# Analysis of ICS and SCADA Systems Attacks Using Honeypots
## 3 Background  
In this section, we present the components and functions of ICS/SCADA systems, as well as honeypot definitions and types. ICS and SCADA systems are used to control and monitor industrial processes and infrastructure. These systems typically consist of the following components and features:  
* Sensors and actuators: These are devices that measure physical quantities such as temperature, pressure, and flow rate, and control equipment such as valves and pumps. * Control hardware: This includes controllers, programmable logic controllers (PLCs), and distributed control systems (DCS) that execute control logic and communicate with field devices. * Communication infrastructure: This includes networks, protocols, and communication devices that enable the control hardware and field devices to communicate with each other and with the SCADA software. * SCADA software: This is software that runs on a computer or server and is used to monitor and control the industrial process. It typically includes a human-machine interface (HMI) for operators to view and control the process, as well as tools for data analysis and reporting. * Security measures: ICS and SCADA systems are vulnerable to cyber attacks, so it is important to implement measures such as firewalls, intrusion detection systems, and secure authentication to protect against unauthorized access. The main components of SCADA systems are presented in Table 1. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Component** & **Acronym** & **Function** \\ \hline Programmable Logic Controller & PLC & Used as local controllers for monitoring and running the different processes. This is accomplished using feedback tools such as sensors and actuators [8]. \\ \hline SCADA Server or Master Terminal Unit & MTU & In charge of giving directions to the field’s RTU [9]. \\ \hline Remote Terminal Unit & RTU & Receiving and transmitting data to MTU is the responsibility of the control field feedback device [10]. \\ \hline Human Machine Interface & HMI & Used as an interface to connect the ICS operator and control hardware. It allows the display of information, whether related to status or data gathered in the ICS Environment [11]. \\ \hline Communication Infrastructure: & The network infrastructure that connects systems. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: SCADA systems’ main components. * Industrial control systems (ICS) protocols can be categorized into two types: transmission control protocols (TCP) and user datagram protocols (UDP). TCP-based protocols typically establish a standard connection before transmitting data, providing an opportunity for authentication from the sender. This makes TCP-based protocols reliable and secure for host-to-host communication. In contrast, UDP-based protocols do not require a standard connection before sending data, resulting in no authentication for process-to-process communication. According to [12] this makes UDP-based protocols less secure [13]. * ICS threats and vulnerabilities can be exploited: the following are some of the vulnerabilities in industrial control systems (ICS) that can be exploited by cyber-attacks. Insecure interfaces and device vulnerabilities are among them, which include legacy control interfaces that are connected to the Internet, industrial Internet of Things (IIoT) devices, and various bring your own devices (BYODs) such as tablets and smartphones. These devices can serve as entry points to the system and introduce vulnerabilities [12]. Communication vulnerabilities that are insecure include insecure protocols and direct access to field devices. The ModBus protocol is an example of an insecure protocol lacking encryption, integrity, and authentication measures, which make it vulnerable to various attacks. In terms of wireless communication, some plants may use weaker Wi-Fi encryption protocols. Additionally, it has been found that a significant number of programmable logic controllers (PLCs) are directly connected to the Internet [13].