# Analysis of ICS and SCADA Systems Attacks Using Honeypots
## 1 Introduction
### Paper Contribution  
This research paper provides a comprehensive overview of the current state of OT cybersecurity and the importance of addressing this critical issue. The paper highlights the potential impact of OT cyber attacks on national security and the economy, and provides valuable insights into the various components of OT networks, including PLCs, RTUs, and HMIs. Additionally, the study explores the use of honeypot technology as a securitylayer, and emphasizes the importance of investing in new security technologies. The paper concludes by discussing some of the most notable OT incidents and underscores the need for organizations to prioritize OT cybersecurity and take steps to prevent these attacks. The paper also discusses experimental work on the OT honeypot (Conpot), including its deployment architecture, running PLCs, and the percentage of cyber-attacks against various protocols and from different countries.  
The contributions of this paper are as follows:  
* It provides an in-depth analysis of the current state of OT cybersecurity, including the latest trends and challenges.
* It highlights the potential impact of OT cyber attacks, which can cause widespread disruption to critical infrastructure, including power grids, transportation systems, and communication networks. These attacks have a direct impact on national security and the economy as a whole.
* It explains the various components of OT networks, including PLCs, RTUs, and HMIs, and identifies potential security weaknesses that attackers can exploit.
* It explores the IoT landscape, including the various types of IoT devices and how they are classified. It highlights the differences between IT and OT systems, and the unique security considerations that each requires.
* It highlights the fact that while IT systems are primarily focused on protecting data and information, OT systems are concerned with the operational processes of physical assets and the protection of industrial control systems.
* It discusses the most famous OT incidents that have taken place in recent years, including Stuxnet, BlackEnergy, and Triton. These incidents have exposed the critical need for robust OT cybersecurity measures, and underscore the importance of investing in the research and development of new security technologies.
* It explores the use of honeypot technology as a valuable tool for detecting and mitigating OT cyber threats. Honeypots are simulated systems or network segments that are designed to appear vulnerable, thereby luring attackers into a controlled environment wherein they can be monitored and analyzed. The paper also outlines different types of honeypots and their respective benefits.  
In this study, we utilized Conpot as an ICS/SCADA honeypot to detect potential malicious tampering and identify which protocols are most targeted, and determine the countries that are most susceptible to attacks. The experiment was deployed on local servers connected to the internet through a firewall, with honeypot software installed to act as fake systems for attacks. The experiment lasted for 45 days, during which logs were collected from servers and applications from day one to the last day. The logs were forwarded to a Splunk SIEM solution for monitoring and correlation.  
The remainder of this paper is organized as follows:  
Section 2 presents related work in the field of OT cybersecurity. Section 3 provides background information about ICS/SCADA components and functions, as well as ICS/SCADA honeypots. The main differences between IT and OT systems are also discussed, and famous OT cyber incidents are highlighted in Sections 4 and 5, respectively. In Section 6, we discuss the experimental setup and present the experimental results in Sections 6.1 and 6.2. Section 7 analyzes the results obtained from the experiment. Finally, we present our conclusions and future work in Section 8.