Improving Field Semantic Inference in ICS Protocols via Hierarchical Clustering and Multi-View Representation Learning

Industrial Control Systems (ICS) are essential components of critical infrastructure, and their security critically depends on a deep semantic understanding of the underlying communication protocols. However, many industrial control protocols are proprietary or lack publicly available documentation, making accurate semantic acquisition challenging. Protocol Reverse Engineering (PRE) offers a viable solution, but existing approaches often rely heavily on domain expertise and are typically limited to inferring only a few predefined semantic types. A recent data-driven solution has shown promise toward automation, but it still suffers from suboptimal semantic clustering and limited cross-protocol generalization. To address these limitations, we propose an enhanced method for automated semantic inference in ICS protocols. Our approach begins with a hybrid clustering strategy that combines field behavioral patterns and semantic descriptions to produce high-quality semantic labels. We then perform representation learning by fusing protocol-agnostic behavioral features and byte sequence features, and use Prototypical Networks to support robust few-shot semantic inference across protocols. We conduct extensive experiments on five public ICS protocols under a leave-one-protocol-out cross-validation setting, demonstrating the effectiveness and generalizability of our proposed method.