2026 · Conference accepted
Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization
PVParser recovers process-variable layouts from industrial traffic and historian records. Periodic-pattern detection locates relevant payloads; a modified Monte Carlo tree search proposes field boundaries, types and endianness, then aligns decoded sequences with observed process variables.
Scope and limitations
Payload localization uses SCADA-N, SWaT and WADI; field/semantic recovery uses SWaT and WADI. Recovery depends on traffic and historian observations plus recurrent, stable plaintext byte layouts. Encrypted traffic, bit-level buses and event-driven messages whose PV lists vary are outside scope. It complements protocol dissectors; results were not independently reproduced.
Why it fits this collection
Infers deployment-specific message fields and semantics from observed communication instead of supplied format specifications.
Publication and review details
- Venue
- CCS 2026
- Status
- Conference accepted
- Publication / posting date
- 2026 (exact date not verified)
- Date source
- The official CCS 2026 accepted-paper list and arXiv v2 establish acceptance; a publication date was not verified.
- First arXiv submission
- August 17, 2026
- arXiv
- 2608.16403
- Reviewed arXiv version
- v2
ArXiv v2 and the CCS 2026 accepted list name four authors; v1 listed eight. The author-supplied DOI 10.1145/3830454.3846584 did not resolve at review, and no publication date or proceedings container was verified. The anonymous review-artifact implementation and license were not inspected.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.