2026 · Conference accepted
Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization
PVParser recovers process-variable layouts from industrial traffic and historian records. Periodic-pattern detection locates relevant payloads; a modified Monte Carlo tree search proposes field boundaries, types and endianness, then aligns decoded sequences with observed process variables.
Scope and limitations
Payload localization uses SCADA-N, SWaT and WADI; field/semantic recovery uses SWaT and WADI. Recovery depends on traffic and historian observations plus recurrent, stable plaintext byte layouts. Encrypted traffic, bit-level buses and event-driven messages whose PV lists vary are outside scope. It complements protocol dissectors.
Why it fits this collection
Infers deployment-specific message fields and semantics from observed communication instead of supplied format specifications.
Publication and review details
- Venue
- CCS 2026
- Status
- Conference accepted
- Publication / posting date
- 2026 (exact date not verified)
- Date source
- The official CCS 2026 accepted-paper list and arXiv v2 establish acceptance; a publication date was not verified.
- First arXiv submission
- August 17, 2026
- arXiv
- 2608.16403
- Reviewed arXiv version
- v2
ArXiv v2 and the CCS 2026 accepted list name four authors; v1 listed eight. The author-supplied DOI 10.1145/3830454.3846584 did not resolve at review, and no publication date or proceedings container was verified.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.