Cyber Threat Investigation of SCADA Modbus Activities

摘要: The use of inter-connectivity Supervisory Control and Data Acquisition (SCADA) Industrial Systems (ICS) networks in smart technologies have exposed them to a large variety security threats. Furthermore, very few investigations are done this field from the Internet (cyber) perspective. Therefore, paper investigates unauthorized, malicious suspicious SCADA activities by leveraging darknet address space. In particular, work Modbus service, which is de facto standard protocol for communication it most available used connect electronic devices critical industrial infrastructures. This study based on real data collected throughout one-month period. Among 8 various inferred scanning activities, we find that TCP distributed portscan only non-typical scan. our analyses fingerprint scanners uncover 6 other services tag along with 74% time. Finally, list case studies related synchronized automated campaigns originated unknown sources.