A Study of Passive Scanning-based Device Identification in Operational Technology Environments

To mitigate security risks, organizational assets must be identified and security vulnerabilities eliminated. active scanning and passive scanning techniques have been applied in existing IT environments to identify assets.. In this paper, we first examine the problems of applying the existing network scanning methods to OT systems. Then, to select network traffic features required when identifying OT devices by applying a passive scanning, we analyze network traffic features (TTL, TCP Window Size, IAT, etc.) used in prior studies on identifying IoT devices which have similar properties to OT devices. In addition, we recognize the types of network traffic features, and present research issues to be addressed for effective identification of OT devices.