{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T02:53:12Z","timestamp":1791427992586,"version":"4.3.3"},"reference-count":37,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2025,6,13]],"date-time":"2025-06-13T00:00:00Z","timestamp":1749772800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,6,13]],"date-time":"2025-06-13T00:00:00Z","timestamp":1749772800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/100019672","name":"University of Western Macedonia","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100019672","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2025,8]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Industrial Internet of Things (IIoT) environments are ushering in new avenues for connectivity and intelligent control, yet their integration with legacy systems poses substantial security challenges. Present cybersecurity frameworks are insufficient for safeguarding protocols like Modbus\/TCP, widely employed in critical infrastructures such as smart grids and healthcare. This protocol\u2019s inherent vulnerabilities-specifically, the lack of robust authentication and authorisation mechanisms-render industrial networks susceptible to a spectrum of cyberattacks with potentially cascading effects. The research motivation stems from the urgent need for an adaptive, robust security solution that bridges this gap. To address these issues, we propose an integrated approach that combines advanced threat modeling with state-of-the-art detection and mitigation techniques. First, we develop a comprehensive Modbus\/TCP threat model by integrating STRIDE-per-element analysis, Attack Defence Trees (ADT), and risk assessment frameworks (CVSS and OWASP-RR) to quantitatively and qualitatively evaluate 14 distinct cyber threats. Next, we introduce a novel Intrusion Detection and Prevention System (IDPS) that leverages an Active ResNet50-based Convolutional Neural Network enhanced with Transfer Learning and Active Learning. This enables automated detection and classification of cyberattacks through continuous re-training based on human verification. Finally, our system employs a Software Defined Networking (SDN)-based mitigation strategy, using Thompson Sampling for adaptive, cost-effective decision-making. Experimental evaluation on a custom Modbus\/TCP dataset demonstrates improved accuracy, higher True Positive Rates, and reduced False Positive Rates compared to conventional methods. These outcomes substantiate that integrating AI-driven detection with SDN-based mitigation offers a viable and robust framework to minimize cyberattack impacts on critical IIoT infrastructures.<\/jats:p>","DOI":"10.1007\/s10207-025-01076-2","type":"journal-article","created":{"date-parts":[[2025,6,13]],"date-time":"2025-06-13T08:29:30Z","timestamp":1749803370000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Defending industrial internet of things against Modbus\/TCP threats: A combined AI-based detection and SDN-based mitigation solution"],"prefix":"10.1007","volume":"24","author":[{"given":"Thanasis","family":"Kotsiopoulos","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Panagiotis","family":"Radoglou-Grammatikis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zacharenia","family":"Lekka","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Valeri","family":"Mladenov","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Panagiotis","family":"Sarigiannidis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,6,13]]},"reference":[{"key":"1076_CR1","doi-asserted-by":"crossref","unstructured":"Andronikidis, G., Eleftheriadis, C., Batzos, Z., Kyranou, K., Maropoulos, N., Sargsyan, G., Grammatikis, P.R., Sarigiannidis, P.: in 2024 IEEE International Conference on Cyber Security and Resilience (CSR) (IEEE, 2024), 777\u2013782","DOI":"10.1109\/CSR61664.2024.10679380"},{"key":"1076_CR2","doi-asserted-by":"crossref","unstructured":"Kelli, V., Radoglou-Grammatikis, P., Lagkas, T., Markakis, E.K., Sarigiannidis, P.: in 2022 IEEE international conference on cyber security and resilience (CSR) (IEEE, 2022), 351\u2013356","DOI":"10.1109\/CSR54599.2022.9850291"},{"key":"1076_CR3","doi-asserted-by":"crossref","unstructured":"Amponis, G., Radoglou-Grammatikis, P., Nakas, G., Goudos, S., Argyriou, V., Lagkas, T., Sarigiannidis, P.: in 2023 12th International Conference on Modern Circuits and Systems Technologies (MOCAST) (IEEE, 2023), 1\u20134","DOI":"10.1109\/MOCAST57943.2023.10176693"},{"key":"1076_CR4","doi-asserted-by":"crossref","unstructured":"Radoglou-Grammatikis, P., Liatifis, A., Dalamagkas, C., Lekidis, A., Voulgaridis, K., Lagkas, T., Fotos, N., Menesidou, S.A., Krousarlis, T., Alcazar, P.R. et\u00a0al., in Proceedings of the 18th International Conference on Availability, Reliability and Security, 1\u20138 (2023)","DOI":"10.1145\/3600160.3605161"},{"key":"1076_CR5","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104077","volume":"147","author":"E Iturbe","year":"2024","unstructured":"Iturbe, E., Llorente-Vazquez, O., Rego, A., Rios, E., Toledo, N.: Unleashing offensive artificial intelligence: Automated attack technique code generation. Computers & Security 147, 104077 (2024)","journal-title":"Computers & Security"},{"issue":"2","key":"1076_CR6","doi-asserted-by":"publisher","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","volume":"21","author":"A Alshamrani","year":"2019","unstructured":"Alshamrani, A., Myneni, S., Chowdhary, A., Huang, D.: A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities. IEEE Commun. Surv. & Tutor. 21(2), 1851 (2019)","journal-title":"IEEE Commun. Surv. & Tutor."},{"issue":"3","key":"1076_CR7","doi-asserted-by":"publisher","first-page":"30","DOI":"10.1016\/j.tej.2017.02.006","volume":"30","author":"JE Sullivan","year":"2017","unstructured":"Sullivan, J.E., Kamensky, D.: How cyber-attacks in Ukraine show the vulnerability of the US power grid. Electr. J. 30(3), 30 (2017)","journal-title":"Electr. J."},{"issue":"2","key":"1076_CR8","doi-asserted-by":"publisher","first-page":"3839","DOI":"10.32604\/cmc.2022.023399","volume":"71","author":"A Berguiga","year":"2022","unstructured":"Berguiga, A., Harchay, A.: An IoT-Based Intrusion Detection System Approach for TCP SYN Attacks. Comput., Mater. & Contin. 71(2), 3839\u20133851 (2022). https:\/\/doi.org\/10.32604\/cmc.2022.023399","journal-title":"Comput., Mater. & Contin."},{"issue":"3","key":"1076_CR9","doi-asserted-by":"publisher","first-page":"4663","DOI":"10.32604\/cmc.2022.026972","volume":"72","author":"A Massaoudi","year":"2022","unstructured":"Massaoudi, A., Berguiga, A., Harchay, A.: Secure Irrigation System for Olive Orchards Using Internet of Things. Comput., Mater. & Contin. 72(3), 4663\u20134673 (2022). https:\/\/doi.org\/10.32604\/cmc.2022.026972","journal-title":"Comput., Mater. & Contin."},{"key":"1076_CR10","doi-asserted-by":"publisher","first-page":"38404","DOI":"10.1109\/ACCESS.2025.3545918","volume":"13","author":"A Berguiga","year":"2025","unstructured":"Berguiga, A., Harchay, A., Massaoudi, A.: HIDS-RPL: A Hybrid Deep Learning-Based Intrusion Detection System for RPL in Internet of Medical Things Network. IEEE Access 13, 38404 (2025). https:\/\/doi.org\/10.1109\/ACCESS.2025.3545918","journal-title":"IEEE Access"},{"key":"1076_CR11","unstructured":"Kotzanikolaou, P., Theoharidou, M., Gritzalis, D.: in International Workshop on Critical Information Infrastructures Security (Springer, 2011), 104\u2013115"},{"key":"1076_CR12","doi-asserted-by":"crossref","unstructured":"Mendes, G., Loew, A., Honkapuro, S.: in 2019 IEEE Power & Energy Society General Meeting (PESGM) (IEEE, 2019), 1\u20135","DOI":"10.1109\/PESGM40551.2019.8973689"},{"key":"1076_CR13","doi-asserted-by":"crossref","unstructured":"Iturbe, E., Rios, E., Toledo, N.: in 2023 IEEE International Conference on Cloud Computing Technology and Science (CloudCom) (IEEE, 2023), 291\u2013297","DOI":"10.1109\/CloudCom59040.2023.00054"},{"key":"1076_CR14","doi-asserted-by":"crossref","unstructured":"Asimopoulos, D.C., Radoglou-Grammatikis, P., Makris, I., Mladenov, V., Psannis, K.E., Goudos, S., Sarigiannidis, P.: in Proceedings of the 18th International Conference on Availability, Reliability and Security (2023), 1\u20138","DOI":"10.1145\/3600160.3605163"},{"key":"1076_CR15","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2022.105116","volume":"114","author":"AMK Adawadkar","year":"2022","unstructured":"Adawadkar, A.M.K., Kulkarni, N.: Cyber-security and reinforcement learning-a brief survey. Eng. Appl. Artif. Intell. 114, 105116 (2022)","journal-title":"Eng. Appl. Artif. Intell."},{"key":"1076_CR16","doi-asserted-by":"crossref","unstructured":"Grigoriadou, S., Radoglou-Grammatikis, P., Sarigiannidis, P., Makris, I., Lagkas, T., Argyriou, V., Lytos, A., Fountoukidis, E.: in 2023 IEEE International Conference on Cyber Security and Resilience (CSR) (IEEE, 2023), 142\u2013147","DOI":"10.1109\/CSR57506.2023.10224981"},{"key":"1076_CR17","doi-asserted-by":"crossref","unstructured":"Liatifis, A., Dalamagkas, C., Radoglou-Grammatikis, P., Lagkas, T., Markakis, E., Mladenov, V., Sarigiannidis, P.: in Proceedings of the 17th International Conference on Availability, Reliability and Security (2022), 1\u20136","DOI":"10.1145\/3538969.3544479"},{"issue":"2","key":"1076_CR18","first-page":"16","volume":"18","author":"P Radoglou-Grammatikis","year":"2023","unstructured":"Radoglou-Grammatikis, P.: SecureCyber: an SDN-enabled SIEM for enhanced cybersecurity in the industrial internet of things. MMTC Commun.-Front. 18(2), 16 (2023)","journal-title":"MMTC Commun.-Front."},{"issue":"1","key":"1076_CR19","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1109\/JPROC.2020.3004555","volume":"109","author":"F Zhuang","year":"2020","unstructured":"Zhuang, F., Qi, Z., Duan, K., Xi, D., Zhu, Y., Zhu, H., Xiong, H., He, Q.: A comprehensive survey on transfer learning. Proc. IEEE 109(1), 43 (2020)","journal-title":"Proc. IEEE"},{"issue":"9","key":"1076_CR20","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3472291","volume":"54","author":"P Ren","year":"2021","unstructured":"Ren, P., Xiao, Y., Chang, X., Huang, P.Y., Li, Z., Gupta, B.B., Chen, X., Wang, X.: A survey of deep active learning. ACM computing surveys (CSUR) 54(9), 1 (2021)","journal-title":"ACM computing surveys (CSUR)"},{"issue":"8","key":"1076_CR21","doi-asserted-by":"publisher","first-page":"251","DOI":"10.3390\/info10080251","volume":"10","author":"E Li","year":"2019","unstructured":"Li, E., Kang, C., Huang, D., Hu, M., Chang, F., He, L., Li, X.: Quantitative Model of Attacks on Distribution Automation Systems Based on CVSS and Attack Trees. Information 10(8), 251 (2019)","journal-title":"Information"},{"key":"1076_CR22","doi-asserted-by":"crossref","unstructured":"Radoglou-Grammatikis, P., Dalamagkas, C., Lagkas, T., Zafeiropoulou, M., Atanasova, M., Zlatev, P., Boulogeorgos, A.A.A., Argyriou, V., Markakis, E.K., Moscholios, I. et\u00a0al., in GLOBECOM 2022-2022 IEEE Global Communications Conference (IEEE, 2022), 1856\u20131861","DOI":"10.1109\/GLOBECOM48099.2022.10000880"},{"issue":"9","key":"1076_CR23","doi-asserted-by":"publisher","first-page":"1622","DOI":"10.1016\/j.jss.2009.08.023","volume":"83","author":"SH Houmb","year":"2010","unstructured":"Houmb, S.H., Franqueira, V.N., Engum, E.A.: Quantifying security risk level from CVSS estimates of frequency and impact. J. Syst. Softw. 83(9), 1622 (2010)","journal-title":"J. Syst. Softw."},{"key":"1076_CR24","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1016\/j.ijcip.2008.08.003","volume":"1","author":"P Huitsing","year":"2008","unstructured":"Huitsing, P., Chandia, R., Papa, M., Shenoi, S.: Attack taxonomies for the Modbus protocols. Int. J. Crit. Infrastruct. Prot. 1, 37 (2008)","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"1076_CR25","doi-asserted-by":"crossref","unstructured":"Baptista, I., Shiaeles, S., Kolokotronis, N.: in 2019 IEEE International Conference on Communications Workshops (ICC Workshops) (IEEE, 2019), 1\u20136","DOI":"10.1109\/ICCW.2019.8757060"},{"key":"1076_CR26","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3019330","volume":"8","author":"JA P\u00e9rez-D\u00edaz","year":"2020","unstructured":"P\u00e9rez-D\u00edaz, J.A., Valdovinos, I.A., Choo, K.K.R., Zhu, D.: A flexible SDN-based architecture for identifying and mitigating low-rate DDoS attacks using machine learning. IEEE Access 8, 155859 (2020)","journal-title":"IEEE Access"},{"key":"1076_CR27","doi-asserted-by":"publisher","unstructured":"Berde, P., Gerola, M., Hart, J., Higuchi, Y., Kobayashi, M., Koide, T., Lantz, B., O\u2019Connor, B., Radoslavov, P., Snow, W., Parulkar, G.: (Association for Computing Machinery, New York, NY, USA, 2014), HotSDN \u201914, p. 1-6. https:\/\/doi.org\/10.1145\/2620728.2620744","DOI":"10.1145\/2620728.2620744"},{"key":"1076_CR28","doi-asserted-by":"crossref","unstructured":"Khan, R., McLaughlin, K., Laverty, D., Sezer, S.: in 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe) (IEEE, 2017), 1\u20136","DOI":"10.1109\/ISGTEurope.2018.8571879"},{"key":"1076_CR29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.cosrev.2014.07.001","volume":"13","author":"B Kordy","year":"2014","unstructured":"Kordy, B., Pi\u00e8tre-Cambac\u00e9d\u00e8s, L., Schweitzer, P.: DAG-based attack and defense modeling: Don\u2019t miss the forest for the attack trees. Computer science review 13, 1 (2014)","journal-title":"Computer science review"},{"key":"1076_CR30","doi-asserted-by":"crossref","unstructured":"Radoglou-Grammatikis, P., Siniosoglou, I., Liatifis, T., Kourouniadis, A., Rompolos, K., Sarigiannidis, P.: in 2020 9th International Conference on Modern Circuits and Systems Technologies (MOCAST) (IEEE, 2020), 1\u20134","DOI":"10.1109\/MOCAST49295.2020.9200287"},{"key":"1076_CR31","unstructured":"Shostack, A.: Threat modeling: Designing for security (John Wiley & Sons, 2014)"},{"key":"1076_CR32","unstructured":"https:\/\/ryu-sdn.org\/"},{"key":"1076_CR33","doi-asserted-by":"publisher","unstructured":"Ong, B.L., Kiat Yeo, C.: in 9th IEEE Annual Ubiquitous Computing. Electronics & Mobile Communication Conference (UEMCON) 2018, 412\u2013417 (2018). https:\/\/doi.org\/10.1109\/UEMCON.2018.8796839","DOI":"10.1109\/UEMCON.2018.8796839"},{"key":"1076_CR34","doi-asserted-by":"crossref","unstructured":"Pan, S.J., Yang, Q.: A survey on transfer learning. IEEE Trans. Knowl. Data Eng. 22(10), 1345 (2009)","DOI":"10.1109\/TKDE.2009.191"},{"key":"1076_CR35","unstructured":"Li, D., Wang, Z., Chen, Y., Jiang, R., Ding, W., Okumura, M.: A survey on deep active learning: Recent advances and new frontiers (2024). https:\/\/arxiv.org\/abs\/2405.00334"},{"issue":"18","key":"1076_CR36","doi-asserted-by":"publisher","first-page":"5305","DOI":"10.3390\/s20185305","volume":"20","author":"P Radoglou Grammatikis","year":"2020","unstructured":"Radoglou Grammatikis, P., Sarigiannidis, P., Efstathopoulos, G., Panaousis, E.: ARIES: a novel multivariate intrusion detection system for smart grid. Sensors 20(18), 5305 (2020)","journal-title":"Sensors"},{"key":"1076_CR37","doi-asserted-by":"crossref","unstructured":"Wong, K., Dillabaugh, C., Seddigh, N., Nandy, B.: in 2017 IEEE 30th Canadian Conference on Electrical and Computer Engineering (CCECE) (IEEE, 2017), 1\u20135","DOI":"10.1109\/CCECE.2017.7946818"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-01076-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-025-01076-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-01076-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T11:32:39Z","timestamp":1757071959000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-025-01076-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,13]]},"references-count":37,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,8]]}},"alternative-id":["1076"],"URL":"https:\/\/doi.org\/10.1007\/s10207-025-01076-2","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,13]]},"assertion":[{"value":"13 June 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"157"}}