Machine Learning for Detecting Modbus Zero-Day Exploits
Open Access DepositedWith cyber threats on the rise worldwide, Industrial Control Systems (ICS) have not gone unscathed. ICS play a major role in the backbone of critical infrastructure. ICS security controls are a must have requirement to ensure resilience; however, ICS are often deployed with little to no security controls. This Praxis evaluated Machine Learning (ML) models designed to detect zero-day exploits targeting Modbus TCP/IP, which is the standard protocol used in most ICS networks. Prior ML research on Modbus has not explored exploits from a zero-day perspective, contributing to the novelty of and motivation for this Praxis.The dataset of this Praxis was acquired from Kaggle, and ML was performed using the AutoML Pycaret library. Models were evaluated primarily for which had the best accuracy and speed, alongside if data rescaling techniques made a significant difference and performance. The best performing models were non-rescaled Gradient Boosting, Normalized Light Gradient Boosting, and non-rescaled Light Gradient Boosting, with no significant difference between their accuracies. Rescaling techniques did make a significant difference in performance, but the answer to which rescaling technique was best varied between each model. Welch's ANOVA and the Games-Howell post hoc test were used to determine if there is any significant difference between the models. This Praxis proves that AutoML can be used to detect Modbus zero-days, and can serve to inform security engineers when they design ML based intrusion detection systems.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.