关键词: Modbus/TCP, 工控协议, 卷积神经网络, 异常报文检测, HOOK工具

Abstract: Aiming at the frequent vulnerabilities problem in Modbus/TCP protocol in industrial control system, we propose a Modbus/TCP anomaly message detection method based on convolutional neural network. By analyzing and summarizing the types of abnormal packets in Modbus/TCP, we design the convolution core of convolution neural network. Through simulation training of input dimension, convolution layer and convolution weight of neural network, we design the Modbus/TCP anomaly message detection model based on convolutional neural network, and use HOOK in Netfilter to embed the model into industrial firewall to realize the Modbus/TCP abnormal packets detection.

Key words: Modbus/TCP, industrial control protocol, convolutional neural network, abnormal packet detection, HOOK