# ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution

> Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. It merges bytes using value-preserving operations and similar processing traces. For the 1,000-message datasets of four public ICS protocols, the authors report average boundary F1 of 0.76 and field perfection of 0.67.

- Authors: Yibo Qu; Dongliang Fang; Zhen Wang; Jiaxing Cheng; Shuaizong Si; Yongle Chen; Limin Sun
- Venue: Proceedings of the ACM on Software Engineering (ISSTA 2025)
- Status: Journal article
- Publication / posting date: June 22, 2025
- Date source: The ACM article page and publisher-deposited Crossref metadata agree on publication on 2025-06-22. The ISSTA presentation date is not substituted for this journal publication date.
- DOI: 10.1145/3728982
- Sources reviewed: 2026-10-17
- Added to the catalog: 2026-10-17
- Original paper: <https://dl.acm.org/doi/10.1145/3728982>
- PDF: <https://dl.acm.org/doi/pdf/10.1145/3728982>
- Code: <https://github.com/QYbPtqyb/ICEPRE>
- BibTeX: <https://awesomerea.org/papers/citations/paper-icepre.bib>
- Catalog page: <https://awesomerea.org/papers/paper-icepre/>
- Record JSON: <https://awesomerea.org/papers/paper-icepre/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-icepre/index.md)

## Scope and limitations

Recovers message syntax, not field semantics, protocol state machines or endpoint equivalence. It needs the binary, loader configuration and correctly identified initialization, input and parsing functions; manual filtering remains necessary, especially without symbols. Encrypted protocols and bit-level fields are unsupported, and ignored or only copied bytes can be merged incorrectly. Perfection measures fields with both boundaries correct. Quantitative tests use four public protocols with 50- and 1,000-message sets; separate proprietary studies cover three protocols in five firmware targets, with interaction checks on three devices and manually established ground truth. Those checks do not demonstrate complete device behavior.

## Why it fits this collection

Adds firmware-assisted protocol format inference using concolic analysis, complementing live-server instrumentation and traffic-only field inference.

## Publication and review notes

The publisher identifies article ISSTA105 and licenses the paper under CC BY 4.0; its Data Availability section links the repository. The reviewed 2025-04-16 code snapshot has no project-level license declaration. Python 3 dependencies use compatible-release bounds, including angr~=9.2.100, Netzob~=2.0.0 and scapy~=2.5.0; the paper describes Ghidra 11.0.3 for function analysis. The repository includes public-protocol configurations and a Modbus capture, but no firmware images; target binaries and libraries need separate provision. The paper specifies trace-similarity threshold 0.9, while released InferSyntax.py uses 99 on a 100-point scale. Its batch evaluator excludes abnormal traces from aggregate metrics.

## Primary sources

1. <https://dl.acm.org/doi/10.1145/3728982>
2. <https://api.crossref.org/works/10.1145/3728982>
3. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/README.md>
4. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/requirements.txt>
5. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/ICEPRE.py>
6. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/Ctracer.py>
7. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/InferSyntax.py>
8. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/modbus_config.yaml>
9. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/enip_config.yaml>
10. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/iec104_config.yaml>
11. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/s7comm_config.yaml>
12. <https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/evaluation/syntax_evaluation.py>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.