Reverse engineering of industrial control protocols based on BERT-BiLSTM-CRF
LIAN Lian
LI Sumin
ZONG Xuejun
HE Kan
Abstract：[Objective]Industrial control protocol parsing is a critical component of industrial internet security.However,traditional methods suffer from poor universality and low accuracy.These issues lead to a low efficiency in protocol parsing,making it difficult to meet the demands for high precision and adaptability in real-world industrial scenarios.[Methods]A deep learning-based reverse engineering method was proposed for industrial control protocols by integrating a bidirectional encoder representations from transformers(BERT)pre-trained model,a bidirectional long short-term memory(BiLSTM)network,and conditional random fields(CRF).The goal is to enhance the universality and accuracy of protocol parsing,thereby providing technical support for security analysis and vulnerability mining in industrial control systems.First,the BERT pre-trained model was employed to dynamically encode industrial control protocol data into high-dimensional word vector representations,so as to capture the semantic information of the protocol data.Leveraging the powerful contextual understanding capabilities of BERT,the model effectively handled the complexity and diversity of protocol data.Subsequently,a BiLSTM network was utilized to model the relationships between protocol data as well as between protocol data and label data.The BiLSTM network captured long-range dependencies within the protocol data,enabling a better understanding of the structure and semantics of the protocol.Finally,CRF were introduced as constraints to optimize the prediction of protocol formats and semantics.By incorporating transition probabilities between labels,CRF further enhanced prediction accuracy and consistency.The combination of the BERT pre-trained model,BiLSTM network,and CRF enabled the format extraction and semantic analysis of industrial control protocols.Additionally,the proposed method was optimized for large-scale protocol data,which ensured efficiency and stability in complex industrial scenarios.[Results]Experiments were conducted on three typical industrial control protocols.The results demonstrate that the proposed method achieves an accuracy of over 96％in both format extraction and semantic analysis,outperforming traditional methods.The method exhibits high adaptability and accuracy across different protocols,effectively identifying field boundaries and semantic information.[Conclusion]The proposed method significantly improves the universality and accuracy of industrial control protocol parsing,providing reliable technical support for security analysis in industrial control systems.Future work will focus on further optimizing the model,expanding its application scenarios,and enhancing its practicality.
Keywords：industrial control protocolprotocol reverse engineeringbidirectional encoder representations from transformers(BERT)pre-trained modelbidirectional long short-term memory networkconditional random fieldword vectorformat extractionsemantic analysis
Publication Date：2025-09-25
Online Publishing Date：2025-10-31(First online date of this platform, not the publication date of the document)
Pages：8( 609-616 )