The DOI matches its Crossref record; 18 of the 21 references it cites were found in a registry or an index.
Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To simulate the control networks, e.g.Modbus, Allen-Bradley Data Highway, TASSCS uses Opnet tool and to simulate the operation behaviour; it uses PowerWorldi simulation system.”
From Architecture and security of SCADA systems: A review (2021) · cites this paper as [106]
In the citing paper
“virtual testbed”
From Architecture and security of SCADA systems: A review (2021) · cites this paper as [106]
In the citing paper
“Modbus”
From Architecture and security of SCADA systems: A review (2021) · cites this paper as [106]
Citations
Cites
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094
Security problems in the TCP/IP protocol suite
Bellovin, S. (1989) · ACM SIGCOMM Computer Communication Review · doi:10.1145/378444.378449 · Cited by 559
Using Model-based Intrusion Detection for SCADA Networks
Cheung, S. W., Dutertre, B., Fong, M. W., Lindqvist, U., Skinner, K., & Valdes, A. (2006) · Cited by 321
On SCADA control system command and response injection and intrusion detection
Gao, W., Morris, T. H., Reaves, B., & Richey, D. (2010) · eCrime Researchers Summit (eCrime) · doi:10.1109/ecrime.2010.5706699 · Cited by 187
Stuxnet, the real start of cyber warfare? [Editor's Note]
Chen, T. (2010) · IEEE Network · doi:10.1109/mnet.2010.5634434 · Cited by 168
A testbed for analyzing security of SCADA control systems (TASSCS)
Mallouhi, M., Al-Nashif, Y., Cox, D., Chadaga, T., & Hariri, S. (2011) · ISGT 2011 · doi:10.1109/isgt.2011.5759169 · Cited by 164
Modbus/DNP3 State-Based Intrusion Detection System
Fovino, I. N., Carcano, A., Murel, T. D. L., Trombetta, A., & Masera, M. (2010) · International Conference on Advanced Information Networking and Applications (AINA) · doi:10.1109/aina.2010.86 · Cited by 153
Smart grids, smart cities need better networks [Editor's Note
Chen, T. (2010) · IEEE Network · doi:10.1109/mnet.2010.5430136 · Cited by 138
Tsang, C.-H., & Kwong, S. (2006) · IEEE International Conference on Industrial Technology (ICIT) · doi:10.1109/icit.2005.1600609 · Cited by 107
Communication pattern anomaly detection in process control systems
Valdes, A., & Cheung, S. (2009) · IEEE Conference on Technologies for Homeland Security (HST) · doi:10.1109/ths.2009.5168010 · Cited by 106
Research works printed but not linked: 1
- D. Yang, A. Usynin, J. Hines, Anomaly-based intrusion detection for SCADA systems, in: Proceedings of the Fifth International Topical Meeting on Nuclear Plant Instrumentation, Control and Human–Machine Interface Technologies, 2006, pp. 12–16.
Cited by
Sorted by citations
In-vehicle network intrusion detection using deep convolutional neural network
Song, H. M., Woo, J., & Kim, H. K. (2019) · Vehicular Communications · doi:10.1016/j.vehcom.2019.100198 · Cited by 595
Challenges and Opportunities in Securing the Industrial Internet of Things
Serror, M., Hack, S., Henze, M., Schuba, M., & Wehrle, K. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3023507 · Cited by 381
“This includes the business case for technical tools (e. g., IDSs and access logs), appropriate resources (e. g., incident response teams), and security training of employees.”
InfluentialA survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344
“Goldenberg and Wool [86] implement state-based anomaly detection for Modbus/TCP networks using a deterministic finite automaton.”
MethodA Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics
Pliatsios, D., Sarigiannidis, P., Lagkas, T., & Sarigiannidis, A. G. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2987688 · Cited by 320
“Goldenberg and Wool [103] modeled the Modbus communication traffic using Deterministic Finite Automation (DFA).”
MethodArchitecture and security of SCADA systems: A review
Yadav, G., & Paul, K. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100433 · Cited by 261
Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems
Grammatikis, P. I. R., & Sarigiannidis, P. G. (2019) · IEEE Access · doi:10.1109/access.2019.2909807 · Cited by 229
An Ensemble of Deep Recurrent Neural Networks for Detecting IoT Cyber Attacks Using Network Traffic
Saharkhizan, M., Azmoodeh, A., Dehghantanha, A., Choo, K. R., & Parizi, R. M. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2996425 · Cited by 219
“In another study, Goldenberg and Wool [15] modeled the behavior of the Modbus protocol to detect intrusions using deterministic finite automaton (DFA).”
BackgroundMethodSequence-aware Intrusion Detection in Industrial Control Systems
Caselli, M., Zambon, E., & Kargl, F. (2015) · ACM Workshop on Cyber-Physical System Security (CPSS) · doi:10.1145/2732198.2732200 · Cited by 169
“Goldenberg et al. [9] focus on a protocol (Modbus) and use a deterministic finite automaton ( ) to build a model from real traffic traces.”
Zhou, C., Huang, S., Xiong, N. N., Yang, S., Li, H., Qin, Y., & Li, X. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2415763 · Cited by 168
“Goldenberg and Wool [16] proposed a model-based intrusion detection system designed specifically”
BackgroundMethodInfluentialIndustrial Control System Network Intrusion Detection by Telemetry Analysis
Ponomarev, S., & Atkison, T. (2015) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2015.2443793 · Cited by 147
“Sayegh et al. [15] proposed an IDS which uses temporal packet data to identify traffic anomalies.”
BackgroundA Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems
Feng, C., Palleti, V. R., Mathur, A. P., & Chana, D. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23265 · Cited by 129
“Furthermore, such methods are less general because they are often designed for specific protocols such as Modbus [13], [14], [15] and DNP3 [16].”
MethodCurrent cyber-defense trends in industrial control systems
Rubio, J. E., Alcaraz, C., Roman, R., & Lopez, J. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.015 · Cited by 113
“Namely, industrial communication protocols working with Ethernet and TCP/IP, such as Ethernet/IP, Ethernet POWERLINK, CANopen, PROFINET, Modbus/TCP or HART/IP; and also fieldbus protocols (e.g., HART, wirelessHART, etherCAP, IO-Link).”
BackgroundInfluentialCyber security for fog-based smart grid SCADA systems: Solutions and challenges
Ferrag, M. A., Babaghayou, M., & Yazıcı, M. A. (2020) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102500 · Cited by 109
Anomaly Detection for Industrial Control System Based on Autoencoder Neural Network
Wang, C., Wang, B., Liu, H., & Qu, H. (2020) · Wireless Communications and Mobile Computing · doi:10.1155/2020/8897926 · Cited by 99
Network intrusion detection system for DDoS attacks in ICS using deep autoencoders
Ortega-Fernandez, I., Sestelo, M., Burguillo, J. C., & Piñón-Blanco, C. (2023) · Wireless Networks · doi:10.1007/s11276-022-03214-3 · Cited by 104
“The papers [12, 16, 34] utilise network traffic to establish a pattern of conventional MODBUS/TCP communications.”
An enhanced optimization based algorithm for intrusion detection in SCADA network
Selvarajan, S., & David, P. W. (2017) · Computers & Security · doi:10.1016/j.cose.2017.04.012 · Cited by 95
“Goldenberg and Wool (2013) designed a model-based IDS based on the key observation for SCADA systems.”
MethodA fog computing based approach to DDoS mitigation in IIoT systems
Zhou, L., Guo, H., & Deng, G. (2019) · Computers & Security · doi:10.1016/j.cose.2019.04.017 · Cited by 95
On Ladder Logic Bombs in Industrial Control Systems
Govil, N., Agrawal, A., & Tippenhauer, N. O. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-72817-9_8 · Cited by 90
“A similar IDS is proposed in [8], where the authors model periodic communication between HMI and PLCs using a deterministic finite automata.”
BackgroundAnalysis of cyber security for industrial control systems
Drias, Z., Serhrouchni, A., & Vogel, O. (2015) · International Conference on Security of Smart Cities, Industrial Control System and Communications (SSIC) · doi:10.1109/ssic.2015.7245330 · Cited by 89
Control variable classification, modeling and anomaly detection in Modbus/TCP SCADA systems
Erez, N., & Wool, A. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.05.001 · Cited by 87
Intrusion Detection and Prevention for ZigBee-Based Home Area Networks in Smart Grids
Jokar, P., & Leung, V. C. M. (2016) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2016.2600585 · Cited by 86
“In [15] and [16] model-”
Cyber-attack detection in SCADA systems using temporal pattern recognition techniques
Kalech, M. (2019) · Computers & Security · doi:10.1016/j.cose.2019.03.007 · Cited by 82
Internet-scale Probing of CPS: Inference, Characterization and Orchestration Analysis
Fachkha, C., Bou‐Harb, E., Keliris, A., Memon, N. D., & Ahamad, M. (2017) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2017.23149 · Cited by 81
Industrial control systems security: What is happening?
Krotofil, M., & Gollmann, D. (2013) · IEEE International Conference on Industrial Informatics (INDIN) · doi:10.1109/indin.2013.6622964 · Cited by 74
False sequential logic attack on SCADA system and its physical impact analysis
Li, W., Xie, L., Deng, Z., & Wang, Z. (2016) · Computers & Security · doi:10.1016/j.cose.2016.01.001 · Cited by 71
Saheed, Y. K., Misra, S., & Chockalingam, S. (2023) · IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) · doi:10.1109/encycris59249.2023.00006 · Cited by 74
“The authors [16] implement a deterministic finite automaton (DFA) for each”
BackgroundAccurate Modeling of the Siemens S7 SCADA Protocol for Intrusion Detection and Digital Forensics
Kleinmann, A., & Wool, A. (2014) · The journal of digital forensics, security and law · doi:10.15394/jdfsl.2014.1169 · Cited by 69
“• The ROSCTR (Remote Service Control) field can take the values: 0x01 (request), 0x02 (acknowledge), 0x03 (response), 0x07 (request user data), or 0x08 request and response in our data.”
BackgroundMethodInfluentialCyber attack and defense on industry control systems
Lin, C.-T., Wu, S., & Lee, M.-L. (2017) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/desec.2017.8073874 · Cited by 68
Anomaly Detection in Real-Time Multi-Threaded Processes Using Hardware Performance Counters
Krishnamurthy, P., Karri, R., & Khorrami, F. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2923577 · Cited by 68
“monitoring of network traffic have been proposed, for example, in [30] and [31].”
BackgroundMethodA Large-Scale Empirical Study on the Vulnerability of Deployed IoT Devices
Zhao, B., Ji, S., Lee, W., Lin, C., Weng, H., Wu, J., Zhou, P., Fang, L., & Beyah, R. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3037908 · Cited by 64
“Moreover, ModbusGW is an essential part of the IoT ecosystem that has been widely adopted in a great number of application scenarios, such as connecting PLCs in the SCADA network [35].”
BackgroundA method for evaluating the consequence propagation of security attacks in cyber–physical systems
Orojloo, H., & Azgomi, M. A. (2016) · Future Generation Computer Systems · doi:10.1016/j.future.2016.07.016 · Cited by 64
Wan, M., Shang, W., & Zeng, P. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2730581 · Cited by 59
“Goldeberg and Wool [16] use a unique DFA (Deterministic Finite Automation) associated with each HMI-PLC channel to flag anomalies in Modbus/TCP networks.”
BackgroundMethodFrazão, I., Abreu, P. H., Cruz, T., Araújo, H. J., & Simões, P. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05849-4_19 · Cited by 59
Vosughi, A., Tamimi, A., King, A. B., Majumder, S., & Srivastava, A. K. (2022) · Renewable and Sustainable Energy Reviews · doi:10.1016/j.rser.2022.112794 · Cited by 58
SCADAWall: A CPI-enabled firewall model for SCADA security
Li, D., Guo, H., Zhou, J., Zhou, L., & Wong, J. W. (2018) · Computers & Security · doi:10.1016/j.cose.2018.10.002 · Cited by 53
A cyber-physical model for SCADA system and its intrusion detection
Sheng, C., Yao, Y. K., Fu, Q., & Yang, W. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107677 · Cited by 53
Deep autoencoders as anomaly detectors: Method and case study in a distributed water treatment plant
Raman, M. R. G., Dong, W., & Mathur, A. P. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102055 · Cited by 52
Phillips, B., Gamess, E., & Krishnaprasad, S. (2020) · ACM Southeast Regional Conference (ACMSE) · doi:10.1145/3374135.3385282 · Cited by 53
“Goldenberg and Wool [16] have developed a model-based network intrusion detection system derived from normal Modbus/TCP traffic patterns.”
BackgroundImplementation and Detection of Modbus Cyberattacks
Grammatikis, P. I. R., Siniosoglou, I., Liatifis, A., Kourouniadis, A., Rompolos, K., & Sarigiannidis, P. G. (2020) · International Conference on Modern Circuits and Systems Technologies · doi:10.1109/mocast49295.2020.9200287 · Cited by 48
“Accordingly, in [8] N. Goldenberg and A. Wool presented a relevant anomaly-based IDS, which relies on a Deterministic Finite Automaton (DFA).”
MethodIndustrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network
Lai, Y., Zhang, J., & Liu, Z. (2019) · Security and Communication Networks · doi:10.1155/2019/8124254 · Cited by 48
“For the high periodicity of an industrial control system flow, Goldenberg and Wool [10] used a deterministic finite automaton (DFA) for each HMI-PLC channel’s modeling to construct an accurate flow detection model.”
MethodIDS Detection Based on Optimization Based on WI-CS and GNN Algorithm in SCADA Network
Selvarajan, S., Satheesh, N., Kumar, B. P., & Sangeetha, K. (2021) · Lecture notes in networks and systems · doi:10.1007/978-981-16-0386-0_14 · Cited by 45
Security of Programmable Logic Controllers and Related Systems: Today and Tomorrow
Alsabbagh, W., & Langendörfer, P. (2023) · IEEE Open Journal of the Industrial Electronics Society · doi:10.1109/ojies.2023.3335976 · Cited by 45
“Investigating scenarios that involve periodic Modbus/TCP traffic between HMIs and PLCs, Goldenberg, and Woo [127] devised individual DFA models for each communication channel.”
Exploiting traffic periodicity in industrial control networks
Barbosa, R. R. R., Sadre, R., & Pras, A. (2016) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2016.02.004 · Cited by 44
“Based on the observa- tion that traffic exchanged between a human–machine inter- face (HMI) and a programmable logic controller consists of requests for the same values being sent periodically, Gold- enberg and Wool attempted to model Modbus traffic using a deterministic finite automaton (DFA).”
BackgroundMethodInfluentialA Survey on Programmable Logic Controller Vulnerabilities, Attacks, Detections, and Forensics
Wang, Z., Zhang, Y., Chen, Y., Liu, H., Wang, B., & Wang, C. (2023) · Processes · doi:10.3390/pr11030918 · Cited by 42
Formal security assessment of Modbus protocol
Nardone, R., Rodríguez, R. J., & Marrone, S. (2016) · International Conference for Internet Technology and Secured Transactions · doi:10.1109/icitst.2016.7856685 · Cited by 41
“Similarly, in [13] the Modbus/TCP communication channel between assets was modeled using deterministic finite automaton, later used to detect intrusions by network packet analysis.”
MethodUnderstanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
Lin, C., & Nadjm‐Tehrani, S. (2018) · ACM Workshop on Cyber-Physical System Security (CPSS) · doi:10.1145/3198458.3198460 · Cited by 41
“As observed in earlier works [10, 12], SCADA traffic sometimes contains phase transitions.”
MethodResultStealthy Deception Attacks Against SCADA Systems
Kleinmann, A., Amichay, O., Wool, A., Tenenbaum, D., Bar, O., & Lev, L. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-72817-9_7 · Cited by 40
“Goldenberg & Wool [18] developed a model-based approach (the GW model) for Network anomaly detection based on the normal traffic pattern in Modbus SCADA networks using a Deterministic Finite Automata (DFA) to represent the cyclic traffic.”
BackgroundMethodInfluentialCybersecurity protection for power grid control infrastructures
Jarmakiewicz, J., Parobczak, K., & Maślanka, K. (2017) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2017.07.002 · Cited by 39
“Methods and mechanisms for attack and anomaly detection are presented in [5, 15, 23, 72], while research and development environments for evaluating cybersecurity solutions are discussed in [33, 60, 68].”
BackgroundTiming-Based Anomaly Detection in SCADA Networks
Lin, C., Nadjm‐Tehrani, S., & Asplund, M. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-99843-5_5 · Cited by 39
“[8], Goldenberg and Wool [9], and Kleinmann and Wool [10– 12] use deterministic finite automata to model the message sequences of IEC104, Modbus TCP and S7 respectively.”
BackgroundTime is of the Essence: Machine Learning-Based Intrusion Detection in Industrial Time Series Data
Antón, S. D. D., Ahrens, L., Fraunholz, D., & Schotten, H. D. (2018) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2018.00008 · Cited by 39
“State-based intrusion detection was evaluated by Goldenberg and Wool [16], Fovino et al.”
MethodWolsing, K., Wagner, E., Saillard, A., & Henze, M. (2022) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3545948.3545968 · Cited by 38
“[49] 2013 DFA P G# # # # B # # 1 0 Ñ Modbus Yoon et al.”
Experimental assessment of network design approaches for protecting industrial control systems
Genge, B., Graur, F., & Haller, P. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.07.005 · Cited by 36
Palleti, V. R., Tan, Y. C., & Lakshminarayanan, S. (2018) · Journal of Process Control · doi:10.1016/j.jprocont.2018.05.005 · Cited by 36
Detecting PLC control corruption via on-device runtime verification
García, L. A. R., Zonouz, S., Wei, D., & de Aguiar, L. P. (2016) · Resilience Week (RWS) · doi:10.1109/rweek.2016.7573309 · Cited by 35
“Offline intrusion detection solutions have been proposed to model PLC traffic as a deterministic finite automaton in [8] and [6].”
MethodSmart Grid Security : Innovative Solutions for a Modernized Grid
Skopik, F. (2015) · Cited by 35
Akpinar, K. O., & Özçeli̇k, İ. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3037050 · Cited by 35
“Wool and Goldenberg collected data and modeled the Modbus protocol by observing commands and memory accesses of the traffic patterns [38].”
MethodIndustrial control systems security: What is happening?
Krotofil, M., & Gollmann, D. (2013) · IEEE International Conference on Industrial Informatics (INDIN) · doi:10.1109/indin.2013.6622963 · Cited by 35
Anomaly detection in SCADA systems : a network based approach
Barbosa, R. R. R. (2014) · doi:10.3990/1.9789036536455 · Cited by 35
“[51] network anomaly measurement unaware Goldenberg and Wool [62] network anomaly measurement unaware Gonzalez and Papa [64] network anomaly testbed unaware Hadeli et al.”
BackgroundMethodInfluentialA Brief Survey of Security Approaches for Cyber-Physical Systems
Bou‐Harb, E. (2016) · IFIP International Conference on New Technologies, Mobility and Security (NTMS) · doi:10.1109/ntms.2016.7792424 · Cited by 33
“[22] proposed the use of Deterministic Finite Automata (DFA) to capture the behavior of the Modbus protocol.”
MethodDiPot: A Distributed Industrial Honeypot System
Cao, J., Li, W., Li, J., & Li, B. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-73830-7_30 · Cited by 31
Modeling Modbus TCP for intrusion detection
Faisal, M. A., Cárdenas, Á. A., & Wool, A. (2016) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2016.7860524 · Cited by 30
“That same year Goldenberg et al [1] proposed a way to automatically learn a DFA for Modbus TCP; in particular, they determine a periodic pattern of symbols which can be used as a reference for detecting anomalies.”
BackgroundMethodInfluentialKleinmann, A., & Wool, A. (2017) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3011018 · Cited by 30
“We hypothesize that in real multiplexed SCADA traces, the symbol uniqueness will be rather high (this is certainly the case for the S7 traces of [18, 19] and for the Modbus traces of [14].”
BackgroundMethodInfluentialAdvanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey
Gan, C., Lin, J., Huang, D.-W., Zhu, Q., & Tian, L. (2023) · Mathematics · doi:10.3390/math11143115 · Cited by 35
EDMAND: Edge-Based Multi-Level Anomaly Detection for SCADA Networks
Ren, W., Yardley, T. M., & Nahrstedt, K. (2018) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2018.8587533 · Cited by 29
“On the one hand, since traffic in SCADA usually follows periodic patterns [17]–[20], the packet count PC and average packet size APS in a certain period usually”
BackgroundIndustrial network-based behavioral anomaly detection in AI-enabled smart manufacturing
Kim, H., & Shon, T. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-022-04408-4 · Cited by 29
“Some studies have proposed signature or traffic pattern modeling based on the detailed meanings of the packet fields [6–8].”
BackgroundImplementing Man-in-the-Middle Attack to Investigate Network Vulnerabilities in Smart Grid Test-bed
Banik, S., Banik, T., Hossain, S. M. M., & Saha, S. K. (2023) · IEEE World AI IoT Congress (AIIoT) · doi:10.1109/aiiot58121.2023.10174478 · Cited by 29
SIDS: State-based intrusion detection for stage-based cyber physical systems
Khalili, A., Sami, A., Khozaei, A., & Pouresmaeeli, S. (2018) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2018.06.003 · Cited by 28
Security enhancement for software defined network using game theoretical approach
Anithaashri, T. P., Ravichandran, G., & Baskaran, R. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.04.014 · Cited by 27
PLC Guard: A practical defense against attacks on cyber-physical systems
Malchow, J.-O., Marzin, D., Klick, J., Kovács, R., & Roth, V. (2015) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2015.7346843 · Cited by 27
“[23] have proposed an approach that models Modbus/TCP in order to detect intrusions in SCADA systems.”
MethodKleinmann, A., & Wool, A. (2016) · doi:10.1145/2994487.2994490 · Cited by 27
“However, unlike [15, 18] they did not observe clear cyclic message patterns.”
BackgroundMethodInfluentialA New Burst-DFA model for SCADA Anomaly Detection
Markman, C., Wool, A., & Cárdenas, Á. A. (2017) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3140241.3140245 · Cited by 27
“Based on data from three different Dutch utilities, the authors found that only 35%-75% of the possible transitions in the DTMC were observed. strengthens the observations of a substantial sequentiality in SCADA communications [3, 15, 18].”
BackgroundMethodResultInfluentialA SCADA Intrusion Detection Framework that Incorporates Process Semantics
Nivethan, J., & Papa, M. (2016) · Annual Cyber and Information Security Research Conference (CISRC) · doi:10.1145/2897795.2897814 · Cited by 26
“All these research efforts differ from other anomaly detection approaches [13], [16], [17], [18], [19], [20], [21] in that they incorporate process semantics into the detection framework.”
BackgroundXu, L., Wang, B., Wu, X., Zhao, D., Zhang, L., & Wang, Z. (2021) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2021.3130602 · Cited by 26
A connection pattern-based approach to detect network traffic anomalies in critical infrastructures
Genge, B., Rusu, D. A., & Haller, P. (2014) · European Workshop on System Security · doi:10.1145/2592791.2592792 · Cited by 25
“INTRODUCTION The term Critical Infrastructure (CI) underlines the signi.cance of an infrastructure, which if disrupted or destroyed, would have a serious impact on the health, safety, security or economic well-being of citizens [10].”
BackgroundD-IDS for Cyber-Physical DER Modbus System - Architecture, Modeling, Testbed-based Evaluation
Ravikumar, G., Singh, A. K., Babu, J. R., Abdelkhalek Moataz, A., & Govindarasu, M. (2020) · Resilience Week (RWS) · doi:10.1109/rws50334.2020.9241259 · Cited by 25
“Recently, various IDS methodologies such as Modbus state-based IDS [25], deterministic finite automaton (DFA) based IDS for Modbus/TCP SCADA systems [26], semantic-based IDS [27], and Modbus/TCP packet inspection-based meth-ods [28]–[31] have been developed for detecting cyberattacks.”
MethodAttack detection and prevention in IoT-SCADA networks using NK-classifier
Justindhas, Y., & Jeyanthi, P. (2022) · Soft Computing · doi:10.1007/s00500-022-06921-3 · Cited by 25
“The literature (Goldenberg and Wool (2013)) recommended model-centered IDS on the basis of the key scrutiny for SCADA that looked deep into Modbus/TCP packets and generated an extremely meticulous traffic model.”
MethodAnomaly-Based Detection and Classification of Attacks in Cyber-Physical Systems
Kreimel, P., Eigner, O., & Tavolato, P. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3103155 · Cited by 25
“A similar approach by Goldenberg and Wool is proposed in [9].”
MethodSICARD, F., ZAMAI, É., & FLAUS, J.-M. (2019) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2019.03.020 · Cited by 25
Scaphy: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical
Ike, M., Phan, K., Sadoski, K., Valme, R., & Lee, W. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179411 · Cited by 24
“Flow-based approaches [8, 10, 11, 37] analyze abnormal function codes/channels, such as shown in [98, 99], but are evaded by attacks such as Industroyer, which uses legitimate HMIs.”
BackgroundInfluentialA Statechart-Based Anomaly Detection Model for Multi-Threaded SCADA Systems
Kleinmann, A., & Wool, A. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-33331-1_11 · Cited by 24
“This strengthens the observations of [13, 16] of a substantial sequentiality in the SCADA communications.”
BackgroundMethodInfluentialImplementation of error detection and correction in the Modbus-RTU serial protocol
Urrea, C., Morales, C., & Kern, J. (2016) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2016.07.001 · Cited by 24
Safeguarding Building Automation Networks: THE-Driven Anomaly Detector Based on Traffic Analysis
Zheng, Z., & Reddy, A. L. N. (2017) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn.2017.8038393 · Cited by 24
IEC 60870-5-104 Network Characterization of a Large-Scale Operational Power Grid
Mai, K., Qin, X., Ortiz, N., & Cárdenas, Á. A. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00051 · Cited by 24
“…security posture and do not allow external parties to easily access their networks; therefore most of the data analyzed by previous work represents SCADA systems in small geographical areas, including an energy monitoring system in a college campus [1], or a single distribution substation [4], [5].”
BackgroundResultIntrusion detection in SCADA systems by traffic periodicity and telemetry analysis
Zhang, J., Gan, S., Liu, X., & Zhu, P. (2016) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc.2016.7543760 · Cited by 24
“Goldenberg and Wool [12] used an deterministic finite automation (DFA) model to detect intrusions in Modbus/TCP traffic.”
MethodResultInfluentialGăitan, V. G., & Zagan, I. (2021) · Sensors · doi:10.3390/s21010246 · Cited by 24
“Scientific papers related to Modbus refer in particular to Modbus TCP/IP addressing issues related to the following, among others: use as a support for communication in distributed applications [4] (mostly SCADA [2]), the implementation of access gateways (for remote connection using a TCP/IP protocol stack [5] and wi…”
BackgroundTemporal pattern-based malicious activity detection in SCADA systems
Shlomo, A., Kalech, M., & Moskovitch, R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102153 · Cited by 23
A General Real-Time Control Approach of Intrusion Response for Industrial Automation Systems
Huang, S., Zhou, C., Xiong, N. N., Yang, S., Qin, Y., & Zhang, Q. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2469688 · Cited by 23
An intrusion detection method based on log sequence clustering of honeypot for Modbus TCP protocol
Wang, P.-H., Liao, I., Kao, K., & Huang, J.-Y. (2018) · 2018 IEEE International Conference on Applied System Invention (ICASI) · doi:10.1109/icasi.2018.8394581 · Cited by 23
Protocol study and anomaly detection for server-driven traffic in SCADA networks
Lin, C., & Nadjm‐Tehrani, S. (2023) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2023.100612 · Cited by 22
On the impact of empirical attack models targeting marine transportation
Bou‐Harb, E., Kaisar, E. I., & Austin, M. A. (2017) · IEEE International Conference on Models and Technologies for Intelligent Transportation Systems · doi:10.1109/mtits.2017.8005665 · Cited by 22
“[12] proposed the use of Deterministic Finite Automata (DFA) to capture the behavior of the Modbus protocol.”
MethodCompact Modbus TCP/IP protocol for data acquisition systems based on limited hardware resources
Bai, Q., Jin, B., Wang, D., Wang, Y., & Liu, X. (2018) · Journal of Instrumentation · doi:10.1088/1748-0221/13/04/t04004 · Cited by 22
“Originally, the Modbus TCP/IP protocol typically runs on a PC-based human-machine interface to communicate with programmable logic controllers (PLCs) especially in supervisory control and data acquisition (SCADA) systems [22].”
Lu, S., Wang, K., Zhang, L., & Wang, B. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.118345 · Cited by 21
“Classical techniques integrate the Convolutional Neural Networks (CNNs) and the Long Short Term Memory modules (LSTMs) (Dey, 2020) (Abdallah et al., 2021) (Sinha and Manollas, 2020) as their core building components to perform feature extraction over the Abbreviations: ICS, Industrial Control System; AAE, Adversarial…”
BackgroundMethodInfluentialSecure Communications in Smart Grid: Networking and Protocols
McLaughlin, K., Friedberg, I., Kang, B., Maynard, P., Sezer, S., & McWilliams, G. (2015) · Elsevier eBooks · doi:10.1016/b978-0-12-802122-4.00005-5 · Cited by 21
An experiment in using IMUNES and Conpot to emulate honeypot control networks
Kuman, S., Groš, S., & Mikuc, M. (2017) · International Convention on Information and Communication Technology, Electronics and Microelectronics · doi:10.23919/mipro.2017.7973617 · Cited by 21
“Port 502 is used for the Modbus protocol [15].”
MethodAnomaly Detection for Power Grid Based on Time Series Model
Lizong, Z., Shen, X., Zhang, F., Ren, M., Ge, B., & Li, B. (2019) · IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC) · doi:10.1109/cse/euc.2019.00044 · Cited by 20
“In the field of state machine, GW model is proposed to detect anomaly by constructing a deterministic finite automation[9].”
MethodAccurate Automata-Based Detection of Cyber Threats in Smart Grid Communication
Havlena, V., Matoušek, P., Ryšavý, O., & Holík, L. (2022) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2022.3216726 · Cited by 20
“The representation of Modbus communication using finite state machines was introduced by Goldenberg and Wool [34].”
MethodYu, C., Xiang, X., Maurelli, F., Zhang, Q., Zhao, R. J., & Xu, G. (2019) · Ocean Engineering · doi:10.1016/j.oceaneng.2019.106121 · Cited by 20
A Software-Defined Security Approach for Securing Field Zones in Industrial Control Systems
Yang, J. Y., Zhou, C., Tian, Y., & Yang, S. (2019) · IEEE Access · doi:10.1109/access.2019.2924800 · Cited by 19
“, a Denial of Service (DoS) attack or an IP/port scan attack, the value of the information entropy will be quite different from that under normal conditions [28].”
BackgroundEfficient Modelling of ICS Communication For Anomaly Detection Using Probabilistic Automata
Matoušek, P., Havlena, V., & Holík, L. (2021) · Cited by 18
Slunjski, M., Sumina, D., Groš, S., & Erceg, I. (2022) · IEEE Access · doi:10.1109/access.2022.3217797 · Cited by 18
“…[19], [26], [27], [28], [29] by suggesting different algorithmic extensions (e.g. for rectifying some main Modbus security downsides), while the other part deals with algorithmic client/server data encryption and intrusion detection systems/algorithms [14], [16], [20], [21], [22], [23], [24].”
Background
Metadata
- Authors
- Goldenberg, N., & Wool, A.
- Affiliations
- Tel Aviv University (IL)
- Corresponding author
- Wool, Avishai
- ORCID
- Wool, Avishai
- Venue
- International Journal of Critical Infrastructure Protection
- Publisher
- Elsevier BV
- Published
- 2013-06
- Volume
- 6
- Issue
- 2
- Pages
- 63-75
- ISSN
- 1874-5482 (ISSN-L)
- OpenAlex
- W2089944128
- Cited by
- 323
- References
- 21
- Citations by year
- 2026: 15 · 2025: 20 · 2024: 26 · 2023: 30 · 2022: 27 · 2021: 25 · 2020: 28 · 2019: 39 · 2018: 31 · 2017: 25 · 2016: 28 · 2015: 20 · 2014: 6 · 2013: 3
- FWCI
- 23.65
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- International Journal of Critical Infrastructure Protection (publishedVersion)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Keywords
- Modbus TCP, SCADA security, intrusion detection, deterministic finite automata, industrial control network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
