Identifying Exposed ICS Remote Management Device using Multimodal Feature in the Wild
Liuxing Su, Zhenzhen Li, Gaopeng Gou, Zhen Li, Gang Xiong, Chengshang Hou · 2023
Industrial Control System (ICS) devices with Internet-accessible IP addresses are critical to the smooth functioning of industries, power grids, and other critical infrastructures. Previous methods used to identify ICS devices exposed to the Internet often ignored these remotely managed devices. Specifically, these systems, which do not openly provide ICS-specific port services, remain undetected during Internet-wide scans for such services. The existing method for scanning and discovering this part of remote management devices has a single feature extraction, and discovering such remote management devices is inefficient. In this paper, we propose a novel strategy dedicated to identifying exposed remote managed devices on the Internet by using multidimensional approaches, such as traffic periodicity analysis, device customized field identification, key content extraction via image-to-text conversion, and remote management device access HTTP traffic feature analysis. We have effectively identified 26 different types of remote management devices in Japan, comprising a total of 983 exposed devices, in a shorter timeframe. When juxtaposed with previous methods, our strategy has identified more devices faster. Therefore, our method holds considerable potential for identifying and reducing the attack surface of critical infrastructures on the Internet. Furthermore, it also has substantial significance for protecting global network security.