Abnormal Traffic Detection Mechanism for Protecting IIoT Environments

In the last few decades, control systems have been upgraded from the standard serial bus systems to modern TCP/IP based systems. The Modbus protocol is one of the most widely used protocols in control systems. However, it provides no inherent security mechanisms. Therefore, the Modbus protocol is susceptible to the type of attack that injects false Modbus commands. For that reason, we propose an abnormal traffic detection mechanism by tracing Modbus/TCP transactions. The proposed method enables immediate and fast response to not only Denial-of-Service (DoS) attacks, which can be induced by a repetition of false Modbus commands, but also various types of accidents, which can be occurred inadvertently from things such as routing loops, misconfigured devices and human mistakes.