An intrusion detection system for critical infrastructures: Modbus approach
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Varol and Iskefiyeli [49] constructed a hybrid dataset of Modbus/TCP-based ICS network traffic by combining a public Modbus attack dataset with normal traffic captured from the real CENTER SAU water system (240,000 packets, eight packet/protocol-level features).
“Varol and ˙ Iskefiyeli [49] constructed a hybrid dataset of Modbus/TCP-based ICS network traffic by combining a public Modbus attack dataset with normal traffic captured from the real CENTER SAU water system (240,000 packets, eight packet/protocol-level features).”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [49]
Even relatively simple ML/DL classifiers can benefit from carefully engineered protocol features.
“Third, the current work also highlights that even relatively simple ML/DL classifiers can benefit from carefully engineered protocol features.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [49]
Varol and Iskefiyeli evaluated DT, RF, SVM, KNN, NB, XGBoost, DNN, and ensemble models for binary classification of normal vs. attack packets.
“They evaluated DT, RF, SVM, KNN, NB, XGBoost, DNN, and ensemble models for binary classification of normal vs. attack packets.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [49]
Varol and Iskefiyeli show that a small set of packet/protocol-level Modbus features already enables high-accuracy binary classification of normal vs. attack traffic using conventional models (DT, RF, SVM, KNN, XGBoost, DNN, and ensembles).
“Varol and ˙ Iskefiyeli [49] show that a small set of packet/protocol-level Modbus features already enables high-accuracy binary classification of normal vs. attack traffic using conventional models (DT, RF, SVM, KNN, XGBoost, DNN, and ensembles),”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [49]
Protocol-aware methods are particularly suitable for detecting attacks that directly exploit industrial protocol semantics such as command and response injection, replay, spoofing, and MITM because they evaluate deviations in function codes, addressing schemes, request-response matching, and state-transition rules rather than only in coarse traffic statistics.
“First, protocol-aware methods are particularly suitable for detecting attacks that directly exploit industrial protocol semantics such as command and response injection, replay, spoofing, and MITM because they evaluate deviations in function codes, addressing schemes, request-response matching, and state-transition rules rather than only in coarse traffic statistics [47,49].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [49]
Even a small number of meaningful features, together with Modbus fields extracted via Wireshark post-dissectors, enable highly accurate detection of Modbus cyberattacks.
“Results demonstrated that even a small number of meaningful features, together with Modbus fields extracted via Wireshark post-dissectors, enable highly accurate detection of Modbus cyberattacks.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [49]
Cites
Accurate modeling of modbus/TCP for intrusion detection in SCADA systems
Goldenberg, N., & Wool, A. (2013) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2013.05.001 · Cited by 323 · see citing works
A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments
Siniosoglou, I., Grammatikis, P. I. R., Efstathopoulos, G., Fouliras, P., & Sarigiannidis, P. G. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3078381 · Cited by 277 · see citing works
Attack taxonomies for the Modbus protocols
Huitsing, P., Chandia, R., Papa, M., & Shenoi, S. (2008) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2008.08.003 · Cited by 249 · see citing works
An Ensemble of Deep Recurrent Neural Networks for Detecting IoT Cyber Attacks Using Network Traffic
Saharkhizan, M., Azmoodeh, A., Dehghantanha, A., Choo, K. R., & Parizi, R. M. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2996425 · Cited by 210 · see citing works
An ensemble deep learning model for cyber threat hunting in industrial internet of things
Yazdinejad, A., Kazemi, M., Parizi, R. M., Dehghantanha, A., & Karimipour, H. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.09.008 · Cited by 176 · see citing works
Network Traffic Anomaly Detection Using Recurrent Neural NetworksPreprint
Radford, B. J., Apolonio, L. M., Trias, A. J., & Simpson, J. A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.10769 · Cited by 120 · see citing works
Khan, I. A., Keshk, M., Pi, D., Khan, N., Hussain, Y., & Soliman, H. (2022) · Ad Hoc Networks · doi:10.1016/j.adhoc.2022.102930 · Cited by 110 · see citing works
Huda, S., Yearwood, J. L., Hassan, M. M., & Almogren, A. (2018) · Applied Soft Computing · doi:10.1016/j.asoc.2018.06.017 · Cited by 105 · see citing works
Antón, S. D. D., Kanoor, S., Fraunholz, D., & Schotten, H. D. (2018) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3230833.3232818 · Cited by 105 · see citing works
Saheed, Y. K., Misra, S., & Chockalingam, S. (2023) · IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) · doi:10.1109/encycris59249.2023.00006 · Cited by 74 · see citing works
Bukhari, S. M. S., Zafar, M. H., Houran, M. A., Qadir, Z., Moosavi, S. K. R., & Sanfilippo, F. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101252 · Cited by 67 · see citing works
Fooling the Master: Exploiting Weaknesses in the Modbus Protocol
Parian, C., Guldimann, T., & Bhatia, S. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.04.265 · Cited by 61 · see citing works
Rahman, A., Mustafa, G., Khan, A. Q., Abid, M., & Durad, M. H. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100568 · Cited by 46 · see citing works
Securing the IoT System of Smart City against Cyber Threats Using Deep Learning
Saba, T., Rehman, A. U., Sadad, T., & Hong, S.-P. (2022) · Discrete Dynamics in Nature and Society · doi:10.1155/2022/1241122 · Cited by 41 · see citing works
A survey on safeguarding critical infrastructures: Attacks, AI security, and future directions
Raval, K. J., Jadav, N. K., Rathod, T., Tanwar, S., Vimal, V., & Yamsani, N. (2023) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2023.100647 · Cited by 39 · see citing works
A Systematic Literature Review on RAMS analysis for critical infrastructures protection
Pirbhulal, S., Gkioulos, V., & Katsikas, S. K. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100427 · Cited by 37 · see citing works
Security of Machine Learning-Based Anomaly Detection in Cyber Physical Systems
Jadidi, Z., Pal, S., Nithesh Nayak, K., Selvakkumar, A., Chang, C.-C., Beheshti, M., & Jolfaei, A. (2022) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn54977.2022.9868845 · Cited by 32 · see citing works
Critical Infrastructure Protection VIII
Butts, J., & Shenoi, S. (2014) · IFIP advances in information and communication technology · doi:10.1007/978-3-662-45355-1 · Cited by 29 · see citing works
Securing Substations with Trust, Risk Posture, and Multi-Agent Systems: A Comprehensive Approach
Boakye-Boateng, K., Ghorbani, A. A., & Lashkari, A. H. (2023) · Conference on Privacy, Security and Trust · doi:10.1109/pst58708.2023.10320154 · Cited by 28 · see citing works
Gueye, T., Wang, Y., Rehman, M., Mushtaq, R. T., & Zahoor, S. (2023) · Cluster Computing · doi:10.1007/s10586-023-04028-4 · Cited by 27 · see citing works
Industrial Datasets with ICS Testbed and Attack Detection Using Machine Learning Techniques
Mubarak, S., Habaebi, M. H., Islam, M. R., Balla, A., Tahir, M., Elsheikh, E. A. A., & Suliman, F. M. (2021) · Intelligent Automation & Soft Computing · doi:10.32604/iasc.2022.020801 · Cited by 26 · see citing works
D-IDS for Cyber-Physical DER Modbus System - Architecture, Modeling, Testbed-based Evaluation
Ravikumar, G., Singh, A. K., Babu, J. R., Abdelkhalek Moataz, A., & Govindarasu, M. (2020) · Resilience Week (RWS) · doi:10.1109/rws50334.2020.9241259 · Cited by 25 · see citing works
SMS Spam Detection System Based on Deep Learning Architectures for Turkish and English Messages
Altunay, H. C., & Albayrak, Z. (2024) · Applied Sciences · doi:10.3390/app142411804 · Cited by 23 · see citing works
An efficient evolutionary deep learning-based attack prediction in supply chain management systems
Chauhdary, S. H., Alkatheiri, M. S., Alqarni, M., & Saleem, S. (2023) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2023.108768 · Cited by 18 · see citing works
Ghosh, T., Bagui, S. S., Bagui, S. C., Kadzis, M., & Bare, J. (2023) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp3040041 · Cited by 17 · see citing works
Zhang, H., Min, Y., Liu, S., Tong, H., Li, Y., & Lv, Z. (2023) · Mobile Networks and Applications · doi:10.1007/s11036-023-02108-8 · Cited by 16 · see citing works
CENTER Water: A Secure Testbed Infrastructure Proposal For Waste and Potable Water Management
Özçeli̇k, İ., İskefiyeli, M., Balta, M., Akpinar, K. O., & TOKER, F. S. (2021) · International Symposium on Digital Forensics and Security (ISDFS) · doi:10.1109/isdfs52919.2021.9486364 · Cited by 15 · see citing works
Self-citationModbus/RS-485 Attack Detection on Communication Signals with Machine Learning
Ochiai, H., Hossain, M. D., Chirupphapa, P., Kadobayashi, Y., & Esaki, H. (2023) · IEEE Communications Magazine · doi:10.1109/mcom.002.2200553 · Cited by 15 · see citing works
Assessment of Hidden Channel Attacks: Targetting Modbus/TCP
Lamshöft, K., & Dittmann, J. (2020) · IFAC-PapersOnLine · doi:10.1016/j.ifacol.2020.12.258 · Cited by 14 · see citing works
Anomaly Detection Sensors for a Modbus-Based Oil and Gas Well-Monitoring System
He, X., Robards, E., Gamble, R., & Papa, M. (2019) · International Conference on Data Intelligence and Security (ICDIS) · doi:10.1109/icdis.2019.00008 · Cited by 12 · see citing works
Smart Meter Modbus RS-485 Intrusion Detection by Federated Learning Approach
Hossain, M. D., Ochiai, H., Khan, L. R., & Kadobayashi, Y. (2023) · International Conference on Computer and Automation Engineering · doi:10.1109/iccae56788.2023.10111132 · Cited by 12 · see citing works
MOSTO: A toolkit to facilitate security auditing of ICS devices using Modbus/TCP
Rodríguez, R. J., Marrone, S., Marcos, I., & Porzio, G. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103373 · Cited by 12 · see citing works
Development of Intrusion Detection in Industrial Control Systems Based On Deep Learning
Monfared, M. R., & Fakhrahmad, S. M. (2022) · Iranian Journal of Science and Technology Transactions of Electrical Engineering · doi:10.1007/s40998-022-00493-6 · Cited by 10 · see citing works
Zarzycki, K., Chaber, P., Cabaj, K., Ławryńczuk, M., Marusak, P. M., Nebeluk, R., Plamowski, S., & Wojtulewicz, A. (2023) · IEEE Access · doi:10.1109/access.2023.3277250 · Cited by 10 · see citing works
Jiang, J., & Lin, Y.-T. (2022) · Sensors · doi:10.3390/s22239084 · Cited by 9 · see citing works
Cybersecurity-aware log management system for critical water infrastructures
Balta, D., Kaç, S. B., Balta, M., Oğur, N. B., & Eken, S. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.112613 · Cited by 9 · see citing works
RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection
Du, Y., Zhang, S., Wan, G., Zhou, D., Lu, J., Huang, Y., Cheng, X., Zhang, Y., & He, P. (2023) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.035919 · Cited by 8 · see citing works
Anomaly Detection in Air-Gapped Industrial Control Systems of Nuclear Power Plants
Thiyagarajan, K., & Hammad, I. (2024) · doi:10.1109/cars61786.2024.10778886 · Cited by 7 · see citing works
Design of Intrusion Prevention System for OT Networks Using Deep Neural Networks
Rajapkar, A., Binnar, P., & Kazi, F. (2020) · International Conference on Computing, Communication and Networking Technologies (ICCCNT) · doi:10.1109/icccnt49239.2020.9225339 · Cited by 6 · see citing works
MODLSTM: A Method to Recognize DoS Attacks on Modbus/TCP
Zhang, H., Min, Y., Liu, S., Tong, H., & Li, Y. (2022) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc55026.2022.9894305 · Cited by 6 · see citing works
Almendli, M., & Bagherzadeh, J. (2024) · International Journal of Power Electronics and Drive Systems/International Journal of Electrical and Computer Engineering · doi:10.11591/ijece.v14i6.pp6827-6837 · Cited by 6 · see citing works
Baxley, S., Bastin, N., Gurkan, D., & Conklin, W. A. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100573 · Cited by 4 · see citing works
Malware communication in smart factories: A network traffic data set
Brenner, B., Fabini, J., Offermanns, M., Semper, S., & Zseby, T. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110804 · Cited by 4 · see citing works
Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used
Holasová, E., & Fujdiak, R. (2022) · IEEE International Carnahan Conference on Security Technology (ICCST) · doi:10.1109/iccst52959.2022.9896532 · Cited by 2 · see citing works
Deep Learning-based Multi-PLC Anomaly Detection in Industrial Control Systems
Gawehn, P., Ergenç, D., & Fischer, M. (2022) · Globecom · doi:10.1109/globecom48099.2022.10001315 · Cited by 2 · see citing works
Modbus Vulnerability: Hard-to-Detect Sabotage Scenario
Bartyś, M., & Włodarczyk, O. (2024) · IFAC-PapersOnLine · doi:10.1016/j.ifacol.2024.07.268 · Cited by 2 · see citing works
Critical Information Infrastructures Security
Nadjm-Tehrani, S. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-99843-5 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Al-tarawneh, K. M., Sharieh, A., & Baddar, S. W. A.-H. (2026) · Applied Sciences · doi:10.3390/app16136545 · Cited by 1 · see citing works
AI-enabled cyber threat detection for IoT-based critical infrastructure
Dey, A. K., Gupta, G. P., & Sahu, S. P. (2026) · Advances in computers · doi:10.1016/bs.adcom.2026.03.003
AbdulJawad, M., Masoud, M. Z., Alesanco, Á., & García, J. (2026) · Future Internet · doi:10.3390/fi18050259
Razzaq, K., Shah, M., & Abbasi, S. I. (2026) · Asian Journal of Criminology · doi:10.1007/s11417-026-09505-4
Privacy-preserving SCADA systems: a hybrid encryption approach
Guo, X., & Zhao, D. (2026) · The Journal of Supercomputing · doi:10.1007/s11227-026-08823-9
Design and Implementation of Serial Communication for AB PLC Based on Anybus Gateway
Li, H. (2026) · International Conference on Computer Information and Big Data Applications (CIBDA) · doi:10.1145/3813822.3813975
Kanwal, S., Rafique, B., Amin, W., Munir, M., & Zhu, Y. (2026) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2026.100908
- Authors
- Varol, M., & İskefiyeli, M.
- Affiliations
- Sakarya University (TR)
- Corresponding author
- Varol, Murat
- Venue
- Engineering Applications of Artificial Intelligence
- Publisher
- Elsevier BV
- Published
- 2025-12
- Volume
- 162
- Pages
- 112410
- ISSN
- 0952-1976 (ISSN-L)
- OpenAlex
- W4414675475
- Cited by
- 8
- References
- 47
- Citations by year
- 2026: 7 · 2025: 1
- FWCI
- 3.38
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- Engineering Applications of Artificial Intelligence (publishedVersion)
- Zonguldak Bülent Ecevit University Institutional Repository (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- intrusion detection systems, critical infrastructure, Modbus, industrial control systems, network traffic classification, cyberattack detection, industrial cybersecurity, cyber-physical systems, ensemble learning, network traffic datasets
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
