基于Modbus功能码细粒度过滤算法的研究  

Research on fine grained filtering algorithm based on Modbus function code

作　　者：张仁斌[1] 李思娴 刘飞 许辅昊 Zhang Renbin;Li Sixian;Liu Fei;Xu Fuhao(School of Computer&Information,Hefei University of Technology,Hefei 230009,China)

机构地区：[1]合肥工业大学计算机与信息学院,合肥230009

出　　处：《计算机应用研究》2018年第1期277-281,共5页Application Research of Computers

摘　　要：针对防火墙粗粒度过滤Modbus/TCP导致工控系统存在安全威胁的问题,研究基于Modbus功能码的细粒度过滤算法。基于Modbus TCP功能码的特征,对其功能码字段进行解析,实现基于白名单规则的细粒度过滤算法。然而大量匹配规则的存储管理对数据过滤过程的查询效率有着决定性的影响,结合对规则集进行分类管理以提高匹配效率。通过构建有效的数据存储结构及对白名单规则的组织与配置,实现了Modbus TCP协议的细粒度过滤,更大程度地提高了Modbus TCP通信的安全性,且保证了通信过程的实时性。通过实验分析,提出的方法可以深度安全地过滤Modbus,提高Modbus通信的安全性。Aiming at the problem of the security threat of the industrial control system caused by the coarse particle filter Modbus/TCP of the firewall,this paper studied the fine grained filtering algorithm based on the Modbus function code.Based on the feature of TCP Modbus protocol function code,it analyzed the function code field,and realized the fine granularity filtering calculation based on the rule of white list.However,the storage management of a large number of matching rules had a decisive influence on the query efficiency of the data filtering process,so this paper combined the classification management of the rule set to improve the matching efficiency.By constructing the effective data storage structure and dialogue list rules of organization and configuration,it realized of the fine-grained filtering of Modbus/TCP protocol,improved a greater degree of the Modbus TCP communication security and ensured the real time communication process.Through experimental analysis,the proposed method can be used to filter the Modbus protocol in depth and improve the security of Modbus communication.

关 键 词：MODBUS TCP/IP协议 功能码 细粒度过滤 数据存储结构 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]