中圖分類號： TP309 文獻標識碼： A DOI： 10.19358/j.issn.2096-5133.2020.10.011 引用格式： 陳鑫龍，陳志翔，周小方. 基于機器學習的Modbus_TCP通信異常檢測方法研究[J].信息技術與網絡安全，2020，39(10)：55-60.
Research on Modbus_TCP communication anomaly detection method based on machine learning
Chen Xinlong1，Chen Zhixiang1，2，Zhou Xiaofang2，3
1.School of Computer Science，Minnan Normal University，Zhangzhou 363000，China； 2.Key Laboratory of Data Science and Intelligence Application，Zhangzhou 363000，China； 3.School of Physics and Information Engineering，Minnan Normal University，Zhangzhou 363000，China
Abstract： Aiming at the hidden security problems of Modbus_TCP protocol in industrial control systems, this paper proposes a Modbus_TCP communication anomaly detection method based on machine learning,analyzes the types and structural characteristics of Modbus_TCP messages, introduces the implementation process of decision tree classification model algorithm in machine learning, establishes the simulation communication of Modbus_TCP protocol, and uses Scapy tool to construct pseudo message to realize anomaly detection. The experiments of Naive Bayes classification model, logistic regression classification model and traditional support vector machine classification model are also set up to compare with the proposed method, and the accuracy, false positive rate, false negative rate and time performance of the models are analyzed. The analysis results show that the decision tree classification model has high accuracy, short time consumption, and certain advantages.
Key words : Modbus_TCP protocol；industrial control system；decision tree algorithm；anomaly detection
0 引言
隨著兩化融合進程的不斷加速，工業控制系統逐漸接入互聯網，使得原本的“工業信息孤島”變得不再封閉，但同時也不再安全。近幾年，全球工控安全事件頻發，不僅帶來了巨大的經濟損失，同時也給人們的生活環境及人身安全帶來了巨大的影響。Modbus協議是工業控制系統(Industrial Control System，ICS)中的一種常用的通信協議，其具有實現簡單、部署方式多樣、標準公開等諸多優勢，但同時也存在缺乏認證機制、授權機制、加密機制和功能碼濫用等諸多缺陷，給系統帶來了一定的安全威脅。
