Conference paper Open Access

Implementation and Detection of Modbus Cyberattacks

Panagiotis Radoglou-Grammatikis; Ilias Siniosoglou; Thanasis Liatifis; Anastasios Kourouniadis; Konstantinos Rompolos; Panagiotis Sarigiannidis

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in Critical Infrastructures (CIs) since they monitor and control the automation processes of the industrial equipment. However, SCADA relies on vulnerable communication protocols without any cybersecurity mechanism, thereby making it possible to endanger the overall operation of the CI. In this paper, we focus on the Modbus/TCP protocol, which is commonly utilised in many CIs and especially in the electrical grid. In particular, our contribution is twofold. First, we study and enhance the cyberattacks provided by the Smod pen-testing tool. Second, we introduce an anomaly-based Intrusion Detection System (IDS) capable of detecting Denial of Service (DoS) cyberattacks related to Modbus/TCP. The efficacy of the proposed IDS is demonstrated by utilising real data stemming from a hydropower plant. The accuracy and the F1 score of the proposed IDS reach 81% and 77% respectively.

Files (281.1 kB)
Name Size
[14] Implementation and Detection of Modbus Cyberattacks A Case Study .pdf
md5:8d9663227de1a789ca8cf1003371dd71
281.1 kB Download
39
409
views
downloads
Views 39
Downloads 409
Data volume 115.0 MB
Unique views 39
Unique downloads 401

Share

Cite as