Search papers, labs, and topics across Lattice.
This paper addresses the challenge of recovering process variables (PVs) from raw industrial network traffic, which is crucial for enhancing security monitoring in cyber-physical systems (CPSs). By formulating the recovery task as a search-based optimization problem, the authors introduce PVParser, which utilizes periodic pattern detection to identify PV-carrying payloads and a modified Monte Carlo Tree Search to optimize segmentation and minimize error propagation. Experiments show that PVParser significantly outperforms six existing protocol reverse engineering methods in terms of accuracy and F1-score for PV localization and inference across three industrial datasets.
Non-sequential segmentation of industrial network traffic can be optimized to recover critical process variables, achieving unprecedented accuracy in the field.
Process variables (PVs) provide the process evidence needed for process-aware security monitoring in industrial cyber-physical systems (CPSs). However, existing supervisory infrastructures expose only the subset of PV values recorded by historians, leaving many additional runtime PV values unobserved. To address this incomplete process visibility, we study the problem of recovering PV fields and their semantics directly from raw industrial network traffic through protocol reverse engineering (PRE). In this setting, existing PRE methods face two practical challenges: PV-carrying communication is mixed with heterogeneous runtime traffic, and PV-carrying payloads are often long and deployment-specific. Mixed runtime traffic obscures the PV-carrying communication paths, while long payloads create a vast segmentation space in which early segmentation errors can propagate and corrupt the recovery of later fields under sequential inference. In this paper, we formulate the recovery of PV fields from raw network traffic as a search-based optimization problem. Our key insight is that non-sequentially identifying correct segmentations in such a vast segmentation space can be cast as an optimization problem and addressed by searching for near-optimal solutions. We propose PVParser to approach this goal. PVParser first reduces the search space by identifying the PV-carrying payloads from network traffic via a periodic pattern detection mechanism. It then employs a modified Monte Carlo Tree Search to explore near-optimal segmentations, reducing error propagation from incorrect early boundary decisions. Experiments on three representative industrial CPS datasets demonstrate that PVParser achieves high accuracy and F1-score in PV-carrying payload localization and PV field inference, outperforming six state-of-the-art PRE approaches by a significant margin.
