IDEAS home Printed from https://ideas.repec.org/a/gam/jftint/v15y2023i7p241-d1193896.html

Analysis of ICS and SCADA Systems Attacks Using Honeypots

Author

Listed:
  • Mohamed Mesbah

    (School of Information Technology and Computer Science, Nile University, Cairo 12677, Egypt)

  • Mahmoud Said Elsayed

    (School of Computer Science, University College Dublin, D04 V1W8 Dublin, Ireland)

  • Anca Delia Jurcut

    (School of Computer Science, University College Dublin, D04 V1W8 Dublin, Ireland)

  • Marianne Azer

    (National Telecommunication Institute, Nile University, Cairo 12677, Egypt)

Abstract

Supervisory control and data acquisition (SCADA) attacks have increased due to the digital transformation of many industrial control systems (ICS). Operational technology (OT) operators should use the defense-in-depth concept to secure their operations from cyber attacks and reduce the surface that can be attacked. Layers of security, such as firewalls, endpoint solutions, honeypots, etc., should be used to secure traditional IT systems. The three main goals of IT cybersecurity are confidentiality, integrity, and availability (CIA), but these three goals have different levels of importance in the operational technology (OT) industry. Availability comes before confidentiality and integrity because of the criticality of business in OT. One of the layers of security in both IT and OT is honeypots. SCADA honeypots are used as a layer of security to mitigate attacks, known attackers’ techniques, and network and system weaknesses that attackers may use, and to mitigate these vulnerabilities. In this paper, we use SCADA honeypots for early detection of potential malicious tampering within a SCADA device network, and to determine threats against ICS/SCADA networks. An analysis of SCADA honeypots gives us the ability to know which protocols are most commonly attacked, and attackers’ behaviors, locations, and goals. We use an ICS/SCADA honeypot called Conpot, which simulates real ICS/SCADA systems with some ICS protocols and ICS/SCADA PLCs.

Suggested Citation

  • Mohamed Mesbah & Mahmoud Said Elsayed & Anca Delia Jurcut & Marianne Azer, 2023. "Analysis of ICS and SCADA Systems Attacks Using Honeypots," Future Internet, MDPI, vol. 15(7), pages 1-17, July.
    • Handle: RePEc:gam:jftint:v:15:y:2023:i:7:p:241-:d:1193896
    as

    Download full text from publisher

    File URL: https://www.mdpi.com/1999-5903/15/7/241/pdf
    Download Restriction: no
    File URL: https://www.mdpi.com/1999-5903/15/7/241/
    Download Restriction: no
    ---><---

    References listed on IDEAS

    as
    1. Xingyuan Yang & Jie Yuan & Hao Yang & Ya Kong & Hao Zhang & Jinyu Zhao, 2023. "A Highly Interactive Honeypot-Based Approach to Network Threat Management," Future Internet, MDPI, vol. 15(4), pages 1-31, March.
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Rareș-Mihail Visalom & Maria-Elena Mihăilescu & Răzvan Rughiniș & Dinu Țurcanu, 2025. "Intercepting and Monitoring Potentially Malicious Payloads with Web Honeypots," Future Internet, MDPI, vol. 17(9), pages 1-32, September.
    2. Tameem ud Din, Usman Zia1, Mahnoor, Laiq Hasan, Syed M. Ali Uddin Hafee, 2024. "Investigating Threats to ICS and SCADA Systems Via Honeypot Data Analysis and SIEM," International Journal of Innovations in Science & Technology, 50sea, vol. 6(5), pages 189-197, May.
    3. Khadidos, Alaa O. & Khadidos, Adil O. & Selvarajan, Shitharth & Al-Shehari, Taher & Alsadhan, Nasser A & Singh, Subhav, 2025. "CyberSentry: Enhancing SCADA security through advanced deep learning and optimization strategies," International Journal of Critical Infrastructure Protection, Elsevier, vol. 50(C).

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Rareș-Mihail Visalom & Maria-Elena Mihăilescu & Răzvan Rughiniș & Dinu Țurcanu, 2025. "Intercepting and Monitoring Potentially Malicious Payloads with Web Honeypots," Future Internet, MDPI, vol. 17(9), pages 1-32, September.

    More about this item

    Keywords

    ;
    ;
    ;
    ;
    ;
    ;
    ;
    ;
    ;
    ;

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:gam:jftint:v:15:y:2023:i:7:p:241-:d:1193896. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: MDPI Indexing Manager (email available below). General contact details of provider: https://www.mdpi.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.