VIRTUAL CYBER TESTING RANGE FOR MODBUS-BASED ICS FOR ANOMALY DETECTION USING MACHINE LEARNING
DOI:
https://doi.org/10.56132/2791-3368-2026-3-67-193-202Keywords:
industrial control systems, cyber threats, Modbus TCP, machine learning, anomaly detection, network securityAbstract
This research shows experiments for anomaly detection with machine learning models in the Modbus Transmission Control Protocol system. It uses a range of testbeds, emulated in Mininet, Supervisory Control and Data Acquisition, and operational technology environments that are connected through virtual network routers and traffic monitoring tools. Normal records were generated with periodic virtual controllers, whereas Denial-of-service (DoS) records were created to present integrity attacks. Scapy technology was used to extract important characteristics of the received traffic, such as protocol types, packet sizes, traffic timing, and packet size variability. The dataset consisted of 500 records, including 280 legitimate data, 100 DoS attacks, and 120 False Data Injection (FDI). It was supplemented with 10% noise to create realistic classification conditions. Classification was performed using logistic regression, support vector machine, and random forest algorithms. The results were evaluated using accuracy, precision, recall, and F1-score metrics. Comparing the results, the logistic regression model showed the best results: accuracy - 0.888, precision - 0.894, recall - 0.888, f1-score 0.885. In summary, the obtained data demonstrated that a fully virtualized cyber-attack detection environment is effective and secure for industrial traffic generation and threat detection testing. It was also demonstrated that it can provide a scalable system.
Downloads
References
1. Genge B., Siaterlis C., Nai Fovino I., Masera M. (2012) A cyber-physical experimentation environment for the security analysis of networked industrial control systems. Computers & Electrical Engineering. 2012. - Vol. 38, No.5. P. 1146-1161. DOI: 10.1016/j.compeleceng.2012.06.015.
2. Antonioli D., Tippenhauer N. O. (2015) MiniCPS: A toolkit for security research on CPS networks. Proceedings of the First ACM Workshop on Cyber-Physical Systems Security and Privacy. - New York: ACM, 2015. P.91-100. DOI: 10.1145/2808705.2808715.
3. Mathur A. P., Tippenhauer N. O. (2016) SWaT: A water treatment testbed for research and training on ICS security. 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater). Vienna: IEEE, 2016. P. 31–36. - DOI: 10.1109/CySWater.2016.7469060.
4. Pospisil O., Fujdiak R., Mlynek P., Misurec J. (2021) Application perspective on cybersecurity testbed for industrial control systems. Sensors. 2021. Vol. 21, No.23. Art. 8119. DOI: 10.3390/s21238119.
5. Dehlaghi-Ghadim A., Balador A., Helali Moghadam M., Hansson H., Conti M. (2023) ICSSIM: A framework for building industrial control systems security testbeds. Computers in Industry. 2023. Vol.148. Art.103906. DOI: 10.1016/j.compind.2023.103906.
6. Goldenberg N., Wool A. (2013) Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems. International Journal of Critical Infrastructure Protection. 2013. Vol. 6, No. 2. P. 63-75. DOI: 10.1016/j.ijcip.2013.05.001
7. Ghosh T., Al-Shaer E., Rahman M. (2023) Anomaly detection for Modbus over TCP in control systems using entropy and classification-based analysis. Journal of Cybersecurity and Privacy. 2023. Vol.3, No.4. P. 895-913. DOI: 10.3390/jcp3040041.
8. Duque Anton S., Kanoor S., Fraunholz D., Schotten H. D. (2018) Evaluation of machine learning-based anomaly detection algorithms on an industrial Modbus/TCP data set. Proceedings of the 13th International Conference on Availability, Reliability and Security. New York: ACM, 2018. Art. 41. P. 1-9. DOI: 10.1145/3230833.3232818.
9. Duque Anton S. D., Sinha S., Schotten H. D. (2019) Anomaly-based intrusion detection in industrial data with SVM and Random Forests. 2019 International Conference on Software, Telecommunications and Computer Networks (SoftCOM). Split: IEEE, 2019. P.1–6. DOI: 10.23919/SOFTCOM.2019.8903672.
10. Gómez Á. L. P., Maimó L. F., Celdrán A. H. et al. (2019) On the generation of anomaly detection datasets in industrial control systems. IEEE Access. 2019. Vol. 7. P. 177460-177473. DOI: 10.1109/ACCESS.2019.2958284.
11. Dehlaghi-Ghadim A., Helali Moghadam M., Balador A., Hansson H. (2023) Anomaly detection dataset for industrial control systems. IEEE Access. 2023. Vol. 11. P. 107866-107880. DOI: 10.1109/ACCESS.2023.3319379.
