{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T16:26:55Z","timestamp":1784996815664,"version":"3.55.0"},"reference-count":43,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100012551","name":"Applied Basic Research Program of Liaoning Province","doi-asserted-by":"publisher","award":["2022JH2\/101300240"],"award-info":[{"award-number":["2022JH2\/101300240"]}],"id":[{"id":"10.13039\/100012551","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100017700","name":"Liaoning Provincial Science and Technology Plan Project","doi-asserted-by":"publisher","award":["2023JH2\/101700370"],"award-info":[{"award-number":["2023JH2\/101700370"]}],"id":[{"id":"10.13039\/501100017700","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3569129","type":"journal-article","created":{"date-parts":[[2025,5,12]],"date-time":"2025-05-12T13:43:13Z","timestamp":1747057393000},"page":"5478-5491","source":"Crossref","is-referenced-by-count":4,"title":["Patty: Pattern Series-Based Semantics Analysis for Agnostic Industrial Control Protocols"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-8668-7447","authenticated-orcid":false,"given":"Daoqing","family":"Yang","sequence":"first","affiliation":[{"name":"College of Computer Science and Engineering, Northeastern University, Shenyang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5458-541X","authenticated-orcid":false,"given":"Yu","family":"Yao","sequence":"additional","affiliation":[{"name":"College of Computer Science and Engineering, Northeastern University, Shenyang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4215-3307","authenticated-orcid":false,"given":"Yao","family":"Shan","sequence":"additional","affiliation":[{"name":"School of Computer and Control Engineering, Yantai University, Yantai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1387-5846","authenticated-orcid":false,"given":"Licheng","family":"Yang","sequence":"additional","affiliation":[{"name":"College of Computer Science and Engineering, Northeastern University, Shenyang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4471-0026","authenticated-orcid":false,"given":"Wei","family":"Yang","sequence":"additional","affiliation":[{"name":"College of Software, Northeastern University, Shenyang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fuyi","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Computer Science and Engineering, Northeastern University, Shenyang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yunfeng","family":"Wu","sequence":"additional","affiliation":[{"name":"Sixth Research Institute of China Electronics Information Industry Group Company Ltd., Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2022.3185649"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-29938-9_6"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.5555\/3241189.3241275"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/DSN-W54100.2022.00023"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315286"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3228076"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24531"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24083"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590346"},{"key":"ref11","first-page":"1","article-title":"NEMESYS: Network message syntax reverse engineering by analysis of the intrinsic structure of individual messages","volume-title":"Proc. 12th USENIX Workshop Offensive Technol. (WOOT)","author":"Kleber"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/IFIPNetworking.2015.7145307"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2905353"},{"key":"ref14","first-page":"1","article-title":"Protocol-independent adaptive replay of application dialog","volume-title":"Proc. NDSS","author":"Cui"},{"key":"ref15","first-page":"1","article-title":"Discoverer: Automatic protocol reverse engineering from network traces","volume-title":"Proc. USENIX Secur. Symp.","author":"Cui"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/1308045"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3326666"},{"key":"ref18","first-page":"1","article-title":"Imagenet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"25","author":"Krizhevsky"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/s11265-021-01657-z"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM41043.2020.9155275"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2867544"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363261"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3359002"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2025.3534441"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107677"},{"key":"ref26","first-page":"6597","article-title":"SAIN: Improving ICS attack detection sensitivity via state-aware invariants","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Abbas"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6690988"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-13-1747-7_12"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3649448"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2022.07.025"},{"key":"ref31","volume-title":"Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information","author":"Aitken","year":"2013"},{"key":"ref32","volume-title":"Wireshark","author":"Combs","year":"2025"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ISPA-BDCloud-SocialCom-SustainCom51426.2020.00084"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-08010-9_33"},{"key":"ref35","volume-title":"File Format V1.0","author":"Mishra","year":"2024"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-019-00619-1"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2023\/759"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-020-00727-3"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2779939"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-57077-4_10"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3512345"},{"key":"ref42","author":"Pereyda","year":"2025","journal-title":"boofuzz: Network Protocol Fuzzing for Humans"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103811"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11000284.pdf?arnumber=11000284","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,26]],"date-time":"2026-06-26T19:44:03Z","timestamp":1782503043000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11000284\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":43,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3569129","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}