CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

ICSTrace: A Malicious IP Traceback Model for Attacking Data of Industrial Control System

The authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.

HoneypotOT/ICS

What we know

The authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.

Evidence limits

This entry is based solely on the available title and abstract; the full text was not reviewed and the model's effectiveness has not been independently verified.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. ICSTrace: A Malicious IP Traceback Model for Attacking Data of Industrial Control System
    abstract · 2026-10-04

Reviewed: 2026-10-04. This record may change when new evidence is found.

RIS · BibTeX