Modbus TCP protocol in industrial control system Research on anomaly detection method

With the rapid development of industrial control modernization, traditional manufacturing is closely integrated with the Internet. The networking of industrial control systems not only improves the manufacturing capacity of enterprises, but also facilitates the control and management of remote production sites, but at the same time it also brings a series of network security issues. This paper proposes a frequency feature vector construction method based on Modbus TCP message sequence. This method uses a sliding window to sequentially extract the combined sequence of the function code and the register address, obtains the pattern subsequence through the extraction, and then converts the frequency of the pattern subsequence in the feature library into a frequency feature vector.