Intrusion Detection of Industrial Control System Based on Modbus TCP Protocol
| Title | Intrusion Detection of Industrial Control System Based on Modbus TCP Protocol |
| Publication Type | Conference Paper |
| Year of Publication | 2017 |
| Authors | Yusheng, W., Kefeng, F., Yingxu, L., Zenghui, L., Ruikang, Z., Xiangzhen, Y., Lin, L. |
| Conference Name | 2017 IEEE 13th International Symposium on Autonomous Decentralized System (ISADS) |
| ISBN Number | 978-1-5090-4042-1 |
| Keywords | deep inspection, ICS Anomaly Detection, industrial control, industrial control system, industrial control systems, industrial network protocol, industrial traffic, Inspection, integrated circuits, Intrusion detection, Lenses, modbus TCP protocol, period, protocol parsing, Protocols, pubcrawl, resilience, Resiliency, rule extraction, Scalability, SD-IDS, security of data, semantic analysis, stereo depth IDS, telecommunication control, telecommunication traffic, transport protocols |
| Abstract | Modbus over TCP/IP is one of the most popular industrial network protocol that are widely used in critical infrastructures. However, vulnerability of Modbus TCP protocol has attracted widely concern in the public. The traditional intrusion detection methods can identify some intrusion behaviors, but there are still some problems. In this paper, we present an innovative approach, SD-IDS (Stereo Depth IDS), which is designed for perform real-time deep inspection for Modbus TCP traffic. SD-IDS algorithm is composed of two parts: rule extraction and deep inspection. The rule extraction module not only analyzes the characteristics of industrial traffic, but also explores the semantic relationship among the key field in the Modbus TCP protocol. The deep inspection module is based on rule-based anomaly intrusion detection. Furthermore, we use the online test to evaluate the performance of our SD-IDS system. Our approach get a low rate of false positive and false negative. |
| URL | https://ieeexplore.ieee.org/document/7940233/ |
| DOI | 10.1109/ISADS.2017.29 |
| Citation Key | yusheng_intrusion_2017 |
- protocol parsing
- transport protocols
- telecommunication traffic
- telecommunication control
- stereo depth IDS
- semantic analysis
- security of data
- SD-IDS
- Scalability
- rule extraction
- Resiliency
- resilience
- pubcrawl
- Protocols
- deep inspection
- period
- modbus TCP protocol
- Lenses
- Intrusion Detection
- integrated circuits
- Inspection
- industrial traffic
- industrial network protocol
- Industrial Control Systems
- industrial control system
- industrial control
- ICS Anomaly Detection