Industrial Control Systems (ICSs) are cyber-physical systems that offer attractive targets to threat actors due to the scale of damages, both physical and cyber, that successful exploitation can cause. As such, ICSs often find themselves victims to reconnaissance campaigns - coordinated scanning activity that targets a wide subset of the Internet - that aim to discover vulnerable systems. As these campaigns likely scan broad netblocks of the Internet, some traffic is directed to network telescopes, which are routable, allocated, and unused IP space. In this paper, we explore the threat landscape of ICS devices by analyzing and investigating network telescope traffic. Our network traffic analysis tool takes darknet traffic and generates threat intelligence on scanning campaigns targeting ICSs in the form of campaign fragments, which we leverage in new ways to get more in-depth knowledge of the cybersecurity threats. We investigate the payloads of the identified campaigns using a custom Deep Packet Inspection (DPI) technique to dissect and analyze the packets. We found 13 distinct payload templates and deduced their purpose, and by extension the campaign goals. We use machine learning to classify the sources behind the campaigns and identify threat actors such as botnets, malicious attackers, or researchers, and establish a methodology to rank our campaigns to prioritize our analysis. To conduct our analysis of the threats targeting ICSs, we have leveraged 12.85 TB (330 days) of network traffic received by our observed darknet IP space. Combining these investigative threads, we provide a thorough overview of the threat landscape targeting ICS systems.

中文翻译：

---

使用网络望远镜数据为工业控制系统生成威胁情报


工业控制系统 (ICS) 是网络物理系统，由于成功利用可能造成的物理和网络损害规模，为威胁行为者提供了有吸引力的目标。因此，ICS 经常发现自己是侦察活动（针对互联网的广泛子集的协调扫描活动）的受害者，其目的是发现易受攻击的系统。由于这些活动可能会扫描互联网的广泛网络块，因此一些流量会被定向到网络望远镜，这些望远镜是可路由的、已分配的且未使用的 IP 空间。在本文中，我们通过分析和调查网络望远镜流量来探索 ICS 设备的威胁态势。我们的网络流量分析工具采用暗网流量，并以活动片段的形式生成针对 ICS 的扫描活动的威胁情报，我们以新的方式利用这些信息来更深入地了解网络安全威胁。我们使用自定义深度数据包检查 (DPI) 技术来剖析和分析数据包，调查已识别活动的有效负载。我们发现了 13 个不同的有效负载模板并推断出它们的目的，并由此推断出活动目标。我们使用机器学习对活动背后的来源进行分类，识别僵尸网络、恶意攻击者或研究人员等威胁行为者，并建立一种方法对我们的活动进行排名，以确定分析的优先顺序。为了对针对 ICS 的威胁进行分析，我们利用了我们观察到的暗网 IP 空间收到的 12.85 TB（330 天）网络流量。结合这些调查线索，我们提供了针对 ICS 系统的威胁态势的全面概述。