AI 中文总结
本文针对工业 CPS 中过程变量未被完整观测的问题，提出 PVParser 方法，通过协议逆向工程结合搜索优化实现从网络流量中恢复过程变量，性能优于六种现有方法。
AI 中文摘要
过程变量（PVs）为工业网络物理系统（CPS）中基于过程的安全监控提供所需的过程证据。然而，现有的监控基础设施仅公开 historian 记录的 PV 值子集，许多额外的运行时 PV 值未被观测到。为解决这种不完整的过程可见性问题，我们研究通过协议逆向工程（PRE）直接从原始工业网络流量中恢复 PV 字段及其语义的问题。在该场景下，现有 PRE 方法面临两个实际挑战：携带 PV 的通信与异构运行时流量混合，且携带 PV 的负载通常较长且与部署相关。混合运行时流量会掩盖携带 PV 的通信路径，而长负载会产生巨大的分割空间，在顺序推理下，早期分割错误会传播并破坏后续字段的恢复。本文将从原始网络流量中恢复 PV 字段形式化为基于搜索的优化问题，核心见解是在如此巨大的分割空间中非顺序地识别正确分割可转化为优化问题，并通过搜索近似最优解来解决。我们提出 PVParser 实现该目标：首先通过周期性模式检测机制从网络流量中识别携带 PV 的负载，以缩小搜索空间；随后采用改进的蒙特卡洛树搜索探索近似最优分割，减少早期边界决策错误带来的误差传播。在三个具有代表性的工业 CPS 数据集上的实验表明，PVParser 在携带 PV 的负载定位和 PV 字段推理中实现了高准确率和 F1 值，显著优于六种最先进的 PRE 方法。
英文摘要
Process variables (PVs) provide the process evidence needed for process-aware security monitoring in industrial cyber-physical systems (CPSs). However, existing supervisory infrastructures expose only the subset of PV values recorded by historians, leaving many additional runtime PV values unobserved. To address this incomplete process visibility, we study the problem of recovering PV fields and their semantics directly from raw industrial network traffic through protocol reverse engineering (PRE). In this setting, existing PRE methods face two practical challenges: PV-carrying communication is mixed with heterogeneous runtime traffic, and PV-carrying payloads are often long and deployment-specific. Mixed runtime traffic obscures the PV-carrying communication paths, while long payloads create a vast segmentation space in which early segmentation errors can propagate and corrupt the recovery of later fields under sequential inference. In this paper, we formulate the recovery of PV fields from raw network traffic as a search-based optimization problem. Our key insight is that non-sequentially identifying correct segmentations in such a vast segmentation space can be cast as an optimization problem and addressed by searching for near-optimal solutions. We propose PVParser to approach this goal. PVParser first reduces the search space by identifying the PV-carrying payloads from network traffic via a periodic pattern detection mechanism. It then employs a modified Monte Carlo Tree Search to explore near-optimal segmentations, reducing error propagation from incorrect early boundary decisions. Experiments on three representative industrial CPS datasets demonstrate that PVParser achieves high accuracy and F1-score in PV-carrying payload localization and PV field inference, outperforming six state-of-the-art PRE approaches by a significant margin.
CommentsThis is the full version of the paper 'Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization' published at CCS 2026
