Detecting, Fingerprinting and Tracking Reconnaissance Campaigns Targeting Industrial Control Systems

摘要: Industrial Control Systems (ICS) are attractive targets to attackers because of the significant cyber-physical damage they can inflict. As such, often subjected reconnaissance campaigns aiming at discovering vulnerabilities that be exploited online. these scan large netblocks Internet, some IP packets directed darknet, routable, allocated and unused space. In this paper, we propose a new technique detect, fingerprint, track probing targeting ICS systems by leveraging /13 darknet traffic. Our proposed detects, automatically, in near-real time such generates relevant timely cyber threat intelligence using graph-theoretic methods compare aggregate into campaigns. Besides, it ascribes each observed campaign fingerprint uniquely characterizes allows its tracking over time. has been tested 12.85 TB data, which represents 330 days network traffic received. The result our analysis for discovery not only known legitimate recurrent as those performed Shodan Censys but also uncovers coordinated launched other organizations. Furthermore, give details on linked botnet activity EtherNet/IP protocol.