UPDATE: Zenodo migration postponed to Oct 13 from 06:00-08:00 UTC. Read the announcement.

Conference paper Open Access

Implementation and Detection of Modbus Cyberattacks

Panagiotis Radoglou-Grammatikis; Ilias Siniosoglou; Thanasis Liatifis; Anastasios Kourouniadis; Konstantinos Rompolos; Panagiotis Sarigiannidis

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in Critical Infrastructures (CIs) since they monitor and control the automation processes of the industrial equipment. However, SCADA relies on vulnerable communication protocols without any cybersecurity mechanism, thereby making it possible to endanger the overall operation of the CI. In this paper, we focus on the Modbus/TCP protocol, which is commonly utilised in many CIs and especially in the electrical grid. In particular, our contribution is twofold. First, we study and enhance the cyberattacks provided by the Smod pen-testing tool. Second, we introduce an anomaly-based Intrusion Detection System (IDS) capable of detecting Denial of Service (DoS) cyberattacks related to Modbus/TCP. The efficacy of the proposed IDS is demonstrated by utilising real data stemming from a hydropower plant. The accuracy and the F1 score of the proposed IDS reach 81% and 77% respectively.

Files (281.1 kB)
Name Size
[14] Implementation and Detection of Modbus Cyberattacks A Case Study .pdf
281.1 kB Download
Views 60
Downloads 864
Data volume 242.9 MB
Unique views 59
Unique downloads 844


Cite as