## 3 Proposed Testbed for Cybersecurity Analysis of Nuclear Power Plants
### Modbus/TCP Protocol and the Modbus Simulator  
Modbus is a protocol for industrial communications that was created more than 40 years ago (by PLC manufacturer Modicon, now Schneider Electric) and still enjoys great popularity for real world SCADA/ICS implementations. There are several reasons for \begin{table}
\begin{tabular}{l l} \hline \hline
**Role Performed** & **Component** \\ \hline NPP Simulator & Asherah NPP Simulator (ANS) 1 \\ Communications Protocol & Modbus/TCP \\ Modbus Simulator & ModRSim2 [20] \\ Network Simulator & GNS3 2 [21] \\ Software Router & V/Og (GNS3 Appliance) [22] \\ Software PLC and Ladder Program Editor & OpenPLC 1.3 (Editor and Runtime) 3 [23] \\ Arduino PLC & ESP8266 NodeMCU v1.0 ESP-12E \\ SCADA/HMI & ScadaBR 1.2 [24] \\ Cyber-attack Plataform & Kali Linux [25] \\ MITM Tool & Ettercap [26] \\ Historian & MySQL Workbench 4 [27] \\ Network protocol analyzer & Wireshark [28] \\ \hline \hline \end{tabular}  
* Note: running inside Simulink/MATLAB on a Windows 10 (64-bit) VM., 2 Note: VMware Workstation Player [29] and Oracle VirtualBox [30] used as hypervisors for the GNS3 appliances and VMs. 3 Note: installed on an Ubuntu 20.04 VM. 4 Note: visual tool to manage the open-source MySQL Community Edition [31] database, utilized by ScadaBR.  
\end{table} 
Table 1: Nuclear testbed. List of components. Figure 2: MITM Attack against the nuclear testbed. this: it is an open standard that is easy to implement and optionally available for almost all commercial automation equipment. This allows the same plant to easily integrate equipment from different manufacturers into its operations. The protocol is also a favorite for cybersecurity studies, since in its standard form it has no mechanisms to ensure confidentiality or data integrity, among other vulnerabilities. It is also possible use search engines for Internet connected devices, like Shodan [32], to locate and remotely attack Modbus systems. Furthermore, since different brands of PLC accept the protocol as an option and it responds to external commands regardless of authentication, they can easily be victimized by injection attacks [33; 34]. Last but not least, the open-source software chosen to build our testbed; specifically, ScadaBR and OpenPLC, both support the Modbus protocol. It should be noted that commercial PLC brands in general feature their own proprietary protocols and in some cases accompanying simulation software, also proprietary. Modbus/TCP is one of three variants of the protocol and allows communication over Ethernet networks on standard port 502 (the other two being Modbus ASCII and Modbus RTU). It uses the client-server architecture and its communications are based on exchanging Ethernet Request and Response frames, as can be seen in Figure 3.  
Figure 4 shows how the Modbus TCP packet is encapsulated in the data section of the conventional Ethernet Frame. It is structured as follows: MBAP (Modbus Application Protocol) header followed by the PDU (Protocol Data Unit) section. This last section contains the message itself, consisting of: (a) function code, which indicates the desired operation (such as read and write); and (b) data, related to the operation defined in the previous field, such as addresses or values to write. Table 2 shows common Modbus function codes. Figure 4: Modbus TCP packet structure. Figure 3: Modbus/TCP client-server communication. The protocol has a particular addressing scheme that consists in dividing its memory area into four sections; for discrete (Boolean) and analog values (Coils and Registers), read-only or read-write, as can be seen in Table 3. Each of these addresses can store data types of up to 16 bits. Therefore, to use 32-bit data types, it is necessary to use two consecutive addresses for each of these values. In the particular implementation of our testbed, characterized by simulated physical processes of mainly continuous nature, we chose to use only the Holding Registers section of Modbus memory.