{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T20:32:40Z","timestamp":1771705960501,"version":"3.50.1"},"reference-count":44,"publisher":"Wiley","license":[{"start":{"date-parts":[[2021,7,31]],"date-time":"2021-07-31T00:00:00Z","timestamp":1627689600000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2021,7,31]]},"abstract":"<jats:p>Considering that the attacks against the industrial control system are mostly organized and premeditated actions, IP traceback is significant for the security of the industrial control system. Based on the infrastructure of the internet, we have developed a novel malicious IP traceback model, ICSTrace, without deploying any new services. The model extracts the function codes and their parameters from the attack data according to the format of the industrial control protocol and employs a short sequence probability method to transform the function codes and their parameters into a vector, which characterizes the attack pattern of malicious IP addresses. Furthermore, a partial seeded K-means algorithm is proposed for the pattern\u2019s clustering, which helps in tracing the attacks back to an organization. ICSTrace is evaluated based on the attack data captured by the large-scale deployed honeypots for the industrial control system, and the results demonstrate that ICSTrace is effective on malicious IP traceback in the industrial control system.<\/jats:p>","DOI":"10.1155\/2021\/7525092","type":"journal-article","created":{"date-parts":[[2021,8,2]],"date-time":"2021-08-02T19:20:05Z","timestamp":1627932005000},"page":"1-14","source":"Crossref","is-referenced-by-count":3,"title":["ICSTrace: A Malicious IP Traceback Model for Attacking Data of the Industrial Control System"],"prefix":"10.1155","volume":"2021","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0816-1848","authenticated-orcid":true,"given":"Feng","family":"Xiao","sequence":"first","affiliation":[{"name":"Anhui Province Key Laboratory of Big Data Analysis and Application School of Computer Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Enhong","family":"Chen","sequence":"additional","affiliation":[{"name":"Anhui Province Key Laboratory of Big Data Analysis and Application School of Computer Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiang","family":"Xu","sequence":"additional","affiliation":[{"name":"Electronic Engineering Institute of Hefei, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xianguo","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, University of Science and Technology of China, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","reference":[{"key":"1","doi-asserted-by":"publisher","DOI":"10.1109\/mc.2011.115"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1109\/mspec.2013.6471059"},{"key":"3","article-title":"A cyberattack has caused confirmed physical damage for the second time ever","author":"K. Zetter","year":"2015"},{"key":"4","article-title":"Inside the cunning unprecedented hack of Ukraine's power grid","author":"K. Zetter","year":"2016"},{"key":"5"},{"key":"6","volume-title":"Guide to Industrial Control Systems (ICS) Security","author":"K. Stouffer","year":"2011"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2015.02.002"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1016\/j.jprocont.2015.04.005"},{"key":"9","doi-asserted-by":"publisher","DOI":"10.1109\/ptc.2015.7232339"},{"key":"10","doi-asserted-by":"crossref","article-title":"Rule-based intrusion detection system for SCADA networks","author":"Y. Yang","DOI":"10.1049\/cp.2013.1729"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.1109\/msp.2014.122"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1109\/tcst.2013.2280899"},{"key":"13","doi-asserted-by":"publisher","DOI":"10.4028\/www.scientific.net\/amm.490-491.1745"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1109\/tsmc.2015.2415763"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1080\/01402390.2014.977382"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1145\/347057.347560"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1145\/964723.383060"},{"key":"18","doi-asserted-by":"crossref","article-title":"IP traceback based on packet marking and logging","author":"C. Gong","DOI":"10.1109\/ICC.2005.1494507"},{"key":"19","doi-asserted-by":"publisher","DOI":"10.1109\/tpds.2007.70817"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1109\/lcomm.2003.811200"},{"key":"21"},{"key":"22","first-page":"368","article-title":"S7commTrace: a high interactive honeypot for industrial control system based on s7 protocol","author":"F. Xiao"},{"key":"23","doi-asserted-by":"publisher","DOI":"10.1109\/isi.2016.7745468"},{"key":"24","volume-title":"Honeypots: Tracking Hackers","author":"L. Spitzner","year":"2003"},{"issue":"4","key":"25","doi-asserted-by":"crossref","first-page":"825","DOI":"10.3724\/SP.J.1001.2013.04369","article-title":"Honeypot technology research and application","volume":"24","author":"J.-W. Zhuge","year":"2013","journal-title":"Journal of Software"},{"key":"26"},{"key":"27"},{"key":"28","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813703"},{"key":"29"},{"key":"30"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2009.09.011"},{"key":"32","article-title":"Constrained k-means clustering with background knowledge","author":"K. Wagstaff"},{"key":"33","article-title":"Semi-supervised clustering by seeding","author":"S. Basu"},{"key":"34","doi-asserted-by":"publisher","DOI":"10.1007\/bf01908075"},{"key":"35","first-page":"2837","article-title":"Information theoretic measures for clusterings comparison: variants, properties, normalization and correction for chance","volume":"11","author":"N. X. Vinh","year":"2010","journal-title":"Journal of Machine Learning Research"},{"key":"36","doi-asserted-by":"publisher","DOI":"10.1016\/0377-0427(87)90125-7"},{"key":"37","doi-asserted-by":"publisher","DOI":"10.1080\/03610927408827101"},{"key":"38","volume-title":"ICMP Traceback Messages","author":"S. M. Bellovin","year":"2003"},{"key":"39","doi-asserted-by":"publisher","DOI":"10.1109\/tnet.2007.910594"},{"key":"40","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2011.2169960"},{"key":"41","doi-asserted-by":"publisher","DOI":"10.1109\/tc.2015.2439287"},{"key":"42","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/bxw011"},{"key":"43","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2016.2624741"},{"key":"44","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.08.012"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/7525092.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/7525092.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/7525092.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,8,2]],"date-time":"2021-08-02T19:20:11Z","timestamp":1627932011000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2021\/7525092\/"}},"subtitle":[],"editor":[{"given":"Jingyu","family":"Feng","sequence":"additional","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2021,7,31]]},"references-count":44,"alternative-id":["7525092","7525092"],"URL":"https:\/\/doi.org\/10.1155\/2021\/7525092","relation":{},"ISSN":["1939-0122","1939-0114"],"issn-type":[{"value":"1939-0122","type":"electronic"},{"value":"1939-0114","type":"print"}],"subject":[],"published":{"date-parts":[[2021,7,31]]}}}