The DOI matches its Crossref record; 18 of the 21 references it cites were found in a registry or an index.
Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To simulate the control networks, e.g.Modbus, Allen-Bradley Data Highway, TASSCS uses Opnet tool and to simulate the operation behaviour; it uses PowerWorldi simulation system.”
From Architecture and security of SCADA systems: A review (2021) · cites this paper as [106]
In the citing paper
“virtual testbed”
From Architecture and security of SCADA systems: A review (2021) · cites this paper as [106]
In the citing paper
“Modbus”
From Architecture and security of SCADA systems: A review (2021) · cites this paper as [106]
Citations
Cites
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094
Security problems in the TCP/IP protocol suite
Bellovin, S. (1989) · ACM SIGCOMM Computer Communication Review · doi:10.1145/378444.378449 · Cited by 559
Using Model-based Intrusion Detection for SCADA Networks
Cheung, S. W., Dutertre, B., Fong, M. W., Lindqvist, U., Skinner, K., & Valdes, A. (2006) · Cited by 321
On SCADA control system command and response injection and intrusion detection
Gao, W., Morris, T. H., Reaves, B., & Richey, D. (2010) · eCrime Researchers Summit (eCrime) · doi:10.1109/ecrime.2010.5706699 · Cited by 187
Stuxnet, the real start of cyber warfare? [Editor's Note]
Chen, T. (2010) · IEEE Network · doi:10.1109/mnet.2010.5634434 · Cited by 168
A testbed for analyzing security of SCADA control systems (TASSCS)
Mallouhi, M., Al-Nashif, Y., Cox, D., Chadaga, T., & Hariri, S. (2011) · ISGT 2011 · doi:10.1109/isgt.2011.5759169 · Cited by 164
Modbus/DNP3 State-Based Intrusion Detection System
Fovino, I. N., Carcano, A., Murel, T. D. L., Trombetta, A., & Masera, M. (2010) · International Conference on Advanced Information Networking and Applications (AINA) · doi:10.1109/aina.2010.86 · Cited by 153
Smart grids, smart cities need better networks [Editor's Note
Chen, T. (2010) · IEEE Network · doi:10.1109/mnet.2010.5430136 · Cited by 138
Tsang, C.-H., & Kwong, S. (2006) · IEEE International Conference on Industrial Technology (ICIT) · doi:10.1109/icit.2005.1600609 · Cited by 107
Communication pattern anomaly detection in process control systems
Valdes, A., & Cheung, S. (2009) · IEEE Conference on Technologies for Homeland Security (HST) · doi:10.1109/ths.2009.5168010 · Cited by 106
Flagged first, then by citations
3 of the 21 references couldn’t be matched to a known paper.
Research works printed but not linked: 1
- D. Yang, A. Usynin, J. Hines, Anomaly-based intrusion detection for SCADA systems, in: Proceedings of the Fifth International Topical Meeting on Nuclear Plant Instrumentation, Control and Human–Machine Interface Technologies, 2006, pp. 12–16.
Cited by
Sorted by citations
Items 101–200 of 318
Lopez, J., Liefer, N. C., Busho, C., & Temple, M. A. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2779447 · Cited by 18
Intrusion Detection in Industrial Control Systems
Colbert, E. J. M., & Hutchinson, S. E. (2016) · Advances in information security · doi:10.1007/978-3-319-32125-7_11 · Cited by 18
Channel-State-Based Fingerprinting Against Physical Access Attack in Industrial Field Bus Network
Liu, P., Liu, Y., Wang, X., Fang, C., Guan, X., & Liu, T. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3126461 · Cited by 17
Securing industrial control system environments: the missing piece
Ani, U., Daniel, N., Oladipo, F. O., & Adewumi, S. E. (2018) · Journal of Cyber Security Technology · doi:10.1080/23742917.2018.1554985 · Cited by 17
“On this bases, several IDS approaches and schemes have been proposed and validated in either real-life or computer simulated environments to guard against cyber intrusions in ICS/CPS [22], [55], [95]–[97], [87]–[94] .”
BackgroundA practical implementation of unconditional security for the IEC 60780-5-101 SCADA protocol
Cherifi, T., & HAMAMI, L. (2017) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2017.12.001 · Cited by 17
Zagan, I., & Găitan, V. G. (2022) · Mathematics · doi:10.3390/math10244686 · Cited by 16
A MEC-IIoT intelligent threat detector based on machine learning boosted tree algorithms
Ruiz-Villafranca, S., Roldán-Gómez, J., Carrillo-Mondéjar, J., Gómez, J. M. C., & Villalon, J. M. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109868 · Cited by 18
Ruiz-Villafranca, S., Carrillo-Mondéjar, J., Gómez, J. M. C., & Roldán-Gómez, J. (2023) · The Journal of Supercomputing · doi:10.1007/s11227-023-05098-2 · Cited by 19
“…of the industrial protocols which use the TCP transport protocol: Modbus/TCP, which is the most widely used industrial standard and protocol [36]; S7COMM, which is the proprietary communication protocol used by the Programmable Logic Controller (PLC) of Siemens [37]; and Open Platform…”
MethodGNN-based Advanced Feature Integration for ICS Anomaly Detection
Lu, S., Wang, K., Wei, Y., Liu, H., Fan, Q., & Wang, B. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3620676 · Cited by 15
Intrusion Detection in SCADA System: A Survey
Zeng, P.-R., & Zhou, P. (2018) · Communications in computer and information science · doi:10.1007/978-981-13-2384-3_32 · Cited by 15
Clustering method in protocol reverse engineering for industrial protocols
Shim, K., Goo, Y., Lee, M., & Kim, M. (2020) · International Journal of Network Management · doi:10.1002/nem.2126 · Cited by 15
“33 Developed by Schneider Electric, this protocol implements Modbus message transmission using TCP/IP.”
MethodClassification of Encrypted IoT Traffic despite Padding and Shaping
Engelberg, A., & Wool, A. (2022) · Workshop on Privacy in the Electronic Society · doi:10.1145/3559613.3563191 · Cited by 15
Kim, H., Kim, S., Jo, W., Kim, K.-H., & Shon, T. (2021) · IEEE Access · doi:10.1109/access.2021.3080081 · Cited by 14
“Therefore, Goldenberg et al. [19] built a model by tracking actual traffic using a deterministic finite automaton (DFA) for the command field and packet length of the header field of the Modbus/TCP protocol.”
Method(2021) · doi:10.1007/978-3-030-78086-9_6 · Cited by 19
Modbus Communication Behavior Modeling and SVM Intrusion Detection Method
Shang, W., Cui, J., Wan, M., An, P., & Zeng, P. (2016) · International Conference on Communication and Network Security (ICCNS) · doi:10.1145/3017971.3017978 · Cited by 14
“…Modbus protocol is widely used in industrial control system, the Modbus/TCP network security methods are mainly based on deterministic finite automata (DFA) modeling method of intrusion detection, intrusion detection method based on signature way and traffic detection method based on SVM [12-14].”
MethodIntrusion Detection for Sequence-Based Attacks with Reduced Traffic Models
Ferling, B., Chromik, J. J., Caselli, M., & Remke, A. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-74947-1_4 · Cited by 14
“Traditional Intrusion Detection Systems (IDS) identify malicious traffic in different ways: whitelisting [6], stateful approaches [7,8], and specification-based approaches [9] exist.”
BackgroundRondeau, C. M., Betances, J. A., & Temple, M. A. (2018) · Security and Communication Networks · doi:10.1155/2018/1489347 · Cited by 14
Intrusion Detection Method Based on Support Vector Machine Access of Modbus TCP Protocol
Deng, L., Peng, Y., Liu, C., Xin, X., & Xie, Y. (2016) · 2016 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata.2016.90 · Cited by 14
Strengthening ICS defense: Modbus-NFA behavior model for enhanced anomaly detection
Amer, E., Al‐rimy, B. A. S., & El–Sappagh, S. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.103990 · Cited by 13
Herzberg, A., & Kfir, Y. (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359794 · Cited by 13
“Network-based detection systems try to protect the physical process by searching for anomalies in the network traffic [10, 11, 17, 19, 24, 31, 35, 36, 42].”
BackgroundBenisha, R. B., & Ratna, S. R. (2019) · Security and Communication Networks · doi:10.1155/2019/1082485 · Cited by 13
A Review on Current and Old SCADA Networks Applied to Water Distribution Systems
Franco, D. J., Muhammed, A., Subramaniam, S. K., Abdullah, A., Silva, R. M. S., & Akram, O. K. (2019) · International Conference of Intelligent Computing and Engineering (ICOICE) · doi:10.1109/icoice48418.2019.9035134 · Cited by 13
“Though, PLCs allowing more than one connections at a time on port 502 are susceptible to a larger and simpler number of attacks [16].”
BackgroundMethodInfluentialCross-Domain Solutions (CDS): A Comprehensive Survey
Sundaravarathan, V., Alqalaf, H., Siddiqui, A., Kim, K., Lee, S., Martin Reisslein, B., Thyagaturu, A. S., Ross, N., Howard, J., & Tayal, S. (2024) · IEEE Access · doi:10.1109/access.2024.3483659 · Cited by 13
Development of the ECAT Preprocessor with the Trust Communication Approach
Akpinar, K. O., & Özçeli̇k, İ. (2018) · Security and Communication Networks · doi:10.1155/2018/2639750 · Cited by 12
“The researchers identified each communication channel between the HMI and PLC using deterministic finite automata (DFA) [33].”
MethodA novel online state-based anomaly detection system for process control networks
Farsi, H., Fanian, A., & Taghiyarrenani, Z. (2019) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2019.100323 · Cited by 11
A Reflection-Based Channel Fingerprint to Locate Physically Intrusive Devices in ICS
Liu, P., Liu, Y., Wang, X., Bao, Y., Yang, D., Wang, W., Wu, T., Lv, Z., & Liu, T. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3198676 · Cited by 11
“Thus, many intrusion detection systems (IDSs) are specifically designed for industrial protocols to detect malicious attacks [3], [4].”
BackgroundDRAGON: Deep Reinforcement Learning for Autonomous Grid Operation and Attack Detection
Landen, M., Chung, K., Ike, M., Mackay, S., Watson, J., & Wenke Lee, B. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3567969 · Cited by 12
“Also, prior specification-based detection [22, 28, 56], which detects deviations from normal state machine transitions, suffers from state explosion in real-world power grids.”
BackgroundMethodInfluentialProposal of a Secure Modbus RTU Communication with Adi Shamir's Secret Sharing Method
Ádámkó, É., Jakabóczki, G., & Szemes, P. T. (2018) · International Journal of Electronics and Telecommunications · doi:10.24425/119357 · Cited by 11
Industrial Communication Based on MQTT and Modbus Communication Applied in a Meteorological Network
Sacoto-Cabrera, E. J., Palaguachi, S., León-Paredes, G. A., Gallegos-Segovia, P. L., & Bravo-Quezada, O. G. (2020) · Advances in intelligent systems and computing · doi:10.1007/978-3-030-63665-4_3 · Cited by 11
Martínez, C. V., & Vogel‐Heuser, B. (2018) · Applied Sciences · doi:10.3390/app8122460 · Cited by 11
“, automatic generation of Deterministic Finite Automation [30], One-Class”
BackgroundArchitecture and Prototype Implementation for Process-Aware Intrusion Detection in Electrical Grids
Flosbach, R., Chromik, J. J., & Remke, A. (2019) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds47363.2019.00015 · Cited by 11
[SoK] Evaluations in Industrial Intrusion Detection Research
Lamberts, O., Wolsing, K., Wagner, E., Pennekamp, J., Bauer, J., Wehrle, K., & Henze, M. (2023) · Journal of Systems Research · doi:10.5070/sr33162445 · Cited by 10
“2.2.3).”
BackgroundInfluentialGamess, E., Smith, B., & Francia, G. (2020) · International journal of Computer Networks & Communications · doi:10.5121/ijcnc.2020.12201 · Cited by 10
“In [10], the authors proposed a model for Modbus TCP for intrusion detection based on Deterministic Finite Automatons (DFAs).”
BackgroundMethodAnomaly Detection in SCADA Systems: A State Transition Modeling
Barsha, N. K., & Hubballi, N. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3373881 · Cited by 13
“Owing to the periodic nature of communication in SCADA systems, several attack detection models [9], [10], [11], [12] described state transition machine based detection systems.”
BackgroundIndustrial Control System Fingerprinting and Anomaly Detection
Peng, Y., Xiang, C., Gao, H., Chen, D., & Wang, R. (2015) · IFIP advances in information and communication technology · doi:10.1007/978-3-319-26567-4_5 · Cited by 10
“Cheung et al. [7], Goldenberg et al. [11] and Morris et al. [14] have developed intrusion detection systems for industrial control networks that use the Modbus protocol.”
Temporal Phase Shifts in SCADA Networks
Markman, C., Wool, A., & Cárdenas, Á. A. (2018) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3264888.3264898 · Cited by 10
“This strengthens the observations of a substantial se-quentiality in SCADA communications [3, 14, 16].”
BackgroundMethodInfluentialA Novel Architecture for Cyber-Physical Security in Industrial Control Networks
Bernieri, G., Conti, M., & Pascucci, F. (2018) · IEEE International Forum on Research and Technology for Society and Industry (RTSI) · doi:10.1109/rtsi.2018.8548438 · Cited by 10
“Starting from the work in [7], this submodule recognizes predefined patterns to differentiate between normal and anomalous packets chains in data transmission.”
BackgroundProfiling Communications in Industrial IP Networks: Model Complexity and Anomaly Detection
Faisal, M. A., Cárdenas, Á. A., & Wool, A. (2019) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-030-12330-7_7 · Cited by 10
Security Enhancement for the Network Amalgamation using Machine Learning Algorithm
Anithaashri, T. P., & Ravichandran, G. (2020) · International Conference on Smart Electronics and Communication (ICOSEC) · doi:10.1109/icosec49089.2020.9215452 · Cited by 10
“During the information transaction, the possibility for vulnerabilities such as eavesdropping, denial of service, poor in quality of service, message distortion, and nodes roaming in hostile environment [8], [10], etc.”
BackgroundMethodA Comparative Analysis of Emulated and Real IEC-104 Spontaneous Traffic in Power System Networks
Lin, C.-Y., & Nadjm‐Tehrani, S. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-69781-5_14 · Cited by 10
Process-aware SCADA traffic monitoring : a local approach
Chromik, J. J. (2019) · doi:10.3990/1.9789036548014 · Cited by 10
Sicard, F., Zamai, É., & Flaus, J.-M. (2018) · Diagnosability, Security and Safety of Hybrid Dynamic and Cyber-Physical Systems · doi:10.1007/978-3-319-74962-4_5 · Cited by 10
Organizing the information security in Modbus TCP interfaces for use in the energy complex
Ametov, F. R., Bekirov, E., & Asanov, M. (2021) · IOP Conference Series Materials Science and Engineering · doi:10.1088/1757-899x/1089/1/012007 · Cited by 9
“Let us consider the Modbus TCP protocol, which is widely used to organize the industrial networks control [3].”
MethodHELOT–Hunting Evil Life in Operational Technology
Akailvi, S., Gautam, U., Bhandari, P., Rashid, H., Huff, P., & Springer, J. P. (2022) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2022.3222261 · Cited by 9
“Network monitoring and analysis techniques were further extended to include monitoring of low-level OT instrumentation devices when Goldenberg and Wool [23] designed a model-based IDS for SCADA systems.”
BackgroundMethodFuzzy Controller-empowered Autoencoder Framework for anomaly detection in Cyber Physical Systems
Gupta, K. D., Singhal, K., Sharma, D. K., Sharma, N., & Malebary, S. J. (2023) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2023.108685 · Cited by 9
Securing cyber-physical systems with adaptive commensurate response
Zheng, Z., Jin, S., Bettati, R., & Reddy, A. L. N. (2017) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2017.8228641 · Cited by 9
“The former category focus on the SCADA network and try to prevent malicious activities through methods such as IDS/anomaly detection [6]– [10], authentication [11]–[14], and encryption [15].”
BackgroundMethodStealthy Rootkits in Smart Grid Controllers
Krishnamurthy, P., Salehghaffari, H., Duraisamy, S., Karri, R., & Khorrami, F. (2019) · IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) · doi:10.1109/iccd46524.2019.00012 · Cited by 9
“Approaches that monitor network traffic have been proposed [29], [30].”
BackgroundMethodDetection and localization of cyber attacks on water treatment systems: an entropy-based approach
Liu, K., Wang, M., Ma, R., Zhang, Z., & Wei, Q. (2022) · Frontiers of Information Technology & Electronic Engineering · doi:10.1631/fitee.2000546 · Cited by 9
“…are versatile, they ignore many unique iCPS features that can be used for intrusion detection, such as the periodicity of iCPS traffic and behavior (Goldenberg and Wool, 2013; Song and Liu, 2019), configuration features (Zhang et al., 2019), and rules of message response and operation time (Formby…”
BackgroundSecurity intelligence for industrial control systems
Amrein, A., Angeletti, V., Beitler, A., Nemet, M., Reiser, M., Riccetti, S., Stoecklin, M. P., & Wespi, A. (2016) · IBM Journal of Research and Development · doi:10.1147/jrd.2016.2575698 · Cited by 9
An intrusion detection system for critical infrastructures: Modbus approach
Varol, M., & İskefiyeli, M. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.112410 · Cited by 8
DKaaS: DARK-KERNEL as a service for active cyber threat intelligence
Putrevu, V. S. C., Ratnakaram, G., Chunduri, H., Anand, P. M., & Shukla, S. K. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103329 · Cited by 8
Critical Infrastructure Protection IX
Rice, M., & Shenoi, S. (2015) · IFIP advances in information and communication technology · doi:10.1007/978-3-319-26567-4 · Cited by 8
FPGA-based Real-time Abnormal Packet Detector for Critical Industrial Network
Kang, J., Kim, T., & Park, J. (2019) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc47284.2019.8969630 · Cited by 8
“Since the proposed system aims the real-time packet detection used within the critical industrial network, the prototype system was built for the Modbus that is one of the most widely used industrial network [16].”
BackgroundIntelligent Intrusion Detection System for Smart Grid Applications
Mohanty, D. K., Sethi, K., Prasath, S., Rout, R. R., & Bera, P. (2021) · International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA) · doi:10.1109/cybersa52016.2021.9478200 · Cited by 8
Performance evaluation for Modbus/TCP using Network Simulator NS3
Kim, B., Lee, D., & Choi, T. (2015) · IEEE Region 10 Conference (TENCON) · doi:10.1109/tencon.2015.7372904 · Cited by 8
“The Modbus protocol has been commonly used for the communication between intelligent instrument, such as programmable logic controllers (PLC) and micro controller units (MCU), in computer numerical control (CNC) machine tools and supervisory control and data acquisition (SCADA) systems [7].”
MethodPassive inference of attacks on CPS communication protocols
Bou‐Harb, E., Ghani, N., Erradi, A., & Shaban, K. B. (2018) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2018.10.002 · Cited by 8
Efficient Intrusion Detection on Low-Performance Industrial IoT Edge Node DevicesPreprint
Niedermaier, M., Striegel, M., Sauer, F., Merli, D., & Sigl, G. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.03964 · Cited by 8
“Thus, it requires a precise model of every single protocol it captures, most of which are proprietary [9].”
BackgroundExploiting the temporal behavior of state transitions for intrusion detection in ICS/SCADA
Kabasele Ndonda, G., & Sadre, R. (2022) · IEEE Access · doi:10.1109/access.2022.3213080 · Cited by 8
“There exist several works in the literature to detect such attacks [3], [15], [16].”
BackgroundProcess-Aware Intrusion Detection in MQTT Networks
Empl, P., Böhm, F., & Pernul, G. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3626232.3653271 · Cited by 7
“Different efforts on securing parts of industrial SCADA systems like Modbus or DN3P for communication resulted in plenty of anomaly-based, signature-based and specification-based IDS for both hosts [30, 47, 75], and networks [14, 27, 29, 41, 86].”
BackgroundCross-domain alert correlation methodology for industrial control systems
Koucham, O., Mocanu, S., Hiet, G., Thiriet, J.-M., & Majorczyk, F. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102723 · Cited by 7
“Payload-based IDS [2, 4, 59, 60, 3, 61] are protocol-specific anomaly-based IDS that detect abnormal ICS protocol messages or sequences of messages.”
Application of EtherCAT in Microgrid Communication Network: A Case Study
Delgado, R., Choi, B. W., & Song, H. (2018) · International Conference on Platform Technology and Service · doi:10.1109/platcon.2018.8472736 · Cited by 7
“Modbus/TCP basically embeds a Modbus frame into a TCP frame [10].”
MethodDevelopment of testbed for cyber-manufacturing security issues
Wu, M., Song, J., Sharma, S., Di, J., He, B., Wang, Z., Zhang, J., Lin, L. W. L., Greaney, E. A., & Moon, Y. B. (2020) · International Journal of Computer Integrated Manufacturing · doi:10.1080/0951192x.2020.1736711 · Cited by 7
“The Modbus TCP/IP is the Modbus protocol with a TCP interface that runs on the Ethernet (Goldenberg and Wool 2013).”
MethodInfluentialSecurity Enhancement of Industrial Modbus Message Transmission with Proxy Approach
Lin, Y.-C., Lin, C.-F., & Chen, K.-H. (2021) · IEEE Eurasia Conference on IOT, Communication and Engineering (ECICE) · doi:10.1109/ecice52819.2021.9645741 · Cited by 6
Fagundes, F. D., & da Cunha, M. J. (2022) · Journal of Control Automation and Electrical Systems · doi:10.1007/s40313-021-00889-5 · Cited by 6
“The proposal was laid out as the following: if Modbus messages followed a cyclical pattern, invasions could be characterized by messages outside that pattern (Goldenberg and Wool 2013).”
BackgroundHao, W., Zhang, Z., Wang, X., Yang, Q., Liu, B., Wang, W., Yang, T., & Ye, P. (2024) · IEEE Transactions on Industrial Cyber-Physical Systems · doi:10.1109/ticps.2024.3524185 · Cited by 6
SafeCI: Avoiding process anomalies in critical infrastructure
Adepu, S., & Mathur, A. P. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100435 · Cited by 6
Dutta, A. K., Mukhoty, B., & Shukla, S. K. (2021) · ACM Workshop on CPS&IoT Security and Privacy (CPSIoTSec) · doi:10.1145/3462633.3483978 · Cited by 6
Goosewolf: An Embedded Intrusion Detection System for Advanced Programmable Logic Controllers
Allison, D., McLaughlin, K., & Smith, P. (2023) · Digital Threats Research and Practice · doi:10.1145/3617692 · Cited by 6
“network interfaces, for example, then Goosewolf could be extended to locally implement ICS network communications monitoring methods [10, 17], albeit with careful consideration required for secure implementation.”
BackgroundInformation security of industrial control systems: possible attack vectors and protection methods
Grachkov, I. A. (2018) · Bezopasnost informacionnyh tehnology · doi:10.26583/bit.2018.1.09 · Cited by 6
Risk Data Analysis Based Anomaly Detection of Ship Information System
Xing, B., Jiang, Y., Liu, Y., & Cao, S. (2018) · Energies · doi:10.3390/en11123403 · Cited by 6
Facilitating Protocol-independent Industrial Intrusion Detection Systems
Wolsing, K., Wagner, E., & Henze, M. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3420019 · Cited by 6
“Thus, attacks can be detected by, e.g., modeling communication patterns with automata [2, 6, 9, 15], finding invariants for physical processes [5], detecting critical states with logic formulas [8], fingerprinting physical processes [1], comparing the current physical process state to a simulation…”
BackgroundIntrusion Detection & Prevention in Programmable Logic Controllers: A Model-driven Approach
Negi, R., Dutta, A. K., Handa, A., Ayyangar, U., & Shukla, S. K. (2020) · IEEE International Conference on Industrial Cyber-Physical Systems (ICPS) · doi:10.1109/icps48405.2020.9274765 · Cited by 6
“For example, there is a deterministic finite automata (DFA) based IDS which looks deep into Modbus/TCP packets [9] & S7 traffic [11].”
BackgroundModel‐based protocol specification
Mordecai, Y. (2019) · Systems Engineering · doi:10.1002/sys.21480 · Cited by 6
“Standards are sometimes premature,whentheyareformedforemergingdomains,suchasInter-net of Things (IoT) 2,3 and electric vehicles.”
BackgroundIntrusion Detection System in Smart Grid-A ReviewPreprint
Banik, S., Banik, S., & Banik, S. (2023) · Preprints.org · doi:10.20944/preprints202309.0611.v1 · Cited by 7
Host-Based Intrusion Detection for Industrial Control Systems
Alla, O., & Mocanu, S. (2025) · IEEE International Conference on Network Softwarization (NetSoft) · doi:10.1109/netsoft64993.2025.11080639 · Cited by 5
“Goldenberg and Wool [7] found robust anomaly detection with few false positives in Modbus/TCP message sequences between HMIs and PLCs using a small training set.”
Feature Extraction Optimization for Network Intrusion Detection in Control System Networks.
Atkison, T., Ponomarev, S., Smith, R., & Chen, B. K. (2018) · Cited by 5
Anomaly Detection in Industrial Control Systems using Machine Learning Techniques
Kumain, K. (2019) · Türk bilgisayar ve matematik eğitimi dergisi · doi:10.17762/turcomat.v10i2.13630 · Cited by 5
Asiri, M., Saxena, N., & Burnap, P. (2023) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw59978.2023.00047 · Cited by 5
“For instance, Modbus traffic between a master and a slave is highly periodic, with each communication process exhibiting its unique pattern length [10].”
BackgroundUnraveling the Threat Landscape of CPS: Modbus TCP Vulnerabilities in the Era of I4.0
Lazaridis, G., Drosou, A., Chatzimisios, P., & Tzovaras, D. K. (2024) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr61664.2024.10679453 · Cited by 5
“This makes it a popular choice for integrating heterogeneous systems and components within industrial automation environments [3].”
BackgroundSchuster, F., & König, H. (2024) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3678890.3678932 · Cited by 6
“This may be feasible for a single OT application [11, 12, 24, 29] or for certain traffic aspects [66], but with a rising amount of monitored applications or traffic data, the two approaches suffer from rule or state explosion with negative effects on practicability and efficiency.”
Evolving the Security Paradigm for Industrial IoT Environments
Rosa, L., de Freitas, M. B., Henriques, J., Quitério, P., Caldeira, F., Cruz, T., & Simões, P. (2020) · Advances in information security, privacy, and ethics book series · doi:10.4018/978-1-7998-2910-2.ch004 · Cited by 5
Network-based Anomaly Detection for SCADA Systems : Traffic Generation and Modeling
Lin, C. (2022) · Linköping studies in science and technology. Dissertations · doi:10.3384/9789179295189 · Cited by 5
Graph Optimization via Decoupled Edge Tuning for Efficient Industrial Anomaly Detection
Wang, K., Lu, S., Liu, Y., & Wang, B. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3567671 · Cited by 5
“Relevant methods include the DFA [13], telemetry analysis [14], sequence-aware methods [15], etc.”
OPC Communication Protection Method Based on Access Control and Anomaly Traffic Detection
Guo, Y., Cheng, C., Xin, X., & Xie, Y. (2016) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata.2016.155 · Cited by 5
“For example, the port 502 is usually used in Modbus/TCP communication [15].”
MethodProcess-Aware Model-based Intrusion Detection System on Filtering Approach: Further Investigations
Beaudet, A., Sicard, F., Escudero, C., & Zamaï, É. (2020) · IEEE International Conference on Industrial Technology (ICIT) · doi:10.1109/icit45562.2020.9067195 · Cited by 5
“Behaviour based NIDS based on the modelling of network activity, component registers evolution or function calls are well developed in the literature [13][14].”
BackgroundTowards Safer Industrial Serial Networks: An Expert System Framework for Anomaly Detection
de Moura, R. L., Franqueira, V. N. L., & Pessin, G. (2021) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai52525.2021.00189 · Cited by 5
Compared Insights on Machine-Learning Anomaly Detection for Process Control Feature
Wan, M., Li, Q., Yao, J., Song, Y. X., Liu, Y., & Wan, Y. (2022) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2022.030895 · Cited by 5
Cyber Physical System Vulnerability Research
Redwood, O. (2015) · Cited by 5
Hierarchical Online Intrusion Detection for SCADA NetworksPreprint
Wang, H., Lű, T., Dong, X., Li, P., & Xie, M. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.09418 · Cited by 5
Presekal, A., Stefanov, A. I., Rajkumar, V. S., & Pálenský, P. (2025) · Wiley eBooks · doi:10.1002/9781394191529.ch19 · Cited by 5
Anomaly Detection via Semantically Conjugate View Learning on Industrial Temporal Data
Wang, K., Lu, S., Wang, B., & Zhang, Y. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3527694 · Cited by 7
“These methods build state-based models [13], [14], [15] to abstract and encapsulate every possible state that a system may attain, and attempt to identify any suspicious state absent in the set as a potential anomaly.”
Anomaly detection system for Modbus data based on an open source tool
Suchorab, J., Plamowski, S., & Ławryńczuk, M. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104572 · Cited by 5
Selim, A., & Zhao, J. (2024) · IEEE Texas Power and Energy Conference (TPEC) · doi:10.1109/tpec60005.2024.10472252 · Cited by 4
“In contrast to these methods, Modbus protocol [4] emerges as a more suitable candidate for our integration needs.”
Methodde Moura, R. L., Franqueira, V. N. L., & Pessin, G. (2023) · Congress in Computer Science, Computer Engineering, and Applied Computing (CSCE) · doi:10.1109/csce60160.2023.00365 · Cited by 4
“…solve a specific problem induced by many factors like the nature of data, availability of labeled data, type of anomalies, etc. Researchers have adopted and applied spe-cific problem concepts and techniques from diverse disciplines such as statistics, data science, information theory, etc [7]– [11].”
BackgroundHierarchical GNN Message Passing for Node-Level Anomaly Detection in Industrial Control Systems
Lu, S., Wang, K., Liu, Y., & Wang, B. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3623299 · Cited by 4
“…consistency and periodic features in ICSs’ communication patterns and process-oriented semantics, early traditional methods [15], [16], [17] are introduced to detect anomalies via periodicity mining, using methods ranging from classic statistical analytics [17] to state automata generation[1],[2].”
Periodic Mining of Traffic Information in Industrial Control Networks
Ni, J., Yin, W., Jiang, Y., Zhao, J., & Hu, Y. (2020) · Advances in intelligent systems and computing · doi:10.1007/978-3-030-44041-1_16 · Cited by 4
Masri, A., & Al-Jabi, M. (2021) · PeerJ Computer Science · doi:10.7717/peerj-cs.554 · Cited by 4
“Besides, in Goldenberg & Wool (2013), a model for an intrusion detection system was introduced.”
Ultra-Low Latency Security Hardening of Modbus/TCP Protocol Based on ZUC Cryptographic Algorithm
Zhang, D., Gao, Y., Pan, Q., & Yang, C. (2024) · IEEE International Conference on Information, Communication and Networks (ICICN) · doi:10.1109/icicn62625.2024.10761885 · Cited by 4
“Goldenberg and Wool [9] observe that Modbus has static communication and highly periodic interaction patterns and other characteristics, modeled the communication channel as a deterministic finite state automaton (DFA) to achieve detection of anomalous communication.”
Investigation of a Novel Approach to Securing Data Exchanges Within Industrial Environments
Slunjski, M. (2025) · IEEE Access · doi:10.1109/access.2025.3554983 · Cited by 4
“However, as already explained, various intrusion detection approaches can be found in the literature addressing these issues [30], [31], [32], [33], [34], [35], [36], [37], [38], [39], [40], [41].”
InfluentialSetiawan, M. A., Shahnia, F., Ghosh, A., & Rajakaruna, S. (2014) · Australasian Universities Power Engineering Conference · doi:10.1109/aupec.2014.6966517 · Cited by 4
“The popular wired technologies, used in power systems, are 1This research was financially supported by Lembaga Pengelola Dana Pendidikan (LPDP), Ministry of Finance, Indonesia. serial communication RS-232/422/485 [5], bus technology (e.g. ModBus, ProfiBus, CANBus) [6], power-line communication (e.g. DLC, PLC, BPLC) [3…”
Metadata
- Authors
- Goldenberg, N., & Wool, A.
- Affiliations
- Tel Aviv University (IL)
- Corresponding author
- Wool, Avishai
- ORCID
- Wool, Avishai
- Venue
- International Journal of Critical Infrastructure Protection
- Publisher
- Elsevier BV
- Published
- 2013-06
- Volume
- 6
- Issue
- 2
- Pages
- 63-75
- ISSN
- 1874-5482 (ISSN-L)
- OpenAlex
- W2089944128
- Cited by
- 323
- References
- 21
- Citations by year
- 2026: 15 · 2025: 20 · 2024: 26 · 2023: 30 · 2022: 27 · 2021: 25 · 2020: 28 · 2019: 39 · 2018: 31 · 2017: 25 · 2016: 28 · 2015: 20 · 2014: 6 · 2013: 3
- FWCI
- 23.65
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- International Journal of Critical Infrastructure Protection (publishedVersion)
- RePEc: Research Papers in Economics (submittedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Keywords
- Modbus TCP, SCADA security, intrusion detection, deterministic finite automata, industrial control network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
