Review

Reverse engineering of industrial control protocol: A survey

¹ State Key Laboratory of Public Big Data, School of Computer Science and Technology, Guizhou University, Guiyang, 550025, China
² College of Control Science and Engineering, Zhejiang University, Zhejiang, 310027, China

^* Corresponding authors (email: This email address is being protected from spambots. You need JavaScript enabled to view it. )

Received: 11 April 2025
Revised: 7 June 2025
Accepted: 12 September 2025

Abstract

Industrial control systems (ICSs) are designed for monitoring and controlling industrial processes, enabling the automation and management of critical sectors such as production, manufacturing, and power system through electronic devices and communication infrastructure. Industrial control protocols (ICPs) refer to the standardized rules and formats used for communication. Protocol reverse engineering (PRE) refers to the process of inferring the structure, semantics, and behavior of a communication protocol in the absence of official specifications or documentation. Given the prevalence of proprietary protocols in ICS and the limited formal documentation, PRE is an important method for understanding and managing protocol behavior in complex heterogeneous industrial environments. Over the past decades, ICSs have typically operated within isolated and closed network environments, where many protocol specifications remained proprietary and unknown, thereby hindering the evaluation of protocol security. This limitation has driven the development of reverse engineering approaches for ICPs. To systematically summarize the current research results and development of ICP reverse engineering, we build a complete technical framework about typical objectives of protocol reverse engineering. The existing methods are summarized in seven aspects, including data acquisition, message clustering, field division, key field identification, field semantic derivation, state machine modeling, and application. The common problems and limitations are discussed, and finally, combined with future implementation needs, we propose several research directions worthy of attention.