Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization
2026-08-17 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors address the problem of missing important process data in industrial systems by recovering these values directly from raw network traffic. They identify that existing methods struggle because such data is mixed with various other messages and tends to have long, complex formats. To solve this, the authors propose PVParser, which first finds relevant data by detecting repeating patterns and then uses a smart search technique to correctly break down the data into meaningful parts without early mistakes causing errors later. Their tests show that PVParser recovers this data more accurately than six other leading methods.
Process Variables (PVs)Industrial Cyber-Physical Systems (CPS)Protocol Reverse Engineering (PRE)Network Traffic AnalysisPayload SegmentationMonte Carlo Tree SearchPeriodic Pattern DetectionData RecoverySupervisory Control and Data Acquisition (SCADA)Optimization Problem
Authors
Chuan Sheng, Shan Jiang, Xiaogang Zhu, Wanlun Ma, Jianming Zhao, Yu Yao, Sheng Wen, Yang Xiang
Abstract
Process variables (PVs) provide the process evidence needed for process-aware security monitoring in industrial cyber-physical systems (CPSs). However, existing supervisory infrastructures expose only the subset of PV values recorded by historians, leaving many additional runtime PV values unobserved. To address this incomplete process visibility, we study the problem of recovering PV fields and their semantics directly from raw industrial network traffic through protocol reverse engineering (PRE). In this setting, existing PRE methods face two practical challenges: PV-carrying communication is mixed with heterogeneous runtime traffic, and PV-carrying payloads are often long and deployment-specific. Mixed runtime traffic obscures the PV-carrying communication paths, while long payloads create a vast segmentation space in which early segmentation errors can propagate and corrupt the recovery of later fields under sequential inference. In this paper, we formulate the recovery of PV fields from raw network traffic as a search-based optimization problem. Our key insight is that non-sequentially identifying correct segmentations in such a vast segmentation space can be cast as an optimization problem and addressed by searching for near-optimal solutions. We propose PVParser to approach this goal. PVParser first reduces the search space by identifying the PV-carrying payloads from network traffic via a periodic pattern detection mechanism. It then employs a modified Monte Carlo Tree Search to explore near-optimal segmentations, reducing error propagation from incorrect early boundary decisions. Experiments on three representative industrial CPS datasets demonstrate that PVParser achieves high accuracy and F1-score in PV-carrying payload localization and PV field inference, outperforming six state-of-the-art PRE approaches by a significant margin.