syssec_red_book

6.7. Example Problemsyour ICS infrastructure.” The most notable example is described ina recent industry research paper by Trendmicro [398], who deployeda SCADA/ICS honeypot system that included dummy web serversmimicking the control panel of a water pressure station as well as realPLC devices exposed on the Internet with default login credentials, whichact as traps by imitating the activities of a real production system. Thirtynineattempts to access or alter unauthorized resources of the honeypotwere discovered during less than a month of observation. The reportmentions that “China accounted for the majority of the attack attemptsat 35%, followed by the United States at 19% and Lao at 12%.”Evaluating the accuracy of current modeling and simulation tools and, possibly,design better simulation tools. There are plenty of SCADA/ICS/CI simulationtools, created to fill the gap that many researchers face whenthey need real devices to test their security mechanisms. It is unclear,however, how accurate these systems are and how much they adhere tothe reality. Each study in this field has obviously justified the proposedapproach. What is missing is a systematization effort, toward the creationof a framework that can be used to evaluate existing and future simulators.This framework will have to take into account the characteristicsof real-world attacks: How well is a simulation tool able to emulate thebehavior of a real-world attack such as Stuxnet?Information correlation and attack scenario reconstruction. Intrusion detectionresearch is one of the main consumers of the data collected by honeypotsystems. In particular, as it happened in the past when intrusion detectionresearch was rampant, the correlation of various sources of information isone of the most challenging research problems. In ICS/SCADA systemsthis problem is more difficult, due to the inherent interdisciplinarityof the area and to the variety of protocols and vendors involved. Forinstance, one of the questions that need answering is to what extentattacks perpetrated (and detected) on the TCP side of a SCADA networkare visible also on the PLC side and, if that is the case, to what extentthese are correlated.49