{"id":"https://openalex.org/W4389237207","doi":"https://doi.org/10.3390/jcp3040041","title":"Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis","display_name":"Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis","publication_year":2023,"publication_date":"2023-12-01","ids":{"openalex":"https://openalex.org/W4389237207","doi":"https://doi.org/10.3390/jcp3040041"},"language":"en","primary_location":{"id":"doi:10.3390/jcp3040041","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp3040041","pdf_url":"https://www.mdpi.com/2624-800X/3/4/41/pdf?version=1701415916","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2624-800X/3/4/41/pdf?version=1701415916","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081138500","display_name":"Tirthankar Ghosh","orcid":"https://orcid.org/0000-0003-1914-711X"},"institutions":[{"id":"https://openalex.org/I40253897","display_name":"University of New Haven","ror":"https://ror.org/00zm4rq24","country_code":"US","type":"education","lineage":["https://openalex.org/I40253897"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Tirthankar Ghosh","raw_affiliation_strings":["Department of Electrical & Computer Engineering and Computer Science, University of New Haven, West Haven, CT 06516, USA"],"raw_orcid":"https://orcid.org/0000-0003-1914-711X","affiliations":[{"raw_affiliation_string":"Department of Electrical & Computer Engineering and Computer Science, University of New Haven, West Haven, CT 06516, USA","institution_ids":["https://openalex.org/I40253897"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038428882","display_name":"Sikha Bagui","orcid":"https://orcid.org/0000-0002-1886-4582"},"institutions":[{"id":"https://openalex.org/I83683471","display_name":"University of West Florida","ror":"https://ror.org/002w4zy91","country_code":"US","type":"education","lineage":["https://openalex.org/I83683471"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sikha Bagui","raw_affiliation_strings":["Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA","Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA;"],"raw_orcid":"https://orcid.org/0000-0002-1886-4582","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","institution_ids":["https://openalex.org/I83683471"]},{"raw_affiliation_string":"Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA","institution_ids":["https://openalex.org/I83683471"]},{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA;","institution_ids":["https://openalex.org/I83683471"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102947824","display_name":"Subhash C. Bagui","orcid":"https://orcid.org/0000-0001-6140-5384"},"institutions":[{"id":"https://openalex.org/I83683471","display_name":"University of West Florida","ror":"https://ror.org/002w4zy91","country_code":"US","type":"education","lineage":["https://openalex.org/I83683471"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Subhash Bagui","raw_affiliation_strings":["Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA","Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA;"],"raw_orcid":"https://orcid.org/0000-0001-6140-5384","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","institution_ids":["https://openalex.org/I83683471"]},{"raw_affiliation_string":"Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA","institution_ids":["https://openalex.org/I83683471"]},{"raw_affiliation_string":"Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA;","institution_ids":["https://openalex.org/I83683471"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093397369","display_name":"Martin Kadzis","orcid":null},"institutions":[{"id":"https://openalex.org/I83683471","display_name":"University of West Florida","ror":"https://ror.org/002w4zy91","country_code":"US","type":"education","lineage":["https://openalex.org/I83683471"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Martin Kadzis","raw_affiliation_strings":["Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA;"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","institution_ids":["https://openalex.org/I83683471"]},{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA;","institution_ids":["https://openalex.org/I83683471"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5104206630","display_name":"Jackson Bare","orcid":null},"institutions":[{"id":"https://openalex.org/I83683471","display_name":"University of West Florida","ror":"https://ror.org/002w4zy91","country_code":"US","type":"education","lineage":["https://openalex.org/I83683471"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jackson Bare","raw_affiliation_strings":["Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA;"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA","institution_ids":["https://openalex.org/I83683471"]},{"raw_affiliation_string":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA;","institution_ids":["https://openalex.org/I83683471"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5081138500"],"corresponding_institution_ids":["https://openalex.org/I40253897"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1114},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1114},"fwci":2.0008,"has_fulltext":true,"cited_by_count":15,"citation_normalized_percentile":{"value":0.86633069,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"3","issue":"4","first_page":"895","last_page":"913"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7497546672821045},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6969419717788696},{"id":"https://openalex.org/keywords/ewma-chart","display_name":"EWMA chart","score":0.6498889923095703},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.5496370792388916},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.548105001449585},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5416702628135681},{"id":"https://openalex.org/keywords/modbus","display_name":"Modbus","score":0.5109962224960327},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.49792909622192383},{"id":"https://openalex.org/keywords/man-in-the-middle-attack","display_name":"Man-in-the-middle attack","score":0.49468180537223816},{"id":"https://openalex.org/keywords/traffic-analysis","display_name":"Traffic analysis","score":0.4436100721359253},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.4193370044231415},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.41287457942962646},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.34123170375823975},{"id":"https://openalex.org/keywords/control-chart","display_name":"Control chart","score":0.26120835542678833},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.22308653593063354},{"id":"https://openalex.org/keywords/communications-protocol","display_name":"Communications protocol","score":0.12448358535766602},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.09273380041122437},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.09156188368797302}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7497546672821045},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6969419717788696},{"id":"https://openalex.org/C74746147","wikidata":"https://www.wikidata.org/wiki/Q5324652","display_name":"EWMA chart","level":4,"score":0.6498889923095703},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.5496370792388916},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.548105001449585},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5416702628135681},{"id":"https://openalex.org/C2776666747","wikidata":"https://www.wikidata.org/wiki/Q1135322","display_name":"Modbus","level":3,"score":0.5109962224960327},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.49792909622192383},{"id":"https://openalex.org/C196491621","wikidata":"https://www.wikidata.org/wiki/Q554830","display_name":"Man-in-the-middle attack","level":3,"score":0.49468180537223816},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.4436100721359253},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.4193370044231415},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.41287457942962646},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34123170375823975},{"id":"https://openalex.org/C196985124","wikidata":"https://www.wikidata.org/wiki/Q1369242","display_name":"Control chart","level":3,"score":0.26120835542678833},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.22308653593063354},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.12448358535766602},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.09273380041122437},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.09156188368797302},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp3040041","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp3040041","pdf_url":"https://www.mdpi.com/2624-800X/3/4/41/pdf?version=1701415916","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:8fc36094975540b2a27fef8d4d3a4ba1","is_oa":true,"landing_page_url":"https://doaj.org/article/8fc36094975540b2a27fef8d4d3a4ba1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 3, Iss 4, Pp 895-913 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp3040041","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp3040041","pdf_url":"https://www.mdpi.com/2624-800X/3/4/41/pdf?version=1701415916","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6000000238418579,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4389237207.pdf"},"referenced_works_count":22,"referenced_works":["https://openalex.org/W195047088","https://openalex.org/W1617459194","https://openalex.org/W2021702566","https://openalex.org/W2101722046","https://openalex.org/W2105960882","https://openalex.org/W2129898854","https://openalex.org/W2141910941","https://openalex.org/W2155915275","https://openalex.org/W2161592722","https://openalex.org/W2608911009","https://openalex.org/W2625243865","https://openalex.org/W2753352458","https://openalex.org/W2790915158","https://openalex.org/W2898280479","https://openalex.org/W2962910311","https://openalex.org/W3016482482","https://openalex.org/W3036782255","https://openalex.org/W3134875698","https://openalex.org/W3172510111","https://openalex.org/W4256497308","https://openalex.org/W6674805939","https://openalex.org/W6738520201"],"related_works":["https://openalex.org/W2394363056","https://openalex.org/W2362216025","https://openalex.org/W2371014880","https://openalex.org/W3015293401","https://openalex.org/W2357768347","https://openalex.org/W4223430807","https://openalex.org/W2379048028","https://openalex.org/W4213139828","https://openalex.org/W4285816602","https://openalex.org/W2253379000"],"abstract_inverted_index":{"This":[0,96],"article":[1],"presents":[2,98],"a":[3,38,107,123],"statistical":[4,20],"approach":[5,42],"using":[6,122,144,201],"entropy":[7,110,128,148],"and":[8,28,79,146,155,217,225],"classification-based":[9,124,182],"analysis":[10,111,121,129,149,183],"to":[11,25,31,50,207],"detect":[12,32],"anomalies":[13],"in":[14,34,43,60,76,176,205],"industrial":[15],"control":[16],"systems":[17],"traffic.":[18],"Several":[19],"techniques":[21],"have":[22],"been":[23],"proposed":[24],"create":[26],"baselines":[27],"measure":[29],"deviation":[30,53],"intrusion":[33,40],"enterprise":[35],"networks":[36],"with":[37,70,131,236,260],"centralized":[39,74],"detection":[41,90,175],"mind.":[44],"Looking":[45],"at":[46],"traffic":[47,115],"volume":[48],"alone":[49],"find":[51],"anomalous":[52],"may":[54,58,141,162],"not":[55,159],"be":[56,142,163,227],"enough\u2014it":[57],"result":[59],"increased":[61],"false":[62],"positives.":[63],"The":[64],"near":[65],"real-time":[66],"communication":[67],"requirements,":[68],"coupled":[69],"the":[71,83,120,166,177,187,191,198,208,221,231,237,242,251,254,261,269],"lack":[72],"of":[73,82,139,152,173,190,214,247,266],"infrastructure":[75],"operations":[77],"technology":[78],"limited":[80],"resources":[81],"sensor":[84],"motes,":[85],"require":[86],"an":[87],"efficient":[88],"anomaly":[89,140],"system":[91],"characterized":[92],"by":[93,105],"these":[94],"limitations.":[95],"paper":[97],"extended":[99],"results":[100,189,224,244],"from":[101],"our":[102,132],"previous":[103],"work":[104],"presenting":[106],"detailed":[108,127],"cluster-based":[109],"on":[112],"selected":[113],"network":[114],"features.":[116,211],"It":[117],"further":[118],"extends":[119],"approach.":[125],"Our":[126,181],"corroborates":[130],"earlier":[133],"findings":[134],"that,":[135,185],"although":[136],"some":[137],"degree":[138],"detected":[143],"univariate":[145],"bivariate":[147],"for":[150,165,250],"Denial":[151],"Service":[153],"(DOS)":[154],"Man-in-the-Middle":[156],"(MITM)":[157],"attacks,":[158],"much":[160,195],"information":[161],"obtained":[164],"initial":[167],"reconnaissance,":[168],"thus":[169],"preventing":[170],"early":[171],"stages":[172],"attack":[174,258],"Cyber":[178],"Kill":[179],"Chain.":[180],"shows":[184],"overall,":[186],"classification":[188,223],"DOS":[192,232],"attacks":[193,200],"were":[194],"higher":[196],"than":[197],"MITM":[199,252],"two":[202],"Modbus":[203],"features":[204],"addition":[206],"three":[209],"TCP/IP":[210],"In":[212],"terms":[213],"classifiers,":[215],"J48":[216],"random":[218],"forest":[219],"had":[220,241,268],"best":[222,243,270],"can":[226],"considered":[228],"comparable.":[229],"For":[230],"attack,":[233,253],"no":[234],"resampling":[235],"60\u201340":[238],"(training/testing":[239],"split)":[240],"(average":[245,264],"accuracy":[246,265],"97.87%),":[248],"but":[249],"80\u201320":[255],"non-attack":[256],"vs.":[257],"data":[259],"75\u201325":[262],"split":[263],"82.81%)":[267],"results.":[271]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}