Threat Analysis on Industrial Control System Based on Attacker's Behaviors using Honeypots

Abstract

Industrial Control System (ICS) is an information system used in the maintenance and management of critical infrastructures, which usually have distributed control systems, supervisory control, and data acquisition systems to control local processes. These systems may be used in the power distribution system, gas, water, transportation, and production. However, these systems lack authentication and confidentiality which causes the ICS easily compromised by the attacker. To understand the attacker interactions, behaviors, and type of attack that compromised the Industrial Control System (ICS) we used a honeypot to emulate the Industrial Control System (ICS) and collect the data from the attacker. The data collected from the honeypot is further analyzed and mapped to specific MITRE ATT&CK Tactic, Techniques, and Procedures. The mapping results provide the detailed attacker's behaviors and purpose when they try to compromise Industrial Control System (ICS) emulated in our honeypots.