Modbus/RS-485 Attack Detection on Communication Signals with Machine Learning

Abstract

Modbus/RS-485 is one of the most popular standards used worldwide at the edges of industrial control systems (ICSs) as field buses. These networks were traditionally secured by isolating them from others, but nowadays, they are connected and function as components of a whole ICS. An attack on a field bus will deceive global control and can result in severe security incidents. In this paper, we propose a novel unobtrusive communication signal monitoring method for attack detection on this type of field bus with machine learning. We define five types of field-bus attacks and develop datasets with ground truth labels on our real-world testbed. In our performance evaluation, supervised learning with extreme gradient boosting (XGBoost) achieved the best with an accuracy of 0.9999 for attack detection and classification. 1D convolutional neural network (1D-CNN) achieved alternatively. Unsupervised learning with an MLP-autoencoder achieved the area under the curves of receiver operating characteristics between 0.9992 and 0.9999 for anomaly detection. These results indicate that our proposed unobtrusive monitoring method can achieve a high detection rate for field-bus attacks.