Reverse Engineering of Industrial Control Protocol: A Survey

Industrial Control Systems (ICS) are designed to monitor and control industrial processes, enabling the automation and management of critical sectors such as production, manufacturing, and energy through various devices and communication protocols. Industrial control protocols refer to the standardized rules and formats used for communication among industrial automation devices, encompassing functions such as data transmission, control commands, and status monitoring to facilitate the supervision and control of production processes. Over the past decades, ICSs have typically operated within isolated and closed network environments, where many protocol specifications remained proprietary and unknown, thereby hindering the evaluation and enhancement of protocol security. This limitation has driven the development of reverse engineering approaches for industrial control protocols. In order to systematically summarize the current research results and development context of industrial control protocol reverse engineering, this paper builds a complete technical framework around the typical steps of protocol reverse engineering and makes a structured summary and classification of the existing reverse engineering methods of industrial control protocols. It classifies and summarizes the existing methods in seven aspects, including data acquisition, message clustering, field division, key field identification, field semantic derivation, state machine modeling, and application. Meanwhile, this paper selects typical studies for representative analysis, further summarizes the common problems and limitations of current methods, and finally, combined with future implementation needs, proposes several research directions worthy of attention.