Deterministic Intrusion Detection Rules for MODBUS Protocols

This paper introduces a set intrusion detection system rules for MODBUS/TCP and MODBUS over Serial Line systems. The rules described in this paper were derived from a vulnerability analysis of the MODBUS protocols. In total the paper describes 50 signature based intrusion detection sys-tem rules. Details on protocol requirements and the construction of the rules are provided for each rule. Rule descriptions are generic to encourage use on multiple intrusion detection system platforms.