1.School of Computer Science,，Minnan Normal University,，Zhangzhou 363000，China,； 2.Key Laboratory of Data Science and Intelligence Application,，Zhangzhou 363000，China,； 3.School of Physics and Information Engineering,，Minnan Normal University，Zhangzhou 363000,，China
Abstract： Aiming at the hidden security problems of Modbus_TCP protocol in industrial control systems, this paper proposes a Modbus_TCP communication anomaly detection method based on machine learning,analyzes the types and structural characteristics of Modbus_TCP messages, introduces the implementation process of decision tree classification model algorithm in machine learning, establishes the simulation communication of Modbus_TCP protocol, and uses Scapy tool to construct pseudo message to realize anomaly detection. The experiments of Naive Bayes classification model, logistic regression classification model and traditional support vector machine classification model are also set up to compare with the proposed method, and the accuracy, false positive rate, false negative rate and time performance of the models are analyzed. The analysis results show that the decision tree classification model has high accuracy, short time consumption, and certain advantages.
Key words : Modbus_TCP protocol,；industrial control system；decision tree algorithm,；anomaly detection
0 引言
隨著兩化融合進程的不斷加速,，工業(yè)控制系統(tǒng)逐漸接入互聯(lián)網(wǎng)，使得原本的“工業(yè)信息孤島”變得不再封閉,，但同時也不再安全,。近幾年，全球工控安全事件頻發(fā),，不僅帶來了巨大的經(jīng)濟損失,，同時也給人們的生活環(huán)境及人身安全帶來了巨大的影響。Modbus協(xié)議是工業(yè)控制系統(tǒng)(Industrial Control System,，ICS)中的一種常用的通信協(xié)議,，其具有實現(xiàn)簡單、部署方式多樣,、標(biāo)準(zhǔn)公開等諸多優(yōu)勢,，但同時也存在缺乏認證機制、授權(quán)機制,、加密機制和功能碼濫用等諸多缺陷,，給系統(tǒng)帶來了一定的安全威脅。
