Quantifying Active Reconnaissance Strain and Designing Passive Protocol-Level Anomaly Detection in Modbus TCP Industrial Control Networks
Year: 2026
Type: article
Abstract: Operational Technology (OT) networks running legacy protocols like Modbus TCP face significant risks due to the lack of native authentication, transport encryption, and session verification. Traditional Information Technology (IT) security practices, such as active network discovery scanning, introduce severe operational strain when applied to resource-constrained Level 1 Programmable Logic Controllers (PLCs). This paper empirically quantifies the impact of active reconnaissance on target PLCs within the GRFICSv3 chemical plant simulation, demonstrating CPU load spikes up to 26.73% (~25x baseline) and response latency degradation up to 409ms (~131x baseline). Furthermore, stateful parameter manipulation over TCP Port 502 using PyModbus demonstrates a 100% successful execution rate for unauthorized Function Code 06 (Write Single Register) commands. To address these vulnerabilities without introducing inline latency or packet dropping risks, a streaming, non-intrusive C-backed passive protocol anomaly detection engine (modbus_detector_fast.py) was engineered using a tshark subprocess backend. The passive engine achieved a 100% detection rate across synthetic attack vectors with zero false positives on baseline industrial traffic and execution times under 2 seconds. Defense-in-depth recommendations aligned with IEC 62443 are provided for OT network security architects.
Author: Obidike, Chinaza
Language: English
Subfield: Control and Systems Engineering
Field: Engineering
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7212223218
FWCI:
Cites:
Cited by:
Related to: