Abstract
Industrial Control Systems (ICSs) are increasingly evolving from isolated infrastructures into connected platforms due to the integration of information technology, industrial communication networks, and data-driven monitoring services. Although this transformation improves operational visibility and efficiency, it also expands the attack surface of ICS environments. Conventional vulnerability assessment and penetration testing methods are often unsuitable for operational ICSs because of safety, availability, and cost constraints. Similarly, intrusion detection and mitigation mechanisms require realistic attack data for development and validation, but collecting such data from running industrial systems is risky and impractical. Realistic ICS testbeds provide controlled environments for analyzing cyber-attacks, observing their consequences, and validating security mechanisms without disrupting operational facilities. This study presents FALCON (Factory Automation Lab for Cybersecurity & Operational Networks), a cyber-physical ICS testbed that integrates a real physical production process, PLC-based control, HMI/SCADA supervision, monitoring, logging capabilities, and IT–OT network segmentation. The testbed is designed to represent key functions commonly found in industrial production systems, including sensing, actuation, robotic transfer, quality control, labeling, and sequential process execution. FALCON supports both network-oriented and process-oriented attack scenarios within a controlled environment. Its layered architecture enables attacks to be initiated from different system points and analyzed across communication, control, monitoring, and physical process layers. The proposed testbed was evaluated in terms of design requirements and attack scenario coverage. It also supports a broad set of attack scenarios and enables the observation of immediate or delayed physical consequences.