Subject: [sacm] draft-li-sacm-anomaly-detection-00

From: "此间" <[email-masked]>
Date: Fri, 3 Mar 2017 11:33:16 +0800

Hello all,
My colleagues and I put forward some ideas about anomaly detection of Industrial Control System based on Modbus/TCP,we also have submitted an document online to sacm group  working of IETF organization, which is "draft-li-sacm-anomaly-detection-00", https://datatracker.ietf.org/doc/draft-li-sacm-anomaly-detection/

Aiming at the vulnerability and security threat of Industrial Control System, this document proposed a detection model based on the characteristics of Modbus/TCP protocol.

Looking forward to your reply and feekback

Best wishes,

                    Jie Liao

---

From: Jerome Athias <[email-masked]>
Date: Fri, 03 Mar 2017 13:02:19 +0000

Hello,

Thanks for sharing

Few comments.
I think it's a bit out of scope for SACM (for now).
It is of interest and the approach makes sense.
The "input labeling" part would be interesting' especially if the protocol
characteristics could be represented in a structured language. Do you have
samples to share while some observables/patterns could be interesting

Best regards

On Fri, 3 Mar 2017 at 06:33, 此间 <[email-masked]> wrote:

> Hello all,
> My colleagues and I put forward some ideas about anomaly detection of
> Industrial Control System based on Modbus/TCP,we also have submitted an
> document online to sacm group  working of IETF organization, which is
> "draft-li-sacm-anomaly-detection-00",
> https://datatracker.ietf.org/doc/draft-li-sacm-anomaly-detection/
>
> Aiming at the vulnerability and security threat of Industrial Control
> System, this document proposed a detection model based on the
> characteristics of Modbus/TCP protocol.
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>