Detection of critical infrastructure devices on the public Internet

Detection of critical infrastructure devices on the public Internet

Mladenov, Martin (TU Delft Electrical Engineering, Mathematics and Computer Science; TU Delft Cyber Security)

Smaragdakis, G. (mentor)
Erdődi, László (mentor)
Hanjalic, A. (graduation committee)

Delft University of Technology

Computer Science and Engineering

CSE3000 Research Project

2023-06-29

Supervisory Control and Data Acquisition (SCADA) systems are sometimes exposed on the public Internet. It is possible to quickly and efficiently identify such exposed services. They are commonly part of critical infrastructure, so they need to be protected against cyber attacks. In the past, researchers have scanned the Internet to detect such systems. However, such data may be biased due to honeypots set up by other researchers, which are fake hosts mimicking real industrial systems in order to detect malicious attacks.
In this paper, we develop a methodology to discover SCADA systems, classify them as real or honeypots, and analyse the metadata collected from them. We show that a large part of all exposed SCADA services are in fact likely to be honeypots, and we find correlations between independent honeypot-related indicators.

critical infrastructure
Industrial Control System
SCADA
honeypot

http://resolver.tudelft.nl/uuid:fd89efe5-56e2-4661-aeb1-48ac46a8c9ba

Student theses

bachelor thesis

© 2023 Martin Mladenov