Protecting Industrial Control Systems From Shodan Exploitation Through Advanced Traffic Analysis

The security of industrial control systems (ICS) remains a critical challenge for industry stakeholders and business owners who rely on these devices. Many legacy ICS systems still in operation today harbor numerous and severe security vulnerabilities. Shodan, a prominent online scanning tool, systematically scans the entire internet, typically on a weekly basis. By sending targeted requests and analyzing the responses, Shodan identifies internet-connected devices and provides its clients with detailed information, including security vulnerabilities. Unfortunately, this functionality has been exploited by hackers to pinpoint potential attack targets and their associated weaknesses. A key defense against such threats is preventing ICS devices from being indexed by Shodan. To achieve this, it is crucial to understand Shodan’s scanning methods. This research introduces protocol analysis as a novel feature in network traffic analysis, significantly improving detection accuracy over models that rely solely on traditional network features. Additionally, a dual-pronged approach combining customized honeypots with protocol analysis is proposed, enhancing detection capabilities by integrating decoy technologies with enriched traffic insights. Several machine learning algorithms were evaluated, including Random Forest, Support Vector Machine, Logistic Regression, and Gradient Boosting. The proposed model was tested on traffic data from three different Siemens honeypot devices—S7-300, S7-1200, and S7-1500. The traffic was categorized into three types: TCP traffic, UDP traffic, and Others, which includes non-standard or unidentified protocols. Gradient Boosting consistently outperformed other algorithms, achieving the highest F1-scores across all programmable logic controllers (PLC) models. For the S7-300 model, it achieved F1-scores of 0.96 (Others), 0.98 (TCP), and 0.66 (UDP). Similarly, for the S7-1200 model, it obtained F1-scores of 0.95 (Others), 0.98 (TCP), and 0.58 (UDP). The highest performance was observed in the S7-1500 model, with F1-scores of 0.99 (Others), 0.98 (TCP), and 0.74 (UDP). While Random Forest demonstrated competitive performance in Others and TCP traffic, it struggled with UDP classification, highlighting Gradient Boosting’s superior ability to handle diverse traffic types. These findings emphasize the effectiveness of Gradient Boosting in detecting Shodan-originating traffic and suggest its potential application in real-time intrusion detection and firewall automation for ICS environments.