Vulnerability Mining Method for the Modbus TCP Using an Anti-Sample Fuzzer

Area of Science:

• Cybersecurity
• Network Protocols
• Industrial Control Systems

Background:

• Traditional vulnerability mining methods for industrial control systems (ICS) and their network protocols suffer from low efficiency and poor vulnerability discovery rates.
• Protecting the security of ICS and their network protocols is critical due to their increasing integration and potential impact of breaches.

Purpose of the Study:

• To propose a novel test case generation model for vulnerability mining of Modbus TCP using an anti-sample algorithm.
• To address the limitations of existing vulnerability mining techniques in terms of mining ability and reception rate.

Main Methods:

• A recurrent neural network was trained to understand the semantics of Modbus TCP protocol data units.
• An anti-sample algorithm was developed, utilizing softmax for probability distribution and comparing random variable thresholds with maximum probabilities to guide data value replacement.
• The Modbus Application Protocol (MBAP) header was constructed based on protocol specifications.

Main Results:

• The proposed anti-sample algorithm significantly improved the reception rate of generated test cases.
• The method demonstrated enhanced ability in exploiting identified vulnerabilities.
• Vulnerabilities in industrial control protocols were detected more rapidly compared to traditional approaches.

Conclusions:

• The anti-sample algorithm-based test case generation model is effective for Modbus TCP vulnerability mining.
• This approach offers a more efficient and faster method for detecting vulnerabilities in industrial control systems.
• The study contributes to enhancing the security of critical industrial infrastructure.