CN109639624A - Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing - Google Patents
Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing Download PDFInfo
- Publication number
- CN109639624A CN109639624A CN201811166315.8A CN201811166315A CN109639624A CN 109639624 A CN109639624 A CN 109639624A CN 201811166315 A CN201811166315 A CN 201811166315A CN 109639624 A CN109639624 A CN 109639624A
- Authority
- CN
- China
- Prior art keywords
- data
- message
- transmission control
- control protocol
- fuzz testing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/18—Protocol analysers
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention relates to a kind of Modbus Transmission Control Protocol fuzz testing deformity data filtering methods.This method operating procedure is as follows: (1) user imports packet capturing file；(2) from packet capturing file in obtain communication message；(3) the specific fields information of communication message is verified, and the field information is added among message；(4) improved application data (IADU) is obtained to message normalized；(5) multiple IADU are constructed into training matrix；(6) dimensionality reduction is carried out to training matrix and obtains training data；(7) decision mechanism is constructed using training data；(8) decision mechanism determines data to be entered, is given up to it and is retained.The present invention realizes the filtering to lopsided data to be entered, and the input bring additional communication load for reducing invalid test data improves the rate and efficiency of fuzz testing in the case where object to be measured data throughput is limited.
Description
Technical field
The present invention relates to lopsided in industrial network security field more particularly to a kind of Modbus Transmission Control Protocol fuzz testing
Data filtering method.
Background technique
Industrial network control system safety problem is in widespread attention, and Modbus agreement is that Modicon company mentions for 1979
A kind of industrial control protocols out have the characteristics that consensus standard is open, support that range is wide and real-time is good, in Industry Control system
Using very extensive in system.Modbus Transmission Control Protocol is the Modbus agreement operated on ICP/IP protocol, Modbus agreement number
It is propagated according to unit as transport layer load, therefore Modbus Transmission Control Protocol also inherits the loophole of ICP/IP protocol, in addition,
Deficiency existing for program during Modbus agreement itself has such as plaintext transmission, lacks the problems such as authentication mechanism, and realization
Also a series of security breaches can be generated.
Communication protocol used in industrial control network at the beginning of its design due to not fully considering external attack and invasion
Situations such as, there are many insufficient in safety.Modbus agreement, which exists, lacks encryption, lacks to authenticate and lack authorization etc. and ask
Topic.Again since Modbus TCP is operate in the Modbus agreement on ICP/IP protocol, the existing peace in ICP/IP protocol
Full property problem also influences whether industrial control network safety.Such as in Modbus Transmission Control Protocol, due to Modbus protocol data list
Member is propagated in the form that transport layer loads, and communicating pair may be by the internets such as go-between, refusal service, IP spoofing
The attack of common attack means.Simultaneously because engineer is during realizing industrial control network communication protocol, there may be warps
The problems such as testing deficiency, is also possible to that there are loopholes in the communication protocol finally realized.
It is increasing for the type and quantity of industrial control network attack, is protected in Card Buskie laboratory's solution
Energy source tissue industrial control system in, have nearly 40% the second half year in 2017 by a malicious attack.Malicious attacker
Serious harm can be caused to object of attack with loophole using the deficiency in industrial control network agreement.It is attacked in attacker
Insufficient and loophole is found before hitting, and is of great significance in order to carry out prevention and repairing in advance.
Fuzz testing found by inputting a large amount of lopsided data to object to be measured defect present in object to be measured and
Loophole.Fuzz testing is commonly used to defect present in detection network protocol, and whether input file is legal, the automation journey of test
Degree is higher, and the scope of application is wider.One evaluation index of fuzz testing method be searched out using unit testing use-case it is to be measured
The hit rate of the defect of target and the number of loophole, the more more then fuzz testings of number is higher.Fuzz testing can be used to find
Loophole in Modbus TCP agreement.
Since the industrial equipment communication capacity of operation Modbus Transmission Control Protocol is not so good as business information technoloy equipment, to such equipment
When carrying out fuzz testing can because its can bear to load it is low due to can not possess considerable data throughput rate, thereby reduce test
Speed.By establishing decision mechanism realization to the real time filtering of lopsided data, discovery object to be measured leakage is retained in list entries
Possibility higher lopsided data in hole give up the lower lopsided data of possibility, a kind of situation about being limited in data throughput rate
The method of the lower efficiency and rate for improving fuzz testing.
In the sample data for handling training decision mechanism, since the too long caused buffer overflow of data write-in is 70%
Loophole cause, therefore the original length information of sample data must retain, and cannot lose in subsequent processing, so that most
Whole decision mechanism obtains the judgement to buffer overflow, increases the accuracy rate for determining that can lopsided data find loophole.
By will increase new field in original sample data format, value is the physical length of sample data, constructs one
Improved application data (IADU), to prevent from causing length to be believed because sample data length changes in subsequent processing
Breath is lost.
Duplicate message in training data between field and field can come additional to the training of decision mechanism and work belt
Calculation amount, to influence the real-time determined.Therefore under the premise of retaining sample data original length information, by sample
The dimensionality reduction of data gives up the field of redundancy, realizes and guarantees to reduce calculation amount while the accuracy determined, to ensure that judgement
Real-time.
Decision mechanism must have under the premise of guaranteeing real-time judgment, according to new vulnerability information, promptly update and sentence
The ability of set pattern then.Probabilistic neural network can be used for constructing decision mechanism due to accuracy rate height, the rapid feature of training.
Summary of the invention
It is an object of the present invention to cause for Modbus TCP device data throughput rate to be measured in prior art is limited
The low problem of fuzz testing testing efficiency, propose lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing,
The higher data of Devices to test loophole possibility are found by retaining in lopsided data queue to be entered, and it is lower to give up possibility
Lopsided data realize the filtering to lopsided data to be entered, reduce the input bring additional communication of invalid test data
Load improves the speed and efficiency of fuzz testing in the case where object to be measured data throughput rate is limited.
In order to achieve the above objectives, the lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing of the invention
It is as follows using technical solution:
(1) user imports packet capturing file: user imports packet capturing using the training data import modul in data input unit
File.
(2) obtain communication message: the message preprocessing module in data processing section obtains communication report from packet capturing file
Text.
(3) the specific fields information of communication message is examined, and the field information is added among heat preservation: to prevent from training number
According to length information lost in subsequent processing because data length changes, to the specific fields such as length of communication message
Field is verified again, and the field information retrieved is added into message, obtains new training data.
(4) message is normalized to obtain IADU.Each normalized benchmark of field is that each self energy is got most
Big value.
(5) i IADU composing training data matrix S is usedi。
(6) carry out dimensionality reduction to training matrix to operate to obtain training data: to reduce, computation complexity and reduction are final to be sentenced
Determine the structure complexity of mechanism, extracts training data matrix SiPreceding j arrange to obtain matrix Sij.And to SijCarry out PCA processing.It will
All characteristic values of covariance matrix C in PCA processing carry out descending, m eigenvalue λ before taking1,λ2,…,λm, right using its
The feature vector p answered1,p2,…,pmConstitute matrix T=(p1,p2,…,pm).By SijIt projects on the matrix of feature vector composition
The data set of PNN construction sample can be obtained
(7) decision mechanism is constructed using training data:, can be with according to whether cause the abnormal and abnormal type of test target
Message in sample is divided into the message of Y-1 kind Exception Type message and a kind of normal type, normal message type is denoted as the 1st
Seed type.The message total that t class message includes is denoted as N hereint.Remember rtwForIn in t class w-th of message it is corresponding
Dimension is the row vector of m.PNN is constructed, the neuron in layer of summing is training datasetIn each row vector.It is each in summation layer
Neuron indicates rtwClassification belonging to vector.Output layer exports the maximum classification number of input vector X similarity degree.
(8) decision mechanism determines input data, is given up to it and is retained: determining lopsided data to be entered using PNN
IADU.If it is determined that result is 1, then give up the data, if not 1, then transmit data to Devices to test.
The present invention compared with prior art, has obvious prominent substantive distinguishing features and significant technological progress: (1)
The length information for remaining training data enables finally obtained decision mechanism accurately to determine that the actual (tube) length of data to be entered is spent
Can length find object to be measured loophole.(2) to training data matrix SiIt is intercepted and carries out what PCA can be effectively reduced
The structure complexity of PNN reduces the calculation amount of judgement, guarantees the real-time determined.(3) with the progress of test process, due to
PNN has the characteristics that retraining is rapid, and decision mechanism can be updated in real time, to enhance decision-making ability.
Detailed description of the invention
Fig. 1 is specified operational procedure block diagram of the invention.
Fig. 2 is that lopsided data filtering method is used in pair in a kind of Modbus Transmission Control Protocol fuzz testing of the invention
Modbus Transmission Control Protocol carries out the schematic illustration in fuzz testing.
Fig. 3 is the format of improved Modbus TCP application data in embodiment.
Fig. 4 is the PNN schematic diagram established in implementing.
Fig. 5 is PNN work flow diagram used in embodiment.
Specific embodiment
It is clear to be more clear technical solution of the present invention and advantage, below in conjunction in preferred embodiment in the present invention
Attached drawing, technical solution in the embodiment of the present invention is described in detail, it is clear that the example illustrated is only of the invention
A part of example is not whole examples.Based on the embodiments of the present invention, those skilled in the art are not making
Every other example obtained, shall fall within the protection scope of the present invention under the premise of creative work.
Referring to Fig. 2, all embodiments are based on the invention proposes numbers lopsided in a kind of Modbus Transmission Control Protocol fuzz testing
According to filter method.
Embodiment one:
Referring to Fig. 1, lopsided data filtering method, operating procedure in the Modbus Transmission Control Protocol fuzz testing in embodiment one
It is as follows:
(1) user imports packet capturing file；
(2) communication message is obtained from packet capturing file；
(3) the specific fields information of communication message is verified, and the field information is added among message；
(4) IADU is obtained to message normalized；
(5) i IADU is constructed into training matrix, i is the natural number except 0 and 1；
(6) dimensionality reduction is carried out to training matrix and obtains training data；
(7) decision mechanism is constructed using training data；
(8) decision mechanism determines data to be entered, is given up to it and is retained.
Embodiment two:
The present embodiment is basically the same as the first embodiment, as follows in place of characteristic value:
Specific fields involved in the step (3) are the fields for reflecting message length information.
Benchmark employed in normalized involved in the step (4) is the practical maximum that each field can be got
Value.
When in the step (5) using multiple IADU construction training matrix, each IADU corresponds to the row of training matrix.
In the step (6), dimension-reduction treatment mainly includes extracting forefront and PCA processing.
Decision mechanism involved in the step (7) is PNN.
Decision mechanism will retain the higher lopsided data of discovery loophole possibility in the step (8), give up possibility compared with
Low lopsided data
Embodiment three:
Embodiment employed in this example is divided into data input unit, data processing section and test record division
Point.
Data input unit is made of fuzzy data input module and training message import modul.The trained message of user is led
Entering module selection needs trained message to be used, and the training data that user imports in this example is to use Wireshark to grab
Object to be measured Modbus TCP communication data, format be PCAP file.Comprising causing object to be measured loophole in PCAP file
Communication data.The method that fuzzy data input module uses the machine to communicate in this example, using socket communication by third
The fuzzy data that square fuzzy data generator Peach is generated is sent to PNN determination module.
The Modbus message preprocessing module of data processing section imports user using the scapy module of python
PCAP file is parsed, and is obtained original communication data and is communicated corresponding result every time.
Modbus message preprocessing module in data processing section verifies original communication data again.Referring to figure
3.To in the application data (ADU) of Modbus TCP length, element identifier (element ID), function code and data physical length into
Again verification obtains new field to rowAnd it willField is added in application data, obtains improved application number
According to unit (IADU).
Each IADU can be indicated by a vector:
Wherein DATA [n] indicates the value of (n+1)th byte of data field.
Each IADU vector is normalized according to the maximum value that each field can be got.Vector A is obtained,
Wherein MSS is the application data section maximum length that communicating pair is negotiated in TCP/IP handshake procedure.
For i message, an IADU matrix S can be constructedi=(A1,A2,…,Ai)T, in construction process, if vector Ak
Dimension d (Ak) it is less than MAX (d (Am)), (1≤m≤i), then to AkThe insufficient dimension zero padding of vector.
To be further reduced calculation amount, to matrix SiJ arranges to obtain new matrix S before choosingij, remember Sij=(s1,s2,…,
sj)T。
Calculate SijCovariance matrix C:
The characteristic value and feature vector for seeking C carry out descending sort to characteristic value, select the preceding 1st to arrive m (m < j) a characteristic value
λ1,λ2,…,λm, corresponding feature vector p1,p2,…,pmComposition characteristic vector matrix T=(p1,p2,…,pm)。
By SijProject to the data set that PNN construction sample can be obtained on the matrix of feature vector composition
For the available training dataset of i message in sampleNote
According to whether causing the abnormal and abnormal type of test target, it is abnormal that the message in sample can be divided into Y-1 kind
Normal message type is denoted as the 1st seed type by the message of type message and a kind of normal type.Include by t class message herein
Message total is denoted as Nt.Remember rtwForIn the corresponding dimension of w-th of message is m in t class row vector.
In this example, the number of the message of normal type is 1.
PNN is designed as shown in figure 4, being from left to right respectively input layer, mode layer, summation layer and output layer.Wherein input
The element number of input vector is m in layer, i.e. input vector has m feature.Neuron in summation layer is training dataset
In each row vector.Each neuron indicates r in summation layertwClassification belonging to vector.Output layer exports input vector X similarity degree
Maximum classification number.
The working principle of PNN is as shown in Figure 5.PNN is advanced after a data for receiving the input of fuzzy data input module
Line number Data preprocess.Concrete operations are to recalculate input data, are verified, the vector projection obtained after normalized to by
On the matrix T that training sample obtains, vector X=(x is obtained1,x2,…,xm)。
By X=(x1,x2,…,xm) input PNN determination module.
Connection in PNN between input layer and mode layer is to acquire each nerve in mode layer by a Gaussian function
The similarity degree value of each neuron in member and input layer.
All neuron similarity degrees weightings respective in each class are averaging in summation layer.
Input vector X can indicate the similarity degree of t class loophole are as follows:
Wherein σ is to indicate smoothing parameter, for unique adjustable amount, usual σ ∈ (0,1).
Output layer exports the maximum classification of matching similarity, if it is determined that being 1, then it represents that original fuzzy data is very possible
Object to be measured exception can not be caused, and then can not effectively find the loophole of object to be measured, determine the data for redundancy testing data,
And give up it.Determine not to be 1, then transmits data to Modbus test module.
In this example, exception monitoring module, which sends icmp packet to object to be measured by timing to detect object to be measured, is
No normal work.Reply if normal, then object to be measured is working properly, it is on the contrary then to be abnormal.
After detecting that object to be measured work is abnormal, anomaly classification module will read the work log of object to be measured,
And classify to the exception of generation, and record corresponding vulnerability information and test data.
Claims (7)
1. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing, it is characterised in that operating procedure is as follows:
(1) user imports packet capturing file；
(2) communication message is obtained from packet capturing file；
(3) the specific fields information of communication message is verified, and the field information is added among message；
(4) IADU is obtained to message normalized；
(5) williA IADU constructs training matrix,iFor the natural number in addition to 0 and 1；
(6) dimensionality reduction is carried out to training matrix and obtains training data；
(7) decision mechanism is constructed using training data；
(8) decision mechanism determines data to be entered, is given up to it and is retained.
2. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing described in claim 1, it is characterised in that:
Specific fields involved in the step (3) are the fields for reflecting message length information.
3. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing described in claim 1, it is characterised in that:
Benchmark employed in normalized involved in the step (4) is the practical maximum value that each field can be got.
4. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing described in claim 1, it is characterised in that:
When in the step (5) using multiple IADU construction training matrix, each IADU corresponds to the row of training matrix.
5. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing described in claim 1, it is characterised in that:
In the step (6), dimension-reduction treatment mainly includes extracting forefront and PCA processing.
6. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing described in claim 1, it is characterised in that:
Decision mechanism involved in the step (7) is PNN.
7. lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing described in claim 1, it is characterised in that:
Decision mechanism will retain the higher lopsided data of discovery loophole possibility in the step (8), give up the lower deformity of possibility
Data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811166315.8A CN109639624A (en) | 2018-10-08 | 2018-10-08 | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811166315.8A CN109639624A (en) | 2018-10-08 | 2018-10-08 | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109639624A true CN109639624A (en) | 2019-04-16 |
Family
ID=66066339
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811166315.8A Pending CN109639624A (en) | 2018-10-08 | 2018-10-08 | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109639624A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110365678A (en) * | 2019-07-15 | 2019-10-22 | 北京工业大学 | A kind of industry control network protocol bug excavation method based on anti-sample |
| CN111917692A (en) * | 2019-05-10 | 2020-11-10 | 北京车和家信息技术有限公司 | Fuzzy test method, device, equipment and computer readable storage medium |
| CN113242109A (en) * | 2021-04-14 | 2021-08-10 | 中国信息通信研究院 | Method, device and equipment for checking message data |
| CN113259207A (en) * | 2021-07-13 | 2021-08-13 | 中国人民解放军国防科技大学 | QRNN-based stateful network protocol fuzzy test case filtering method |
| CN113419944A (en) * | 2021-05-26 | 2021-09-21 | 深圳开源互联网安全技术有限公司 | Initialization method and device for fuzz test and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080301647A1 (en) * | 2007-06-01 | 2008-12-04 | Microsoft Corporation | Delivering Malformed Data for Fuzz Testing to Software Applications |
| CN104519065A (en) * | 2014-12-22 | 2015-04-15 | 北京卓越信通电子股份有限公司 | Implementation method of industrial control firewall supporting Modbus TCP protocol filtering |
| CN105847249A (en) * | 2016-03-22 | 2016-08-10 | 英赛克科技（北京）有限公司 | Safety protection system and method for Modbus network |
| CN109409408A (en) * | 2018-09-21 | 2019-03-01 | 上海大学 | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing |
-
2018
- 2018-10-08 CN CN201811166315.8A patent/CN109639624A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080301647A1 (en) * | 2007-06-01 | 2008-12-04 | Microsoft Corporation | Delivering Malformed Data for Fuzz Testing to Software Applications |
| CN104519065A (en) * | 2014-12-22 | 2015-04-15 | 北京卓越信通电子股份有限公司 | Implementation method of industrial control firewall supporting Modbus TCP protocol filtering |
| CN105847249A (en) * | 2016-03-22 | 2016-08-10 | 英赛克科技（北京）有限公司 | Safety protection system and method for Modbus network |
| CN109409408A (en) * | 2018-09-21 | 2019-03-01 | 上海大学 | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing |
Non-Patent Citations (1)
| Title |
|---|
| 万明 等: "基于功能码深度检测的Modbus/TCP通信访问控制方法", 《信息与控制》 * |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111917692A (en) * | 2019-05-10 | 2020-11-10 | 北京车和家信息技术有限公司 | Fuzzy test method, device, equipment and computer readable storage medium |
| CN110365678A (en) * | 2019-07-15 | 2019-10-22 | 北京工业大学 | A kind of industry control network protocol bug excavation method based on anti-sample |
| CN113242109A (en) * | 2021-04-14 | 2021-08-10 | 中国信息通信研究院 | Method, device and equipment for checking message data |
| CN113242109B (en) * | 2021-04-14 | 2022-05-27 | 中国信息通信研究院 | Method, device and equipment for checking message data |
| CN113419944A (en) * | 2021-05-26 | 2021-09-21 | 深圳开源互联网安全技术有限公司 | Initialization method and device for fuzz test and storage medium |
| CN113419944B (en) * | 2021-05-26 | 2022-07-12 | 深圳开源互联网安全技术有限公司 | Initialization method and device for fuzz test and storage medium |
| CN113259207A (en) * | 2021-07-13 | 2021-08-13 | 中国人民解放军国防科技大学 | QRNN-based stateful network protocol fuzzy test case filtering method |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109639624A (en) | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing | |
| Zhao et al. | A dimension reduction model and classifier for anomaly-based intrusion detection in internet of things | |
| Sangkatsanee et al. | Practical real-time intrusion detection using machine learning approaches | |
| Zhu et al. | Data mining for network intrusion detection: a comparison of alternative methods | |
| CN110336827B (en) | Modbus TCP protocol fuzzy test method based on abnormal field positioning | |
| Al-Emadi et al. | Using deep learning techniques for network intrusion detection | |
| WO2016082284A1 (en) | Modbus tcp communication behaviour anomaly detection method based on ocsvm dual-profile model | |
| Kato et al. | An intelligent ddos attack detection system using packet analysis and support vector machine | |
| CN107040517A (en) | A kind of cognitive intrusion detection method towards cloud computing environment | |
| KR100877911B1 (en) | Method for detection of p2p-based botnets using a translation model of network traffic | |
| Rout et al. | A hybrid approach for network intrusion detection | |
| Sarwar et al. | Design of an advance intrusion detection system for IoT networks | |
| Sharma et al. | WLI-FCM and artificial neural network based cloud intrusion detection system | |
| Nadiammai et al. | A comprehensive analysis and study in intrusion detection system using data mining techniques | |
| Xu et al. | [Retracted] DDoS Detection Using a Cloud‐Edge Collaboration Method Based on Entropy‐Measuring SOM and KD‐Tree in SDN | |
| Fenil et al. | Towards a secure software defined network with adaptive mitigation of dDoS attacks by machine learning approaches | |
| Zhang et al. | Network Traffic Anomaly Detection Based on ML‐ESN for Power Metering System | |
| Tang et al. | A detection and mitigation scheme of LDoS Attacks via SDN Based on the FSS-RSR Algorithm | |
| Schuster et al. | Attack and fault detection in process control communication using unsupervised machine learning | |
| CN109409408A (en) | Lopsided data filtering method in a kind of Modbus Transmission Control Protocol fuzz testing | |
| Nwakanma et al. | Effective Industrial Internet of Things Vulnerability Detection Using Machine Learning | |
| Kato et al. | Large-scale network packet analysis for intelligent DDoS attack detection development | |
| Sapozhnikova et al. | Intrusion detection system based on data mining technics for industrial networks | |
| Sakhai et al. | Modern cybersecurity solution using supervised machine learning | |
| Bandyopadhyay et al. | A Decision Tree Based Intrusion Detection System for Identification of Malicious Web Attacks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20190416 |
|
| WD01 | Invention patent application deemed withdrawn after publication |