Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization

2026-08-17

AI Summary

This study addresses the challenges of incomplete process variable observation in industrial cyber-physical systems and the failure of existing reverse engineering methods under mixed traffic and long-payload conditions. We propose PVParser, a novel framework that pioneers a search-optimization-based paradigm for non-sequential field segmentation. By formulating variable recovery as an optimization problem and integrating periodic pattern detection with an improved Monte Carlo Tree Search, PVParser effectively mitigates the error propagation inherent in traditional sequential inference. Experimental evaluations across three industrial datasets demonstrate that PVParser significantly outperforms six state-of-the-art baselines in both accuracy and F1-score, achieving high-precision semantic recovery of protocol fields.

Abstract

Process variables (PVs) provide the process evidence needed for process-aware security monitoring in industrial cyber-physical systems (CPSs). However, existing supervisory infrastructures expose only the subset of PV values recorded by historians, leaving many additional runtime PV values unobserved. To address this incomplete process visibility, we study the problem of recovering PV fields and their semantics directly from raw industrial network traffic through protocol reverse engineering (PRE). In this setting, existing PRE methods face two practical challenges: PV-carrying communication is mixed with heterogeneous runtime traffic, and PV-carrying payloads are often long and deployment-specific. Mixed runtime traffic obscures the PV-carrying communication paths, while long payloads create a vast segmentation space in which early segmentation errors can propagate and corrupt the recovery of later fields under sequential inference. In this paper, we formulate the recovery of PV fields from raw network traffic as a search-based optimization problem. Our key insight is that non-sequentially identifying correct segmentations in such a vast segmentation space can be cast as an optimization problem and addressed by searching for near-optimal solutions. We propose PVParser to approach this goal. PVParser first reduces the search space by identifying the PV-carrying payloads from network traffic via a periodic pattern detection mechanism. It then employs a modified Monte Carlo Tree Search to explore near-optimal segmentations, reducing error propagation from incorrect early boundary decisions. Experiments on three representative industrial CPS datasets demonstrate that PVParser achieves high accuracy and F1-score in PV-carrying payload localization and PV field inference, outperforming six state-of-the-art PRE approaches by a significant margin.

Problem

• Process Variable Recovery
• Protocol Reverse Engineering
• Industrial Cyber-Physical Systems
• Network Traffic Analysis
• Payload Segmentation

Innovation

• Search-Based Optimization
• Protocol Reverse Engineering
• Monte Carlo Tree Search
• Process Variable Recovery
• Periodic Pattern Detection