Collaborative mBERT and multi-source domain adaptation for industrial control protocol reverse engineering
ZONG Xuejun
YI Rongguang
LIU Yuxuan
HE Kan
SHI Hongyan
SUN Yifei
NING Bowei
Abstract：[Objective]In industrial control systems(ICS),communication between devices rely heavily on industrial control protocols,and the security of these protocols is essential for stable ICS operation.Vulnerability detection and intrusion detection,as core components of the ICS defense framework,require accurate analysis of protocol structures and semantic functions.Protocol reverse engineering serves as a key technique for this purpose,and the precision of semantic inference directly determines the accuracy of protocol understanding.However,due to the absence of protocol documentation and strong format heterogeneity,existing semantic inference methods generally rely on expert knowledge,resulting in insufficient automation and limited cross-protocol generalization.Consequently,they fail to meet the high precision analysis needs of multi-source heterogeneous protocols in real industrial environments.[Methods]To solve the above problem,this study proposed a semantic inference method that integrated mBERT,multi-source domain adaptation,and a structured masking strategy.Cross-protocol semantic representations were achieved through the mBERT model.A structured masking strategy that combined attention weights and positional encoding was designed to enhance the model's ability to capture intrinsic correlations between protocol structure and semantics,which improved the automation and efficiency of semantic inference.A progressive multi-source domain adaptation strategy with adversarial training further strengthened the model's generalized semantic representation across multiple source protocols,enhanced its applicability to various industrial control protocols,and enabled effective inference of keyword semantics.[Results]Experiments were conducted in the target range for offensive and defensive drills in typical energy enterprises in the Key Laboratory of Information Security for the Petrochemical Industry in Liaoning Province.Data from three industrial control protocols,S7comm,Modbus/TCP,and EtherNet/IP,were collected,and a training dataset was built using a protocol-complexity scoring mechanism.The results show that the progressive multi-source domain adaptation strategy significantly improves model performance.When it is combined with the structured masking strategy,semantic inference accuracy is further enhanced.The proposed method achieves significantly higher precision,recall,and F1-score compared with existing baseline methods.[Conclusions]This study proposes a semantic inference method that integrates mBERT,multi-source domain adaptation,and structured masking.High-dimensional spherical mapping and multi-task loss functions used in semantic inference improve the distinguishability of different semantic categories and enhance the model's deeper recognition capability for protocol semantics.The proposed method significantly reduces reliance on manual prior knowledge,increases inference efficiency,and improves cross-protocol applicability.It provides a theoretically grounded new pathway for industrial control protocol reverse engineering and ICS security protection.
Keywords：industrial control protocolstructured masksemantic inferenceattention weightmulti-source domain adaptationmBERT modelword vectoradversarial training
Publication Date：2026-01-25
Online Publishing Date：2026-03-17(First online date of this platform, not the publication date of the document)
Pages：11( 63-73 )