# Analysis of ICS and SCADA Systems Attacks Using Honeypots
## 7 Results Analysis  
The honeypots were active for one month with public IP addresses from one of the service providers; hence we have one month of data. The protocols analyzed are HTTP, SNMP, Modbus, BACnet, and S7 Comm. The number of IP addresses from each country is summarized in Table 8. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Location** & **Name** & **IP** & **Template** \\ \hline Location 1 & Conpot 1 & 41.38.171.244 & Default S7-200 \\ \hline Location 2 & Conpot 2 & 41.38.171.245 & S7-300 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Honeypots’ deployment setup. \begin{table}
\begin{tabular}{l l} \hline \hline
**Result** & **Script** \\ \hline Scan a single IP & Nmap [IP address] \\ \hline Scan a subnet & Nmap [IP address/Subnet] \\ \hline Detect OS and services & Nmap—A [IP Address] \\ \hline Version detection & Nmap—A—V [IP Address] \\ \hline Doing ping during the scan & Nmap—A—V-PN [IP Address] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Nmap scanning techniques. These IP addresses are the highest in some countries (Table 9), but some countries also have IP addresses under ten, such as Chile, Colombia, Ecuador, Georgia, Germany, India, and Japan. Figure 5 illustrates the percentages of countries. In the second stage analysis for IP addresses per port, we found that the most accessed protocol is HTTP, followed by SNMP, Modbus, S7 comm, and then Bacnet. Below are some IP addresses that tried to access these ports. Figure 6 illustrates a comparison between the protocols addressed in the top countries. \begin{table}
\begin{tabular}{l l} \hline \hline
**Country** & **Number of IPs** \\ \hline Iran & 18 \\ \hline Russia & 21 \\ \hline Netherland & 28 \\ \hline Brazil & 36 \\ \hline China & 750 \\ \hline USA & 250 \\ \hline Ukraine & 89 \\ \hline Italy & 125 \\ \hline France & 778 \\ \hline Egypt & 537 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Number of IP addresses from each country. Figure 5: Number of IP addresses from each country. \begin{table}
\begin{tabular}{l l} \hline \hline
**Honeypot Type** & **Open Ports** \\ \hline Siemens S7-200 & 80, 22, 161, 502, 623, 102 and 6009 \\ \hline Siemens S7-300 & 20, 22, 502, 161 and 102 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Honeypot open ports. * **HTTP: 201 IPs** \(\bigcirc\) (102.134.73.30). \(\bigcirc\) (103.23.34.14). \(\bigcirc\) (103.50.7.115). \(\bigcirc\) (103.65.193.129). \(\bigcirc\) (103.87.170.210). \(\bigcirc\) (104.152.52.31). \(\bullet\) **SNMP: 24 IPs** \(\bigcirc\) (100.27.12.73). \(\bigcirc\) (104.131.145.116). \(\bigcirc\) (104.131.145.165). \(\bigcirc\) (129.250.206.86). \(\bigcirc\) (184.105.139.67). \(\bullet\) **Modbus: 7 IPs** \(\bigcirc\) (104.131.132.215). \(\bigcirc\) (105.42.161.219). \(\bigcirc\) (154.129.241.152). \(\bigcirc\) (196.52.43.116). \(\bigcirc\) (196.52.43.88). \(\bigcirc\) (198.108.66.16). \(\bigcirc\) (50.116.23.165). \(\bullet\) **S7 comm: 10 IPs** \(\bigcirc\) (104.131.131.237). \(\bigcirc\) (105.42.161.219). \(\bigcirc\) (122.228.19.79). \(\bigcirc\) (125.64.94.197). \(\bigcirc\) (139.162.99.243). Figure 6: Protocols accessed by top countries.