{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T20:56:26Z","timestamp":1781816186773,"version":"3.54.5"},"reference-count":19,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T00:00:00Z","timestamp":1689292800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Supervisory control and data acquisition (SCADA) attacks have increased due to the digital transformation of many industrial control systems (ICS). Operational technology (OT) operators should use the defense-in-depth concept to secure their operations from cyber attacks and reduce the surface that can be attacked. Layers of security, such as firewalls, endpoint solutions, honeypots, etc., should be used to secure traditional IT systems. The three main goals of IT cybersecurity are confidentiality, integrity, and availability (CIA), but these three goals have different levels of importance in the operational technology (OT) industry. Availability comes before confidentiality and integrity because of the criticality of business in OT. One of the layers of security in both IT and OT is honeypots. SCADA honeypots are used as a layer of security to mitigate attacks, known attackers\u2019 techniques, and network and system weaknesses that attackers may use, and to mitigate these vulnerabilities. In this paper, we use SCADA honeypots for early detection of potential malicious tampering within a SCADA device network, and to determine threats against ICS\/SCADA networks. An analysis of SCADA honeypots gives us the ability to know which protocols are most commonly attacked, and attackers\u2019 behaviors, locations, and goals. We use an ICS\/SCADA honeypot called Conpot, which simulates real ICS\/SCADA systems with some ICS protocols and ICS\/SCADA PLCs.<\/jats:p>","DOI":"10.3390\/fi15070241","type":"journal-article","created":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T08:35:47Z","timestamp":1689323747000},"page":"241","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":21,"title":["Analysis of ICS and SCADA Systems Attacks Using Honeypots"],"prefix":"10.3390","volume":"15","author":[{"given":"Mohamed","family":"Mesbah","sequence":"first","affiliation":[{"name":"School of Information Technology and Computer Science, Nile University, Cairo 12677, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2416-7481","authenticated-orcid":false,"given":"Mahmoud Said","family":"Elsayed","sequence":"additional","affiliation":[{"name":"School of Computer Science, University College Dublin, D04 V1W8 Dublin, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2705-1823","authenticated-orcid":false,"given":"Anca Delia","family":"Jurcut","sequence":"additional","affiliation":[{"name":"School of Computer Science, University College Dublin, D04 V1W8 Dublin, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8068-5120","authenticated-orcid":false,"given":"Marianne","family":"Azer","sequence":"additional","affiliation":[{"name":"National Telecommunication Institute, Nile University, Cairo 12677, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,7,14]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Arafune, M., Rajalakshmi, S., Jaldon, L., Jadidi, Z., Pal, S., Foo, E., and Venkatachalam, N. (2022, January 21\u201325). Design and Development of Automated Threat Hunting in Industrial Control Systems. Proceedings of the 2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops), Pisa, Italy.","DOI":"10.1109\/PerComWorkshops53856.2022.9767375"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Lehto, M. (2022). Cyber Security, Springer.","DOI":"10.1007\/978-3-030-91293-2"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Rashid, S.M., Haq, A., Hasan, S.T., Furhad, M.H., Ahmed, M., and Barkat Ullah, A.S. (2021, January 11). Faking Smart Industry: A Honeypot-Driven Approach for Exploring Cyber Security Threat Landscape. Cognitive Radio Oriented Wireless Networks and Wireless Internet, Proceedings of the International Conference on Cognitive Radio Oriented Wireless Networks, International Wireless Internet Conference, Virtual.","DOI":"10.1007\/978-3-030-98002-3_23"},{"key":"ref_4","first-page":"012030","article-title":"Security in Supervisory Control and Data Acquisition (SCADA) based Industrial Control Systems: Challenges and Solutions","volume":"Volume 1026","author":"Ara","year":"2022","journal-title":"IOP Conference Series: Earth and Environmental Science"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Kelly, C., Pitropakis, N., Mylonas, A., McKeown, S., and Buchanan, W.J. (2021). A Comparative Analysis of Honeypots on Different Cloud Platforms. Sensors, 21.","DOI":"10.3390\/s21072433"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Grigoriou, E., Liatifis, A., Grammatikis, P.R., Lagkas, T., Moscholios, I., Markakis, E., and Sarigiannidis, P. (2022, January 27\u201329). Protecting IEC 60870-5-104 ICS\/SCADA Systems with Honeypots. Proceedings of the 2022 IEEE International Conference on Cyber Security and Resilience (CSR), Rhodes, Greece.","DOI":"10.1109\/CSR54599.2022.9850329"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Yang, X., Yuan, J., Yang, H., Kong, Y., Zhang, H., and Zhao, J. (2023). A Highly Interactive Honeypot-Based Approach to Network Threat Management. Future Internet, 15.","DOI":"10.3390\/fi15040127"},{"key":"ref_8","first-page":"100250","article-title":"Design of an IoT-PLC: A containerized programmable logical controller for the industry 4.0","volume":"25","author":"Mellado","year":"2022","journal-title":"J. Ind. Inf. Integr."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Sibai, F.N., Mohammad, N., and Muhammad, S. (2020, January 17\u201319). Probabilistic Modeling and Study of Cybersecurity Attacks in Industrial Control Systems of Plants. Proceedings of the 2020 IEEE Conference on Application, Information and Network Security (AINS), Kota Kinabalu, Malaysia.","DOI":"10.1109\/AINS50155.2020.9314992"},{"key":"ref_10","unstructured":"Leverett, E., and Wightman, R. (2013, January 15). Vulnerability Inheritance in Programmable Logic Controllers. Proceedings of the 2013 GreHack Conference, Grenoble, France."},{"key":"ref_11","unstructured":"ICS-CERT (2011). Common Cybersecurity Vulnerabilities in Industrial Control Systems, U.S. Department of Homeland Security."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Yang, Y.S., Lee, S.H., Chen, W.C., Yang, C.S., Huang, Y.M., and Hou, T.W. (2022). Securing SCADA Energy Management System under DDos attacks using token verification approach. Appl. Sci., 12.","DOI":"10.3390\/app12010530"},{"key":"ref_13","first-page":"355","article-title":"Protocols, Solutions, and Testbeds for Cyber-Attack Prevention in Industrial SCADA Systems","volume":"Volume 3","author":"Kumar","year":"2022","journal-title":"The Internet of Things and Analytics for Agriculture"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"116748","DOI":"10.1016\/j.eswa.2022.116748","article-title":"A novel approach for accurate detection of DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks","volume":"197","author":"Polat","year":"2022","journal-title":"Expert Syst. Appl."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"2351","DOI":"10.1109\/COMST.2021.3106669","article-title":"A survey of honeypots and honeynets for the Internet of Things, industrial internet of Things, and cyber-physical systems","volume":"23","author":"Franco","year":"2021","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Lau, S., Klick, J., Arndt, S., and Roth, V. (2016, January 24\u201328). POSTER: Towards highly interactive honeypots for industrial control systems. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.","DOI":"10.1145\/2976749.2989063"},{"key":"ref_17","unstructured":"Cabral, W.Z., Valli, C., Sikos, L.F., and Wakeling, S.G. (2021). Advances in Security, Networks, and Internet of Things 2021, Springer."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Kang, K.D., Park, G., Kim, H., Alian, M., Kim, N.S., and Kim, D. (2021, January 18\u201322). NMAP: Power Management Based on Network Packet Processing Mode Transition for Latency-Critical Workloads. Proceedings of the MICRO-54: 54th Annual IEEE\/ACM International Symposium on Microarchitecture, Virtual Event.","DOI":"10.1145\/3466752.3480098"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Zolotykh, M. (2021, January 13\u201314). Study of Crawlers of Search Engine \u2018Shodan. io\u2019. Proceedings of the 2021 Ural Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT), Yekaterinburg, Russia.","DOI":"10.1109\/USBEREIT51232.2021.9455018"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/7\/241\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:11:54Z","timestamp":1760127114000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/7\/241"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,14]]},"references-count":19,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2023,7]]}},"alternative-id":["fi15070241"],"URL":"https:\/\/doi.org\/10.3390\/fi15070241","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,14]]}}}