Research on Modbus_TCP communication anomaly detection method based on machine learning
Chen Xinlong1，Chen Zhixiang1，2，Zhou Xiaofang2，3
1.School of Computer Science，Minnan Normal University，Zhangzhou 363000，China； 2.Key Laboratory of Data Science and Intelligence Application，Zhangzhou 363000，China； 3.School of Physics and Information Engineering，Minnan Normal University，Zhangzhou 363000，China
Abstract：Aiming at the hidden security problems of Modbus_TCP protocol in industrial control systems, this paper proposes a Modbus_TCP communication anomaly detection method based on machine learning,analyzes the types and structural characteristics of Modbus_TCP messages, introduces the implementation process of decision tree classification model algorithm in machine learning, establishes the simulation communication of Modbus_TCP protocol, and uses Scapy tool to construct pseudo message to realize anomaly detection. The experiments of Naive Bayes classification model, logistic regression classification model and traditional support vector machine classification model are also set up to compare with the proposed method, and the accuracy, false positive rate, false negative rate and time performance of the models are analyzed. The analysis results show that the decision tree classification model has high accuracy, short time consumption, and certain advantages.
Key words :Modbus_TCP protocol；industrial control system；decision tree algorithm；anomaly detection
0 引言
随着两化融合进程的不断加速，工业控制系统逐渐接入互联网，使得原本的“工业信息孤岛”变得不再封闭，但同时也不再安全。近几年，全球工控安全事件频发，不仅带来了巨大的经济损失，同时也给人们的生活环境及人身安全带来了巨大的影响。Modbus协议是工业控制系统(Industrial Control System，ICS)中的一种常用的通信协议，其具有实现简单、部署方式多样、标准公开等诸多优势，但同时也存在缺乏认证机制、授权机制、加密机制和功能码滥用等诸多缺陷，给系统带来了一定的安全威胁。
