# Analysis of ICS and SCADA Systems Attacks Using Honeypots
## 2 Related Work  
In 2021, [PERSON] conducted a study focusing on the analysis of honeypots on different cloud platforms. The author deployed honeypots on popular cloud providers in North America, Europe, and Asia to study the techniques employed by threat actors. The results show regional differences in activity, with evidence of automated activity targeting popular protocols such as remote desktop sharing. The authors found that attackers targeted assets irrespective of the cloud provider's popularity, and that exit nodes originated from both common and uncommon sources. The study highlights the importance of rigorous patch management and threat intelligence feeds for organizations that operate online, and provides insights into adversarial activity that can inform situational awareness operations [5]. In 2022, [PERSON] and his team conducted a study protecting ICS/SCADA systems with honeypots; the results of their research showed that an increasing number of interconnected industrial control systems (ICS) are exposed to the internet without adequate security measures, and this has made them vulnerable to attacks with potentially catastrophic outcomes. The authors enhanced and implemented low-interaction honeypots to collect unsolicited traffic aimed at ICS devices, and analyzed the received traffic to determine who is engaging with vulnerable ICS devices and how. The authors encouraged the industry to strengthen its efforts to secure ICSs and continue monitoring new risks as they emerge [6]. In 2023, [PERSON] conducted research regarding an interactive honeypot-based approach to network threat management; this paper proposes a modular design approach to create a highly interactive honeypot threat management system that achieves active defense measures for the network environment while withstanding continuous attacks. The system's structure includes information collection, connection control, honeypot deployment, and data analysis and processing modules. Practical tests were conducted to assess the model's practicability, and the system was compared with other network threat management methods. The system uses high-interaction honeypots as information collection tools, formats collected data utilizing the attacker's IP address as the primary key for classification, and offers a user-friendly web interface. The system adapts to a variety of operating systems, and shows significant improvements in security and proactivity when compared to traditional network threat management systems. The study demonstrates that the system achieved its security and seduction objectives, and promotes the more widespread application of honeypot technology [7]. There are numerous research papers available on the topic of operational technology (OT) cybersecurity attacks, as well as techniques to protect against them. These research papers cover many OT cybersecurity threats, such as malware attacks, network attacks, physical attacks, and insider threats. * Malware attacks are a significant concern for OT systems, as they can cause serious disruptions to critical infrastructure and industrial processes. Malware can infect OT systems through various vectors, such as phishing emails, compromised software updates, or infected devices. Examples of OT-specific malware include Stuxnet, Triton, and Industroyer. * OT systems often have complex networks that can be vulnerable to various types of network attacks, such as denial of service (DoS) attacks, distributed denial of service (DDoS) attacks, and man-in-the-middle (MITM) attacks. * Physical attacks against OT systems refer to any attempt to physically damage, manipulate, or interfere with the devices and equipment that make up an OT system. These attacks can have serious consequences, including loss of control over critical infrastructure and industrial processes, data theft, and physical harm to people and equipment.