{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,28]],"date-time":"2026-10-28T16:54:39Z","timestamp":1793206479691,"version":"4.5.0"},"reference-count":84,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62303411"],"award-info":[{"award-number":["62303411"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62293510"],"award-info":[{"award-number":["62293510"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62293511"],"award-info":[{"award-number":["62293511"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62273305"],"award-info":[{"award-number":["62273305"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004731","name":"Natural Science Foundation of Zhejiang Province","doi-asserted-by":"publisher","award":["LZ22F030010"],"award-info":[{"award-number":["LZ22F030010"]}],"id":[{"id":"10.13039\/501100004731","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["226-2024-00004"],"award-info":[{"award-number":["226-2024-00004"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["226-2023-0011"],"award-info":[{"award-number":["226-2023-0011"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2025,3]]},"DOI":"10.1109\/tdsc.2024.3434622","type":"journal-article","created":{"date-parts":[[2024,7,30]],"date-time":"2024-07-30T14:16:58Z","timestamp":1722349018000},"page":"1400-1417","source":"Crossref","is-referenced-by-count":13,"title":["Unveiling Physical Semantics of PLC Variables Using Control Invariants"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1596-6890","authenticated-orcid":false,"given":"Zeyu","family":"Yang","sequence":"first","affiliation":[{"name":"State Key Laboratory of Industrial Control Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0741-8795","authenticated-orcid":false,"given":"Liang","family":"He","sequence":"additional","affiliation":[{"name":"School of Computing, University of Nebraska-Lincoln, Lincoln, NE, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-5587-3752","authenticated-orcid":false,"given":"Yucheng","family":"Ruan","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Industrial Control Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4221-2162","authenticated-orcid":false,"given":"Peng","family":"Cheng","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Industrial Control Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3155-3145","authenticated-orcid":false,"given":"Jiming","family":"Chen","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Industrial Control Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"issue":"6","key":"ref1","article-title":"W32.Stuxnet dossier","volume":"5","author":"Falliere","year":"2011","journal-title":"White Paper Symantec Corp. Secur. Respir.nse"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CySWater.2016.7469060"},{"issue":"1\u201329","key":"ref3","article-title":"Analysis of the cyber attack on the Ukrainian power grid","volume":"388","year":"2016","journal-title":"Electricity Inf. Sharing Anal. Center"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-72817-9_8"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05532-5_7"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00034"},{"key":"ref7","first-page":"89","article-title":"Validating anomaly detection mechanisms in industrial control systems","volume-title":"Proc. Int. Tools Methods Competitive Eng. Symp.","author":"Liyakkathali"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384730"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468617"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471864"},{"key":"ref11","article-title":"In Florida, a near-miss with a cybersecurity worst-case scenario","author":"Collier","year":"2021"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3281272"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3140241.3140254"},{"key":"ref14","article-title":"The experiment of uploading PLC code from a S7\u2013315 PLC of Siemens","year":"2024"},{"key":"ref15","article-title":"The experiment of uploading PLC code from a MicroLogix 1400 PLC of Rockwell automation","year":"2024"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382244"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2018.2826558"},{"key":"ref18","article-title":"Dragonfly: Western energy sector targeted by sophisticated attack group","year":"2017"},{"key":"ref19","article-title":"Shamoon: Destructive threat re-emerges with new sting in its tail","year":"2018"},{"key":"ref20","article-title":"Seedworm: Group compromises government agencies, Oil & Gas, NGOs, Telecoms, and IT Firms","year":"2018"},{"key":"ref21","article-title":"Rockwell automation micrologix controllers and RSLogix 500 software","year":"2020"},{"key":"ref22","article-title":"SSA-381684: Improper password protection during authentication in SIMATIC S7\u2013300 and S7-400 CPUs and derived products","year":"2020"},{"key":"ref23","article-title":"Security notification - Modicon M100\/M200\/M221 programmable logic controller (V3.0)","year":"2021"},{"key":"ref24","first-page":"12","article-title":"You snooze, you lose: Measuring PLC cycle times under attacks","volume-title":"Proc. 12th USENIX Workshop Offensive Technol.","author":"Niedermaier"},{"key":"ref25","first-page":"1","article-title":"Rogue7: Rogue engineering station attacks on S7 simatic PLCs","volume-title":"Proc. Conf. BlackHat USA","author":"Biham"},{"key":"ref26","first-page":"1","article-title":"PLC-Blaster: A worm living solely in the PLC","volume-title":"Proc. Conf. Black Hat Asia","author":"Spenneberg"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397376"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3050101"},{"key":"ref29","first-page":"22","article-title":"Internet-facing PLCs - A new back orifice","volume-title":"Proc. Conf. Blackhat USA","author":"Klick"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.14722\/bar.2019.23074"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427660"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3242653"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2013.04.004"},{"key":"ref34","first-page":"1","article-title":"Ghost in the PLC designing an undetectable programmable logic controller rootkit via pin control attack","volume-title":"Proc. Conf. Black Hat Europe","author":"Abbasi"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23313"},{"key":"ref36","article-title":"JEB decompiler for S7 PLC","year":"2015"},{"key":"ref37","article-title":"Library to access siemens PLCs and step5\/step7 project files","author":"K\u00fchner","year":"2014"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23271"},{"key":"ref39","first-page":"2847","article-title":"ICSFuzz: Manipulating I\/Os and repurposing binary code to enable instrumented fuzzing in ICS control applications","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Tychalas"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SmartGridComm.2014.7007754"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-03964-0_9"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3339252.3340331"},{"key":"ref43","article-title":"Triton is the world\u2019s most murderous malware, and it\u2019s spreading","author":"Giles","year":"2019"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00045"},{"key":"ref45","article-title":"Siemens SIMATIC HMI products","year":"2020"},{"key":"ref46","article-title":"Programming with step 7","year":"2017"},{"key":"ref47","article-title":"MicroLogix 1400 programmable controllers user manual","year":"2021"},{"key":"ref48","article-title":"Data sheet: 6ES7315\u20132AF03-0AB0","year":"2017"},{"key":"ref49","article-title":"MicroLogix 1400 programmable controllers reference manual","year":"2023"},{"key":"ref50","article-title":"Iran cyberattack on Israel\u2019s water supply could have sickened hundreds \u2013 report","year":"2020"},{"key":"ref51","article-title":"APT cyber tools targeting ICS\/SCADA devices","year":"2022"},{"key":"ref52","article-title":"Incontroller: New state-sponsored cyber attack tools target multiple industrial control systems","author":"Brubaker","year":"2022"},{"key":"ref53","article-title":"Chernovite\u2019s Pipedream malware targeting industrial control systems (ICS)","year":"2022"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00043"},{"key":"ref55","article-title":"Online discoverability and vulnerabilities of ICS\/SCADA devices in the Netherlands","author":"Ceron","year":"2020"},{"key":"ref56","article-title":"Emerson OpenEnterprise","year":"2020"},{"key":"ref57","article-title":"SIMATIC WinCC graphics designer","year":"2021"},{"key":"ref58","article-title":"Exporting archived data from WinCC with the OLE DB provider","year":"2019"},{"key":"ref59","article-title":"EcoStruxureTM machine SCADA expert technical reference manual","year":"2019"},{"key":"ref60","article-title":"Demo videos of memory manipulation against S7\u2013315 PLC of Siemens","year":"2023"},{"key":"ref61","article-title":"Demo videos of memory manipulation against MicroLogix 1400 PLC of Rockwell","year":"2023"},{"key":"ref62","article-title":"User manual for PLC Programming with CoDeSys 2.3","year":"2010"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1002\/9781118949214"},{"key":"ref64","volume-title":"Automating with STEP 7 in STL and SCL: SIMATIC S7--300\/400 Programmable Controllers","author":"Berger","year":"2012"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23043"},{"key":"ref66","volume-title":"Adv. PID control","author":"\u00c5str\u00f6m","year":"2006"},{"key":"ref67","first-page":"333","article-title":"PLC-Sleuth: Detecting and localizing PLC intrusions using control invariants","volume-title":"Proc. 23rd Int. Symp. Res. Attacks Intrusions Defenses","author":"Yang"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevE.69.066138"},{"key":"ref69","article-title":"Awlsim: S7 compatible PLC\/SPS","author":"B\u00fcsch","year":"2020"},{"key":"ref70","article-title":"WinCC V7.5 SP1: Working with WinCC","year":"2019"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243752"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23265"},{"key":"ref73","first-page":"895","article-title":"SAVIOR: Securing autonomous vehicles with robust physical invariants","volume-title":"Proc 29th USENIX Secur. Symp.","author":"Quinonez"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1142\/S0218001404003228"},{"key":"ref75","first-page":"1","article-title":"Matching structure and semantics: A survey on graph-based pattern matching","volume-title":"Proc. AAAI Fall Symp.: Capturing Using Patterns Evidence Detection","author":"Gallagher"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3560905.3568521"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15555-0_36"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2015.2501802"},{"key":"ref79","article-title":"A semantic attack against the elevator control System","year":"2022"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.robot.2017.12.005"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2014.2312327"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2875008"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978388"},{"key":"ref84","article-title":"Responding to a semantic attack in the elevator control system","year":"2023"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/10925471\/10616045.pdf?arnumber=10616045","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,17]],"date-time":"2025-03-17T17:20:44Z","timestamp":1742232044000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10616045\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3]]},"references-count":84,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2024.3434622","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3]]}}}