## 7 Defenses  
For ICS-ARC-like attacks in ICS, we try to explore defense countermeasures from the specific attack flow of ICS-ARC. In this work, we provide corresponding defense methods for different stages of the attack process, that is, border security, access security, and PLC security, as shown in Figure 15.  
For border security, although some ICS malware such as Stuxnet has shown how to break through the border, physical isolation is still the most straightforward way to defend against ransomware attacks. In the age of Industry 4.0, more and more PLCs are connected to the Internet, and it is foreseeable that this is also one of the future development trends of ICSs. To detect the adversary outside the border with protection techniques such as a honeypot network would be an effective defense method. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Order of List** & **Countries** & **Numbers** \\ \hline
1 & United States & 224,816 \\
2 & Germany & 50,352 \\
3 & China & 46,313 \\
4 & Korea & 16,246 \\
5 & Canada & 16,212 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The top 5 countries of ICS devices. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Protocols** & **Default Port No.** & **TCP/UDP** & **Private/Public** & **Manufacturers** \\ \hline S7 Comm & 102 & TCP & Private & SIEMENS \\ S7 Comm Plus & 102 & TCP & Private & SIEMENS \\ CIP & TCP 44818 & TCP\& UDP & Rockwell Allen \\  & UDP 2222 & & & Bradley \\ Ethernet/IP & TCP 44818 & TCP\& UDP & Rockwell Allen \\  & UDP 2222 & & & Bradley \\ OMRON & 9600 & TCP & Private & Omron \\ MELSEC-Q & 4999 & & & \\  & 5001 & TCP & Private & MITSUBISHI \\  & 5002 & & & \\ GE-SRTP & 18245 & & & \\  & 18246 & & & \\  & 57176 & & & \\ Modbus & 502 & TCP & Public & (Core functions \\  & & & & are private.) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Default ports and communication protocols of PLCs. Industrial Honeypots and Honeynets. The concept of a honeypot has been used in general-purpose intrusion detection systems for a long time with well-recognized contributions in revealing and analyzing cyber attacks [41]. An industrial honeypot is used with the purpose of being attacked and possibly compromised, which can attract attackers and deceive them into thinking they gained access to the real ICS [42]. Two or more honeypots implemented on a system form a honeynet [43]. Many traditional security mechanisms such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), firewalls, antivirus, and anti-malware can be utilized. However, all these solutions cannot transparently allow security researchers to observe and analyze how attackers perform attacks and discover their behaviors. Honeypots can be integrated with firewalls and IDSs to form an IPS to capture all the information about attackers, study all of their actions, and develop ways to improve system security and prevent attacks in the future [44]. Through industrial honeypots, unknown attacks such as ICS-ARC can be captured while \"hiding\" the real target, further enhancing the ICS security based on the captured attack details. For access security, communication with the PLC is a prerequisite for all ICS-ARC-like attacks, which means the access manager can be an effective defense method once the border has been compromised. Access security is currently the most widely used industrial security solution and is suitable for protecting against ICS-ARC-like attacks. Among the existing access security solutions, some are PLC's functions, such as PLC Access Control Lists (ACL), and some are commercial products such as industrial gateways and firewalls. PLC Access Control List. The ACL is a cost-effective defense method available in almost all PLCs which can prevent attackers from communicating with PLCs and further thwart ICS-ARC attacks. For example, ICS-ARC-like attacks always start from a third-party device, which may not be in the ACL. In that case, ACL can effectively prevent further attacks by ICS-ARC.