中圖分類(lèi)號(hào)： TP309 文獻(xiàn)標(biāo)識(shí)碼： A DOI： 10.19358/j.issn.2096-5133.2020.10.011 引用格式： 陳鑫龍，陳志翔，周小方. 基于機(jī)器學(xué)習(xí)的Modbus_TCP通信異常檢測(cè)方法研究[J].信息技術(shù)與網(wǎng)絡(luò)安全，2020，39(10)：55-60.
Research on Modbus_TCP communication anomaly detection method based on machine learning
Chen Xinlong1，Chen Zhixiang1，2，Zhou Xiaofang2，3
1.School of Computer Science，Minnan Normal University，Zhangzhou 363000，China； 2.Key Laboratory of Data Science and Intelligence Application，Zhangzhou 363000，China； 3.School of Physics and Information Engineering，Minnan Normal University，Zhangzhou 363000，China
Abstract： Aiming at the hidden security problems of Modbus_TCP protocol in industrial control systems, this paper proposes a Modbus_TCP communication anomaly detection method based on machine learning,analyzes the types and structural characteristics of Modbus_TCP messages, introduces the implementation process of decision tree classification model algorithm in machine learning, establishes the simulation communication of Modbus_TCP protocol, and uses Scapy tool to construct pseudo message to realize anomaly detection. The experiments of Naive Bayes classification model, logistic regression classification model and traditional support vector machine classification model are also set up to compare with the proposed method, and the accuracy, false positive rate, false negative rate and time performance of the models are analyzed. The analysis results show that the decision tree classification model has high accuracy, short time consumption, and certain advantages.
Key words : Modbus_TCP protocol；industrial control system；decision tree algorithm；anomaly detection
0 引言
隨著兩化融合進(jìn)程的不斷加速，工業(yè)控制系統(tǒng)逐漸接入互聯(lián)網(wǎng)，使得原本的“工業(yè)信息孤島”變得不再封閉，但同時(shí)也不再安全。近幾年，全球工控安全事件頻發(fā)，不僅帶來(lái)了巨大的經(jīng)濟(jì)損失，同時(shí)也給人們的生活環(huán)境及人身安全帶來(lái)了巨大的影響。Modbus協(xié)議是工業(yè)控制系統(tǒng)(Industrial Control System，ICS)中的一種常用的通信協(xié)議，其具有實(shí)現(xiàn)簡(jiǎn)單、部署方式多樣、標(biāo)準(zhǔn)公開(kāi)等諸多優(yōu)勢(shì)，但同時(shí)也存在缺乏認(rèn)證機(jī)制、授權(quán)機(jī)制、加密機(jī)制和功能碼濫用等諸多缺陷，給系統(tǒng)帶來(lái)了一定的安全威脅。
