The DOI matches its Crossref record; 9 of the 9 references it cites were found in a registry or an index.
Using Machine Learning to detect abnormalities on Modbus/TCP Networks
Open accessAbstract
Modbus/TCP is a communication protocol extensively used in machine-to-machine communications. Therefore, anomaly detection on this protocol is of paramount importance in the industry as it helps protect cyber assets and monitor IoT devices created by manufacturing plants across the globe. This detection is achieved by looking at standard patterns and then comparing them with patterns of data found unknown to the system itself. Today, catapulted by rapid developments in machine learning, there has been a marked reduction in the time it takes to identify anomalies in Modbus/TCP networks. Anomaly detection methodologies, leveraging neural networks trained through numerous machine-learning algorithms, further provide a system that could be effectively applied to many IoT device marketplaces, such as consumer-level applications. This paper proposes a framework for evaluating feature sets and learning-based models to detect Modbus/TCP anomalies efficiently and accurately.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“The method extracts statistical features from packet-level information (protocol type, data length, TCP flags, etc.) and flow-level information (packet counts per source/destination IP, port distribution, total bytes) and determines deviations from normal communication distributions to identify attacks.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [32]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“In these scenarios, coarse-grained traffic statistics and entropy measures are sufficient to expose abnormal behavior without requiring deep protocol parsing [13,21,28,32].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [32]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Supervised statistical classifiers tend to achieve high accuracy when ample labeled attack data are available [13,15,17,20,23,25,32,34], whereas unsupervised and semi-supervised methods offer better robustness to previously unseen or zero-day attacks at the expense of slightly lower nominal accuracy [17,20,21,25,28,34].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [32]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These features can be extracted non-invasively from SPAN/TAP ports and scale naturally to large ICS/CPS deployments, providing a low-cost first line of defense [20,21,32].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [32]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Third, in terms of model behavior, the comparison across studies indicates that classical machine-learning classifiers often perform competitively on high-dimensional statistical feature spaces derived from NSL-KDD, UNSW-NB15, NF-BoT-IoT, IoT-23, and similar benchmarks [17,20,23,28,32,34].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [32]
Experimental — accuracy not yet measured
The cited source says what the claim attributes to it.
In the citing paper
“Using the Cyber-Security Modbus ICS dataset, Sekaran et al. [32] introduced a machinelearning-based framework for detecting anomaly Modbus/TCP network behavior.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [32]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Understanding from Machine Learning Models
Sullivan, E. (2019) · The British Journal for the Philosophy of Science · doi:10.1093/bjps/axz035 · Cited by 269
Factor Models, Machine Learning, and Asset Pricing
Giglio, S., Kelly, B., & Xiu, D. (2022) · Annual Review of Financial Economics · doi:10.1146/annurev-financial-101521-104735 · Cited by 187
ARTIFICIAL INTELLIGENCE- A REVIEW
(2022) · International Research Journal of Modernization in Engineering Technology and Science · doi:10.56726/irjmets29569 · Cited by 119
KASIM, Ö. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107390 · Cited by 98
Enhanced Modbus/TCP Security Protocol: Authentication and Authorization Functions Supported
Martins, T., & Oliveira, S. V. G. (2022) · Sensors · doi:10.3390/s22208024 · Cited by 45 · cited 1×
“We determine that basic information which is extractable from individual packets can be utilized to detect anomalies in Modbus/TCP environments [5].”
MethodKatulić, F., Sumina, D., Erceg, I., et al. (2022) · International Symposium on Power Electronics, Electrical Drives, Automation and Motion (SPEEDAM) · doi:10.1109/speedam53979.2022.9842239 · Cited by 15
Sung, G., Lee, C., Yan, Z.-Y., et al. (2022) · Electronics · doi:10.3390/electronics11203269 · Cited by 7
Hao, Z., Asadullah, A., Wawale, S. G., et al. (2021) · International Journal of Systems Assurance Engineering and Management · doi:10.1007/s13198-021-01362-x · Cited by 3
Research works printed but not linked: 3
- Ivo Frazão; Pedro Abreu; Tiago Cruz; Helder Araújo; Paulo Simões. Cyber-security modbus ics dataset, 2019.
- David Rolnick, Priya L Donti, Lynn H Kaack, Kelly Kochanski, Alexandre Lacoste, Kris Sankaran, Andrew Slavin Ross,Nikola Milojevic-Dupont, Natasha Jaques, Anna Waldman-Brown, Tackling climate change with machine learning. ACM Computing Surveys (CSUR), 55(2):1–96, 2022.
- Lucas Macena Lima da Silva. Controle industrial com modbus/tcp e microcontrolador esp8266. 2022.
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15
Metadata
- Authors
- Sekaran, Y., Debnath, T., Assadi, T. A., Suvvari, S. D., & Oswal, S.
- Affiliations
- B.M.S. College of Engineering (IN)
- Venue
- Proceedings of the 4th International Conference on Information Management & Machine Intelligence
- Publisher
- ACM
- Published
- 2022-12-23
- Pages
- 1-6
- OpenAlex
- W4379932949
- Cited by
- 5
- References
- 9
- Citations by year
- 2026: 1 · 2025: 4
- FWCI
- 0.97
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Conference on Information Management & Machine Intelligence (ICIMMI) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- Modbus TCP, anomaly detection, industrial communication networks, Internet of Things security, machine-to-machine communication, artificial neural networks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Using Machine Learning to detect abnormalities on Modbus/TCP Networks. https://app.cochat.ai/papers/10.1145/3590837.3590893
- The paper
- Sekaran, Y., Debnath, T., Assadi, T. A., Suvvari, S. D., & Oswal, S. (2022). Using Machine Learning to detect abnormalities on Modbus/TCP Networks. Proceedings of the 4th International Conference on Information Management & Machine Intelligence. https://doi.org/10.1145/3590837.3590893
