This paper extends the Single Packet Header Binary Image (SPHBI) intrusion detection methodology from IoT to Modbus TCP, evaluating five approaches spanning a gradient of protocol depth on the CIC Modbus 2023 dataset (11.4 million packets, eight detectable attack types). TCP/IP headers alone achieve only 51.8% binary accuracy, confirming that header-level heterogeneity exploited in IoT traffic is absent in uniform SCADA environments. Adding eight bytes of application-layer information improves binary accuracy to 98.1% with just 63 parameters, directly relevant to per-packet classification on resource-constrained OT edge devices. The best-performing approach achieves 94.4% +/- 2.2pp multiclass accuracy across nine classes (95% CI [92.9%, 95.9%], 10 seeds) with 56,873 parameters, roughly 430 times fewer than comparable ResNet50-based approaches. Per-class recall analysis shows seven of eight detectable attack types identified with recall above 94%, while replay attacks remain structurally undetectable by any single-packet method.

翻译：本文将单包头部二值图像（SPHBI）入侵检测方法论从物联网扩展至Modbus TCP，在CIC Modbus 2023数据集（1140万数据包，八种可检测攻击类型）上评估了覆盖不同协议深度的五种方法。仅使用TCP/IP头部时二值分类准确率仅为51.8%，证实了物联网流量中利用的头部异构性在统一的SCADA环境中并不存在。添加八个字节的应用层信息后，仅需63个参数即可将二值分类准确率提升至98.1%，这直接适用于资源受限的OT边缘设备上的逐包分类任务。性能最优的方法在九类分类中实现了94.4%±2.2个百分点的多类准确率（95%置信区间[92.9%,95.9%]，10次随机种子），参数数量为56,873，约为基于ResNet50的同类方法的1/430。各类别召回率分析显示，八种可检测攻击类型中有七种的召回率高于94%，而重放攻击仍无法被任何单包方法从结构上检测。