{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,19]],"date-time":"2026-09-19T17:03:48Z","timestamp":1789837428118,"version":"4.0.1"},"reference-count":45,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100012152","name":"National Postdoctoral Program for Innovative Talents","doi-asserted-by":"publisher","award":["BX20230307"],"award-info":[{"award-number":["BX20230307"]}],"id":[{"id":"10.13039\/501100012152","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62302443"],"award-info":[{"award-number":["62302443"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,12]]},"DOI":"10.1016\/j.cose.2026.105054","type":"journal-article","created":{"date-parts":[[2026,7,14]],"date-time":"2026-07-14T15:54:50Z","timestamp":1784044490000},"page":"105054","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Enhancing ICS equipment security through fuzzing: Automated protocol inference and response-driven exploration"],"prefix":"10.1016","volume":"171","author":[{"given":"Liyang","family":"Hou","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Peiyu","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1481-5844","authenticated-orcid":false,"given":"Yinan","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yue","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiaao","family":"Sheng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yangjun","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chunyu","family":"Miao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenhai","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.cose.2026.105054_b1","doi-asserted-by":"crossref","unstructured":"Andronidis, A., Cadar, C., 2022. SnapFuzz: High-throughput fuzzing of network applications. In: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. pp. 340\u2013351.","DOI":"10.1145\/3533767.3534376"},{"key":"10.1016\/j.cose.2026.105054_b2","series-title":"Review of open source simulators in ICS\/IIoT security context","author":"Ani","year":"2018"},{"key":"10.1016\/j.cose.2026.105054_b3","unstructured":"Ba, J., B\u00f6hme, M., Mirzamomen, Z., Roychoudhury, A., 2022. Stateful greybox fuzzing. In: 31st USENIX Security Symposium. USENIX Security 22, pp. 3255\u20133272."},{"key":"10.1016\/j.cose.2026.105054_b4","series-title":"ISC","first-page":"343","article-title":"SNOOZE: Toward a stateful network protocol fuzzer","volume":"Vol. 4176","author":"Banks","year":"2006"},{"key":"10.1016\/j.cose.2026.105054_b5","series-title":"Black Hat USA","first-page":"723","article-title":"Exploiting siemens simatic s7 plcs","volume":"Vol. 16","author":"Beresford","year":"2011"},{"key":"10.1016\/j.cose.2026.105054_b6","series-title":"Black Hat USA","article-title":"Rogue7: Rogue engineering-station attacks on s7 simatic plcs","volume":"Vol. 2019","author":"Biham","year":"2019"},{"key":"10.1016\/j.cose.2026.105054_b7","series-title":"2011 Third International Conference on Multimedia Information Networking and Security","first-page":"343","article-title":"Extension of SPIKE for encrypted protocol fuzzing","author":"Biyani","year":"2011"},{"key":"10.1016\/j.cose.2026.105054_b8","unstructured":"Boofuzz Contributors, Boofuzz Documentation, https:\/\/boofuzz.readthedocs.io\/en\/stable\/, (Accessed 6 January 2026)."},{"key":"10.1016\/j.cose.2026.105054_b9","doi-asserted-by":"crossref","unstructured":"Bossert, G., Guih\u00e9ry, F., Hiet, G., 2014. Towards automated protocol reverse engineering using semantic information. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security. pp. 51\u201362.","DOI":"10.1145\/2590296.2590346"},{"key":"10.1016\/j.cose.2026.105054_b10","doi-asserted-by":"crossref","unstructured":"Caballero, J., Yin, H., Liang, Z., Song, D., 2007. Polyglot: Automatic extraction of protocol message format using dynamic binary analysis. In: Proceedings of the 14th ACM Conference on Computer and Communications Security. pp. 317\u2013329.","DOI":"10.1145\/1315245.1315286"},{"key":"10.1016\/j.cose.2026.105054_b11","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2019.101582","article-title":"Using memory propagation tree to improve performance of protocol fuzzer when testing ICS","volume":"87","author":"Chen","year":"2019","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105054_b12","series-title":"2009 30th IEEE Symposium on Security and Privacy","first-page":"110","article-title":"Prospex: Protocol specification extraction","author":"Comparetti","year":"2009"},{"key":"10.1016\/j.cose.2026.105054_b13","doi-asserted-by":"crossref","unstructured":"Fang, D., Song, Z., Guan, L., Liu, P., Peng, A., Cheng, K., Zheng, Y., Liu, P., Zhu, H., Sun, L., 2021. Ics3fuzzer: A framework for discovering protocol implementation bugs in ics supervisory software by fuzzing. In: Annual Computer Security Applications Conference. pp. 849\u2013860.","DOI":"10.1145\/3485832.3488028"},{"key":"10.1016\/j.cose.2026.105054_b14","doi-asserted-by":"crossref","unstructured":"Feng, X., Sun, R., Zhu, X., Xue, M., Wen, S., Liu, D., Nepal, S., Xiang, Y., 2021. Snipuzz: Black-box fuzzing of iot firmware via message snippet inference. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. pp. 337\u2013350.","DOI":"10.1145\/3460120.3484543"},{"issue":"8","key":"10.1016\/j.cose.2026.105054_b15","doi-asserted-by":"crossref","first-page":"7672","DOI":"10.1109\/TIE.2020.3001850","article-title":"Model-based stealth attack to networked control system based on real-time ethernet","volume":"68","author":"Ferrari","year":"2020","journal-title":"IEEE Trans. Ind. Electron."},{"key":"10.1016\/j.cose.2026.105054_b16","first-page":"181","article-title":"Fuzz testing based on sulley framework","volume":"1","author":"Guo","year":"2017","journal-title":"Curr. Trends Comput. Sci. Mech. Autom."},{"issue":"16","key":"10.1016\/j.cose.2026.105054_b17","doi-asserted-by":"crossref","first-page":"3083","DOI":"10.1002\/sec.1259","article-title":"SecIoT: A security framework for the Internet of Things","volume":"9","author":"Huang","year":"2016","journal-title":"Secur. Commun. Networks"},{"key":"10.1016\/j.cose.2026.105054_b18","unstructured":"Kleber, S., Kopp, H., Kargl, F., 2018. NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages. In: WOOT@ USENIX Security Symposium."},{"key":"10.1016\/j.cose.2026.105054_b19","series-title":"Blackhat USA","first-page":"22","article-title":"Internet-facing PLCs-a new back orifice","author":"Klick","year":"2015"},{"issue":"3","key":"10.1016\/j.cose.2026.105054_b20","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1109\/MSP.2011.67","article-title":"Stuxnet: Dissecting a cyberwarfare weapon","volume":"9","author":"Langner","year":"2011","journal-title":"IEEE Secur. Priv."},{"key":"10.1016\/j.cose.2026.105054_b21","doi-asserted-by":"crossref","first-page":"2673","DOI":"10.1109\/TIFS.2022.3192991","article-title":"SNPSFuzzer: A fast greybox fuzzer for stateful network protocols using snapshots","volume":"17","author":"Li","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.cose.2026.105054_b22","series-title":"NDSS","first-page":"1","article-title":"Automatic protocol format reverse engineering through context-aware monitored execution","volume":"Vol. 8","author":"Lin","year":"2008"},{"issue":"1","key":"10.1016\/j.cose.2026.105054_b23","doi-asserted-by":"crossref","first-page":"28","DOI":"10.1186\/s42400-021-00087-5","article-title":"ICPFuzzer: Proprietary communication protocol fuzzing by using machine learning and feedback strategies","volume":"4","author":"Lin","year":"2021","journal-title":"Cybersecurity"},{"key":"10.1016\/j.cose.2026.105054_b24","series-title":"2024 IEEE Symposium on Security and Privacy","first-page":"1920","article-title":"Labrador: Response guided directed fuzzing for black-box iot devices","author":"Liu","year":"2024"},{"issue":"5s","key":"10.1016\/j.cose.2026.105054_b25","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3358227","article-title":"Polar: Function code aware fuzz testing of ics protocol","volume":"18","author":"Luo","year":"2019","journal-title":"ACM Trans. Embed. Comput. Syst. (TECS)"},{"key":"10.1016\/j.cose.2026.105054_b26","series-title":"2020 57th ACM\/IEEE Design Automation Conference","first-page":"1","article-title":"ICS protocol fuzzing: Coverage guided packet crack and generation","author":"Luo","year":"2020"},{"key":"10.1016\/j.cose.2026.105054_b27","series-title":"Network and System Security: 11th International Conference, NSS 2017, Helsinki, Finland, August 21\u201323, 2017, Proceedings 11","first-page":"359","article-title":"Sulleyex: A fuzzer for stateful network protocol","author":"Ma","year":"2017"},{"key":"10.1016\/j.cose.2026.105054_b28","series-title":"Understanding fieldbus vs industrial ethernet","author":"Machines","year":"2024"},{"issue":"7","key":"10.1016\/j.cose.2026.105054_b29","doi-asserted-by":"crossref","first-page":"4393","DOI":"10.1109\/TII.2021.3123194","article-title":"Programmable logic controllers past linear temporal logic for monitoring applications in industrial control systems","volume":"18","author":"Mao","year":"2021","journal-title":"IEEE Trans. Ind. Inform."},{"issue":"7","key":"10.1016\/j.cose.2026.105054_b30","doi-asserted-by":"crossref","first-page":"191","DOI":"10.1007\/s10664-022-10233-3","article-title":"Stateafl: Greybox fuzzing for stateful network servers","volume":"27","author":"Natella","year":"2022","journal-title":"Empir. Softw. Eng."},{"key":"10.1016\/j.cose.2026.105054_b31","unstructured":"PeachTech, Peach Fuzzer Community, https:\/\/peachtech.gitlab.io\/peach-fuzzer-community\/, (Accessed 6 January 2026)."},{"key":"10.1016\/j.cose.2026.105054_b32","series-title":"2020 IEEE 13th International Conference on Software Testing, Validation and Verification","first-page":"460","article-title":"AFLNet: A greybox fuzzer for network protocols","author":"Pham","year":"2020"},{"key":"10.1016\/j.cose.2026.105054_b33","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102694","article-title":"Fuzzing-based hard-label black-box attacks against machine learning models","volume":"117","author":"Qin","year":"2022","journal-title":"Comput. Secur."},{"issue":"22","key":"10.1016\/j.cose.2026.105054_b34","doi-asserted-by":"crossref","first-page":"22737","DOI":"10.1109\/JIOT.2022.3182589","article-title":"Iotinfer: Automated blackbox fuzz testing of iot network protocols guided by finite state machine inference","volume":"9","author":"Shu","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.cose.2026.105054_b35","series-title":"Black Hat Asia","first-page":"1","article-title":"PLC-blaster: A worm living solely in the PLC","volume":"Vol. 16","author":"Spenneberg","year":"2016"},{"issue":"82","key":"10.1016\/j.cose.2026.105054_b36","first-page":"16","article-title":"Guide to industrial control systems (ICS) security","volume":"800","author":"Stouffer","year":"2011","journal-title":"NIST Spec. Publ."},{"key":"10.1016\/j.cose.2026.105054_b37","series-title":"Applied Cryptography and Network Security: 20th International Conference, ACNS 2022, Rome, Italy, June 20\u201323, 2022, Proceedings","first-page":"356","article-title":"Ipspex: Enabling efficient fuzzing via specification extraction on ics protocol","author":"Sun","year":"2022"},{"issue":"6","key":"10.1016\/j.cose.2026.105054_b38","doi-asserted-by":"crossref","first-page":"3992","DOI":"10.1109\/TII.2020.3009133","article-title":"Secure links: Secure-by-design communications in IEC 61499 industrial control applications","volume":"17","author":"Tanveer","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"10.1016\/j.cose.2026.105054_b39","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103973","article-title":"MTA Fuzzer: A low-repetition rate Modbus TCP fuzzing method based on Transformer and Mutation Target Adaptation","volume":"144","author":"Wang","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105054_b40","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103811","article-title":"NCMFuzzer: Using non-critical field mutation and test case combination to improve the efficiency of ICS protocol fuzzing","volume":"141","author":"Wanyan","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105054_b41","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2024.104020","article-title":"A survey on fuzz testing technologies for industrial control protocols","volume":"232","author":"Wei","year":"2024","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.cose.2026.105054_b42","series-title":"NDSS","first-page":"1","article-title":"Automatic network protocol analysis","volume":"Vol. 8","author":"Wondracek","year":"2008"},{"key":"10.1016\/j.cose.2026.105054_b43","article-title":"FuzzCode: Code large language model-based fuzz testing for industrial IoT programs","author":"Yang","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.cose.2026.105054_b44","series-title":"NDSS","article-title":"NetPlier: Probabilistic network protocol reverse engineering from message traces","author":"Ye","year":"2021"},{"key":"10.1016\/j.cose.2026.105054_b45","doi-asserted-by":"crossref","first-page":"651","DOI":"10.1007\/s12541-016-0079-8","article-title":"The vulnerability assessment of ground combat vehicles using target functional modeling and FTA","volume":"17","author":"Yoo","year":"2016","journal-title":"Int. J. Precis. Eng. Manuf."}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002300?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002300?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,9,19]],"date-time":"2026-09-19T16:15:19Z","timestamp":1789834519000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826002300"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,12]]},"references-count":45,"alternative-id":["S0167404826002300"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.105054","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,12]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Enhancing ICS equipment security through fuzzing: Automated protocol inference and response-driven exploration","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.105054","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"105054"}}