## 8 Conclusions  
Traditional ransomware such as WannaCry shows massive negative impacts and causes tremendous data and financial losses to victims. The ICS ransomware attack, in particular, can be even more threatening as many ICSs are related to real-world safety. Thus, researchers and practitioners must proactively study the potential attack methods of ICS ransomware in order to protect ICS from future invasions. We present ICS-BROCK in our previous work to demonstrate that ICS ransomware attacks are actual in the real world by compromising a specific PLC. However, ICS-BROCK still has some limitations, such as a precompiled payload and the utilization of specific PLC characteristics. Although ICS-BROCK demonstrates that the ICS ransomware attack is actual, how to complete ransomware attacks against ICSs in a general method is still under struggle.  
This paper presents ICS-ARC, which is a novel ransomware attack method that can automatically generate payloads based on target control logic. ICS-ARC proceeds with a ransomware attack in four steps. First, ICS-BROCK downloads the control logic bytecode from the target PLC and decompiles it into a logical model. Second, it finds a correct mapping between specific ICS devices and variables by model checking. Third, it instantiates the ransomware attack payload with the correct mapping. Finally, it uploads the malicious code to the target PLC. To evaluate the attack capability of ICS-ARC, we built an Arduino with OpenPLC installed and a tap water treatment system for verification separately. The attack results show that ICS-ARC significantly improves the fault tolerance of the attack while reducing the attack cost.  
With the development of Industrial 4.0, more and more PLCs have been connected to the Internet. Thus, we make statistics on PLCs that may potentially be attacked with Shodan. As a result, it is foreseeable that the number of PLCs connected to the Internet will increase and grow faster and faster. Even though ICS-ARC is a novel attack method, almost all attack methods can be defended. In the last section, we have provided some defense methods, such as improved border security, industrial honeypots and honeynets, industrial gateways, industrial firewalls, control logic obfuscation, and ACL. Some of these methods are commercial products, some are academic research, but all help improve the security of ICS and resist attacks, including the ICS-ARC we proposed in this paper.  
Conceptualization, Y.Z. and Z.L.; methodology, Y.Z.; software, Y.Z.; validation, Y.Z., X.Z. and M.L.; formal analysis, Y.Z.; investigation, Y.Z.; resources, Y.H.; data curation, Y.H.; writing--original draft preparation, Y.Z.; writing--review and editing, M.L.; visualization, Y.Z.; supervision, M.L.; project administration, X.Z.; funding acquisition, Z.L. All authors have read and agreed to the published version of the manuscript.  
This research was funded by Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd. (Grant No. GDDKY2021 KF03) and National Natural Science Foundation of China (Grant Nos. U1636211, 61672081); The APC was funded by M.L.  
Not applicable.  
The authors declare no conflict of interest.