Intrusion Detection Method Based on Support Vector Machine Access of Modbus TCP Protocol
Deng Li, Yisong Peng, Cancheng Liu, Xiaoshuai Xin, Yucen Xie · 2016
As the mix of industrial automation control system and the Internet, the industrial control system is becoming more and more vulnerable. The key of information security is how to detect and resist attacks on industrial control systems. This paper proposes a data preprocessing method, this method can convert ModbusTCP traffic into another data that the support vector machine model can identify. This method is based on the frequency of Modbus protocol function code and coil appear in ModbusTCP traffic to detect the abnormal Modbus TCP traffic.