Security defense model of Modbus TCP communication based on Zone/Border rules

摘要

To detect the intrusion of advanced industrial virus of industrial control system, design flaws of Modbus TCP Protocol is firstly analyzed in this paper, and a method is proposed, through which the Modbus TCP packet is deeply inspected to deal with the threat from application layer. Furthermore, a general description form of the security rules is proposed, and defense model for Modbus TCP communication in industrial control system or SCADA system is designed, which is based on intrusion detection rules and “white-list” rules. With definition of the minimum set of normal communication between different zones, the system has eliminated exposure greatly. At last, simulation experiments validate that the proposed method is effective and practical.