware implementation but doesn’t offer
much realism when looking at the complete environment of a CPS as it only
targets the PLC.

HoneyPLC [7] is a honeynet for simulating PLCs. It starts with real physical
PLCs and tries to copy all relevant information from the PLC. After this
HoneyPLC can simulate the different PLCs that it reads allowing for
scalability and diversity in what an attacker sees. This work limits its scope
to the PLCs thus still lacking when it comes to the other components of a CPS.

The study [8] (Pliatsios et al.) specifies a procedure to create a simple
honeynet from an already existing CPS. It uses Conpot[14] a honeypot framework
and uses real traffic from an RTU with two sensors. Afterwards, Conpot uses
that recorded traffic to generate fake traffic by replaying it. From the
attacker’s perspective, there seems to be real traffic thus looking like a
real system.

In [9] the authors build on top of HoneyPLC to add a physical component. In
this article, they add MiniCPS[10] which is a CPS simulation. The use of a
physical simulation improves the realism of the system compared to a system
without it.

The work presented in [11] creates a honeypot called PLCHoney. It uses
OpenPLC[15] and uses data from a recorded simulink simulation to generate the
Plant to PLC traffic. This implementation reduces the cost of running the
simulation but by only using the data from the simulation the environment the
honeypot tries to simulate is less dynamic.

MimePot is the honeypot conceived in [12]. It uses a real-time simulation for
the Plant that feeds data to an HMI to form its CPS. This CPS is simple as it
only includes a PLC and an HMI but is similar to the work we intend to make by
having a real-time simulation for the plant.

The implementation that this work aims to achieve diverges from the other by
having good scalability, a high level of interaction, attack simulation and a
simulation for the physical interactions. Some of the works focus on different
aspects similar to this work from the scalability or simulation of the plant,
but they either only focus on a single component of a CPS or they don’t
achieve real scalability. This work will also focus on the attack simulation
that PLCHoney and MimePot have but will try to have multiple attacks working
together instead of just one.

##  3 System Design

Figure 1: Architecture

Figure 1 shows the architecture of the system. It’s divided into four modules:
Coordinators, Attacks, CPS and Data Collection. The Coordinators are
responsible for managing the system. This module is composed of the
Architecture Coordinator and the Attack Coordinator. They communicate among
themselves so that when the Architecture Coordinator generates the structure
of the system the Attack Coordinator knows it as well.

There is the CPS composed of the elements that the attacker will have access
to. They are a mix of HMIs, PLCs and Plants. The number of components in this
group can vary as the architecture is scalable and controlled by the
Architecture Coordinator. They are networked between them in a realistic way
that is meant to be similar to implementations of CPS in the industry.

Then there is the Data Collection module which is composed of the tools
necessary to collect metrics, logs and network data. It will interact with all
the other components so they can garner the information necessary to validate
and later generate the dataset from that data.

In the implementation, all the components will be docker[16] containers as
this will help isolate every running component and make their implementation
dynamic to expand and replace components. This will also help the
implementation of attacks, as attacks can be docker components that initialize
in runtime.

###  3.1 Architecture Coordinator

The Architecture Coordinator will only run in the setup phase so it can from a
configuration file generate the necessary extra files to configure each
component on the architecture and provide the required information of the
architecture to the Attack Coordinator. With this information, the Attack
Coordinator can orchestrate attacks that make sense on the instantiated
network.

###  3.2 Attack Coordinator

The Attack Coordinator will use the architecture of the system to plan and
organize attacks, this should be done dynamically for any structure of the
system. This helps improve the diversity of attacks that are performed. Having
diverse attacks will lead to a higher level of confidence when validating this
solution. With the improved variability, we also have a more diverse and
complete input to feed into a dataset.

To create realistic attacks, the attack coordinator needs to have a good idea
of the architecture of the system and for this, it needs to keep track of all
the useful system information. The information of the network is in a graph
containing the information of each service running in each component and the
possible corresponding attacks for each service.

The coordination of multiple attacks will require information about what each
attack does and what changes they do to the system. This is important to make
a good attack sequence where the attacks need to make changes to the system to
achieve the attacker’s goal.

The attacks were chosen from [17] which specifies common attacks in CPSs. From
there, the following attacks were chosen to be implemented based on how common
and the complexity of implementation:

  * •

Man-in-the-middle

  * •

Modbus-Register Reading

  * •

Denial of service

  * •

Modbus-Register spoofing

  * •

Replay attack

More attacks can be added as we progress with the implementation.

###  3.3 CPS

This section describes the components of the CPS module. The Plant is
described in the Section 3.3.1, the SCADA/HMI in Section 3.3.2, and the PLC in
Section 3.3.3.

####  3.3.1 Plant

Figure 2: Plant

The Plant is implemented as a container simulating the physical process of the
system and interacts and communicates with the PLCs using different protocols,
currently implemented Modbus/TCP. The details of the software-based Plant
simulator are presented in Figure 2, which represents an overview of how it
works. A simulation feeds the data to the server and can be configured with
different parameters from a configuration file. The aim is to include multiple
simulations and be able to choose between the different simulations with the
configuration file. Currently, the implemented simulation is the heating up of
a gas container following Boyle’s law.

####  3.3.2 SCADA/HMI

The SCADA is implemented with an open-source solution. The one used is FUXA
which is a simple HMI that is easy to configure and use.

This solution also allows some further expansion. By allowing more protocols
that can add additional attacks making a more diverse and realistic
environment, the diverse protocols also serve to create background network
traffic.

####  3.3.3 PLC

For the PLC we used OpenPLC which is also an open-source implementation of a
PLC that implements our used protocols. In this case, it can use Modbus to
communicate with the Plant and with the SCADA.

This solution will allow us to control the Plant with a realistic control
structure. The code implemented on the PLC for the simulation follows the
simple instructions of heating the container if the pressure and the
temperature are below the specified on the HMI.

###  3.4 Data collection

To collect the data, the network traffic of all the components running on
containers will be collected and run through a pre-processing step that will
add information from the type of data in the packet.

The network capture will be implemented to allow the Attack Coordinator to
inform which packets are attacks, and add information to the traffic about
what is passing through the network. Beyond the data about the attacks, there
will also be some of the data added about the kinds of protocols being used as
can be seen in Figure 3.

Figure 3: Network Capture

There will be data collected beyond the network traffic. The system will also
collect the metrics of the running system, from the number of network
connections to processes running on the containers. The collection of logs
will also be important and can be useful in feeding into the dataset to train
a machine-learning algorithm, to fulfil Objetive 3.

##  4 Current Status and Forthcoming Work

Currently the Plant, PLC and HMI are implemented in the CPS thus being able to
run a simple CPS. The initial work in the Architecture Coordinator and Network
Capture is being done. After the completion of those two components the focus
will be in the Attack Coordinator to start the realization of attacks on the
system to validate and generate the data-set.

##  5 Conclusion

This work aims to improve the current state of the art in honeynets by
creating a honeynet that can fit any ICS, it also tries to provide better
training data to create better IDSs so they can be integrated with machine
learning and artificial intelligence by providing a controlled environment to
generate and execute attacks on a system that can follow the structure of a
real CPS.

##  6 Acknowledgement

This work was supported by FCT through the LASIGE Research Unit, ref.
UIDB/00408/2020 (https://doi.org/ 10.54499/UIDB/00408/2020) and ref.
UIDP/00408/2020 (https://doi.org/10.54499/UIDP/00408/2020).

## References

  * [1] J. Franco, A. Aris, B. Canberk, and A. S. Uluagac, “A survey of honeypots and honeynets for internet of things, industrial internet of things, and cyber-physical systems,” IEEE Communications Surveys & Tutorials, vol. 23, no. 4, pp. 2351–2383, 2021.
  * [2] R. Langner, “Stuxnet: Dissecting a cyberwarfare weapon,” IEEE Security & Privacy, vol. 9, no. 3, pp. 49–51, 2011.
  * [3] G. Liang, S. R. Weller, J. Zhao, F. Luo, and Z. Y. Dong, “The 2015 ukraine blackout: Implications for false data injection attacks,” IEEE Transactions on Power Systems, vol. 32, no. 4, pp. 3317–3318, 2017.
  * [4] J. K. Canfil, “The illogic of plausible deniability: why proxy conflict in cyberspace may no longer pay,” Journal of Cybersecurity, vol. 8, p. tyac007, 09 2022.
  * [5] S. Hilt, F. Maggi, C. Perine, L. Remorin, M. Rösler, and R. Vosseler, “Caught in the act: Running a realistic factory honeypot to capture real threats,” tech. rep., Trend Micro, Inc.
  * [6] J. You, S. Lv, Y. Sun, H. Wen, and L. Sun, “Honeyvp: A cost-effective hybrid honeypot architecture for industrial control systems,” in ICC 2021 - IEEE International Conference on Communications, pp. 1–6, 2021.
  * [7] E. López-Morales, C. Rubio-Medrano, A. Doupé, Y. Shoshitaishvili, R. Wang, T. Bao, and G.-J. Ahn, “Honeyplc: A next-generation honeypot for industrial control systems,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS ’20, (New York, NY, USA), p. 279–291, Association for Computing Machinery, 2020.
  * [8] D. Pliatsios, P. Sarigiannidis, T. Liatifis, K. Rompolos, and I. Siniosoglou, “A novel and interactive industrial control system honeypot for critical smart grid infrastructure,” in 2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), pp. 1–6, 2019.
  * [9] M. Conti, F. Trolese, and F. Turrin, “Icspot: A high-interaction honeypot for industrial control systems,” in 2022 International Symposium on Networks, Computers and Communications (ISNCC), pp. 1–4, 2022.
  * [10] D. Antonioli and N. O. Tippenhauer, “Minicps: A toolkit for security research on cps networks,” in Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and/or PrivaCy, CPS-SPC ’15, (New York, NY, USA), p. 91–100, Association for Computing Machinery, 2015.
  * [11] S. Y. Chowdhury, B. Dudley, and R. Sun, “The case for virtual plc-enabled honeypot design,” in 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 351–357, 2023.
  * [12] G. Bernieri, M. Conti, and F. Pascucci, “Mimepot: a model-based honeypot for industrial control networks,” in 2019 IEEE International Conference on Systems, Man and Cybernetics (SMC), pp. 433–438, 2019.
  * [13] D. Michie, ““memo” functions and machine learning,” Nature, vol. 218, pp. 19–22, Apr. 1968.
  * [14] L. Rist, “Conpot.” http://conpot.org/.  Accessed: 2024-01-5.
  * [15] “Openplc.” https://autonomylogic.com/.  Accessed: 2023-12-9.
  * [16] “Docker.” https://www.docker.com/get-started/.  Accessed: 2023-12-8.
  * [17] A. Humayed, J. Lin, F. Li, and B. Luo, “Cyber-physical systems security—a survey,” IEEE Internet of Things Journal, vol. 4, no. 6, pp. 1802–1831, 2017.