ICS Threat Analysis Using a Large-Scale Honeynet

A cyber security strategy for Industrial Control Systems (ICS) is typically based on the identified threats to a system. In order to obtain a better insight into the ICS-related threat landscape, we have deployed a large-scale, low-interaction honeypot system on the Internet and have analysed the interactions observed during 28-day long experiments. We describe the interaction results for a variety of industrial and non-industrial protocols, and we analyse the influence of industrial devices being listed on a device-oriented public search engine such as SHODAN. Finally, different combinations of these protocols are compared to determine their relative attractiveness to an external attacker.