A Message Expansion Method Driven by Device Interaction for Industrial Protocol Understanding

In the Industrial Internet of Things (IIoT), Protocol Reverse Engineering (PRE) is a technique that analyzes protocol message samples to facilitate the understanding of unknown protocol specifications, enabling intercommunication between heterogeneous devices using industrial control protocols (ICPs). However, capturing message samples from the IloT environment is time-consuming, and the collected samples may lack sufficient diversity to comprehensively cover the protocol specifications, thereby affecting PRE's effectiveness in understanding protocol specifications. To address this limitation, we propose a message expansion method driven by device interaction to efficiently generate message samples that offer comprehensive feature coverage, ultimately enhancing the protocol understanding. Our approach operates in two stages. During the exploration stage, it modifies the initial input messages captured from the network and, through interactions with the device, determines which fields should be excluded from further exploration, thereby narrowing the exploration space. In the expansion stage, we design a neighborhood particle swarm optimization (NPSO) algorithm to thoroughly explore the remaining search space, generating diverse messages and validating them through interaction with the device to comprehensively cover the protocol's structure and functionality. Experimental results show that our method surpasses existing algorithms in both message generation speed and message quality.