AwesomeREA.org

2025 · Journal article

ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution

Yibo Qu; Dongliang Fang; Zhen Wang; Jiaxing Cheng; Shuaizong Si; Yongle Chen; Limin Sun

Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. It merges bytes using value-preserving operations and similar processing traces. For the 1,000-message datasets of four public ICS protocols, the authors report average boundary F1 of 0.76 and field perfection of 0.67.

Scope and limitations

Recovers message syntax, not field semantics, protocol state machines or endpoint equivalence. It needs the binary, loader configuration and correctly identified initialization, input and parsing functions; manual filtering remains necessary, especially without symbols. Encrypted protocols and bit-level fields are unsupported, and ignored or only copied bytes can be merged incorrectly. Perfection measures fields with both boundaries correct. Quantitative tests use four public protocols with 50- and 1,000-message sets; separate proprietary studies cover three protocols in five firmware targets, with interaction checks on three devices and manually established ground truth. Those checks do not demonstrate complete device behavior.

Why it fits this collection

Adds firmware-assisted protocol format inference using concolic analysis, complementing live-server instrumentation and traffic-only field inference.

Publication and review details

Venue
Proceedings of the ACM on Software Engineering (ISSTA 2025)
Status
Journal article
Publication / posting date
June 22, 2025
Date source
The ACM article page and publisher-deposited Crossref metadata agree on publication on 2025-06-22. The ISSTA presentation date is not substituted for this journal publication date.
DOI
10.1145/3728982

The publisher identifies article ISSTA105 and licenses the paper under CC BY 4.0; its Data Availability section links the repository. The reviewed 2025-04-16 code snapshot has no project-level license declaration. Python 3 dependencies use compatible-release bounds, including angr~=9.2.100, Netzob~=2.0.0 and scapy~=2.5.0; the paper describes Ghidra 11.0.3 for function analysis. The repository includes public-protocol configurations and a Modbus capture, but no firmware images; target binaries and libraries need separate provision. The paper specifies trace-similarity threshold 0.9, while released InferSyntax.py uses 99 on a 100-point scale. Its batch evaluator excludes abnormal traces from aggregate metrics. These source differences prevent treating this snapshot as a reproduced paper configuration. No firmware, captures or model payloads were downloaded, and no upstream code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://dl.acm.org/doi/10.1145/3728982
  2. https://api.crossref.org/works/10.1145/3728982
  3. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/README.md
  4. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/requirements.txt
  5. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/ICEPRE.py
  6. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/Ctracer.py
  7. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/InferSyntax.py
  8. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/modbus_config.yaml
  9. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/enip_config.yaml
  10. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/iec104_config.yaml
  11. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/s7comm_config.yaml
  12. https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/evaluation/syntax_evaluation.py