{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T07:37:18Z","timestamp":1787902638487,"version":"build-2784847793"},"reference-count":46,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2023,1,3]],"date-time":"2023-01-03T00:00:00Z","timestamp":1672704000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key R&amp;D Program of China","award":["2021YFB3100905"],"award-info":[{"award-number":["2021YFB3100905"]}]},{"name":"National Key R&amp;D Program of China","award":["62276017"],"award-info":[{"award-number":["62276017"]}]},{"name":"National Key R&amp;D Program of China","award":["U1636211"],"award-info":[{"award-number":["U1636211"]}]},{"name":"National Key R&amp;D Program of China","award":["61672081"],"award-info":[{"award-number":["61672081"]}]},{"name":"National Key R&amp;D Program of China","award":["GDDKY2021KF03"],"award-info":[{"award-number":["GDDKY2021KF03"]}]},{"name":"National Key R&amp;D Program of China","award":["SKLSDE-2021ZX-18"],"award-info":[{"award-number":["SKLSDE-2021ZX-18"]}]},{"name":"National Natural Science Foundation of China","award":["2021YFB3100905"],"award-info":[{"award-number":["2021YFB3100905"]}]},{"name":"National Natural Science Foundation of China","award":["62276017"],"award-info":[{"award-number":["62276017"]}]},{"name":"National Natural Science Foundation of China","award":["U1636211"],"award-info":[{"award-number":["U1636211"]}]},{"name":"National Natural Science Foundation of China","award":["61672081"],"award-info":[{"award-number":["61672081"]}]},{"name":"National Natural Science Foundation of China","award":["GDDKY2021KF03"],"award-info":[{"award-number":["GDDKY2021KF03"]}]},{"name":"National Natural Science Foundation of China","award":["SKLSDE-2021ZX-18"],"award-info":[{"award-number":["SKLSDE-2021ZX-18"]}]},{"name":"Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd.","award":["2021YFB3100905"],"award-info":[{"award-number":["2021YFB3100905"]}]},{"name":"Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd.","award":["62276017"],"award-info":[{"award-number":["62276017"]}]},{"name":"Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd.","award":["U1636211"],"award-info":[{"award-number":["U1636211"]}]},{"name":"Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd.","award":["61672081"],"award-info":[{"award-number":["61672081"]}]},{"name":"Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd.","award":["GDDKY2021KF03"],"award-info":[{"award-number":["GDDKY2021KF03"]}]},{"name":"Key Laboratory of Power Grid Automation of China Southern Power Grid Co., Ltd.","award":["SKLSDE-2021ZX-18"],"award-info":[{"award-number":["SKLSDE-2021ZX-18"]}]},{"name":"State Key Laboratory of Software Development Environment","award":["2021YFB3100905"],"award-info":[{"award-number":["2021YFB3100905"]}]},{"name":"State Key Laboratory of Software Development Environment","award":["62276017"],"award-info":[{"award-number":["62276017"]}]},{"name":"State Key Laboratory of Software Development Environment","award":["U1636211"],"award-info":[{"award-number":["U1636211"]}]},{"name":"State Key Laboratory of Software Development Environment","award":["61672081"],"award-info":[{"award-number":["61672081"]}]},{"name":"State Key Laboratory of Software Development Environment","award":["GDDKY2021KF03"],"award-info":[{"award-number":["GDDKY2021KF03"]}]},{"name":"State Key Laboratory of Software Development Environment","award":["SKLSDE-2021ZX-18"],"award-info":[{"award-number":["SKLSDE-2021ZX-18"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>The Programmable Logic Controller (PLC) is located at the junction of the virtual network and physical reality in the Industrial Control System (ICS), which is vulnerable to attacks due to its weak security. Specifically, firmware tampering attacks take the firmware under the PLC operating system as the primary attack target. The firmware provides the bridge between PLC\u2019s hardware and software, which means tampering against the firmware can be more destructive and harmful than other attacks. However, existing defense and forensics methods against firmware tampering attacks are asymmetrical, which directly leads to the proliferation of such attacks and the difficulty of forensic tracing. How to accurately, quickly, and efficiently conduct forensics for such attacks is an urgent problem. In this paper, we designed and implemented a reliable detection method based on Joint Test Action Group (JTAG) and memory comparison\u2014Aye, which can detect mainstream firmware tampering attacks reliably. To determine the effectiveness and reliability of Aye, we selected a widely used PLC to observe Aye\u2019s performance in defense and forensics by simulating the two latest PLC firmware tampering attack methods. The experimental results show that Aye can effectively defend against firmware tampering attacks, helping improve the efficiency and accuracy of such attack detection and forensics.<\/jats:p>","DOI":"10.3390\/sym15010145","type":"journal-article","created":{"date-parts":[[2023,1,4]],"date-time":"2023-01-04T01:42:44Z","timestamp":1672796564000},"page":"145","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["Aye: A Trusted Forensic Method for Firmware Tampering Attacks"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3372-0173","authenticated-orcid":false,"given":"Yipeng","family":"Zhang","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Beihang University, Beijing 100191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ye","family":"Li","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Beihang University, Beijing 100191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhoujun","family":"Li","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Beihang University, Beijing 100191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,1,3]]},"reference":[{"key":"ref_1","first-page":"69","article-title":"Review of PLC security issues in industrial control system","volume":"2","author":"Pan","year":"2020","journal-title":"J. Cybersecur."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Had\u017eiosmanovi\u0107, D., Sommer, R., Zambon, E., and Hartel, P.H. (2014, January 8\u201312). Through the eye of the PLC: Semantic security monitoring for industrial processes. Proceedings of the 30th Annual Computer Security Applications Conference, New Orleans, LA, USA.","DOI":"10.1145\/2664243.2664277"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Hareesh, R., Senthil Kumar, R., Kalluri, R., and Bindhumadhava, B. (2022). Critical Infrastructure Asset Discovery and Monitoring for Cyber Security. ISUW 2020, Springer.","DOI":"10.1007\/978-981-16-9008-2_27"},{"key":"ref_4","unstructured":"Zhu, B., and Sastry, S. (2010, January 12). SCADA-specific intrusion detection\/prevention systems: A survey and taxonomy. Proceedings of the 1st Workshop on Secure Control Systems (SCS), Stockholm, Sweden."},{"key":"ref_5","unstructured":"Feng, B., Mera, A., and Lu, L. (2020, January 12\u201314). P2IM: Scalable and Hardware-independent Firmware Testing via Automatic Peripheral Interface Modeling. Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), Boston, MA, USA."},{"key":"ref_6","unstructured":"Zaddach, J., and Costin, A. (August, January 27). Embedded devices security and firmware reverse engineering. Proceedings of the Black-Hat USA, Las Vegas, NV, USA."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Awad, R.A., Beztchi, S., Smith, J.M., Lyles, B., and Prowell, S. (2018, January 4). Tools, techniques, and methodologies: A survey of digital forensics for scada systems. Proceedings of the 4th Annual Industrial Control System Security Workshop, San Juan, PR, USA.","DOI":"10.1145\/3295453.3295454"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Qasim, S.A., Lopez, J., and Ahmed, I. (2019, January 19\u201321). Automated reconstruction of control logic for programmable logic controller forensics. Proceedings of the International Conference on Information Security, Kuala Lumpur, Malaysia.","DOI":"10.1007\/978-3-030-30215-3_20"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"S57","DOI":"10.1016\/j.diin.2017.06.012","article-title":"SCADA network forensics of the PCCC protocol","volume":"22","author":"Senthivel","year":"2017","journal-title":"Digit. Investig."},{"key":"ref_10","first-page":"301196","article-title":"JTAG-based PLC memory acquisition framework for industrial control systems","volume":"37","author":"Rais","year":"2021","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_11","unstructured":"Garcia, L., Brasser, F., Cintuglu, M.H., Sadeghi, A.R., Mohammed, O.A., and Zonouz, S.A. (March, January 26). Hey, My Malware Knows Physics! Attacking PLCs with Physical Model Aware Rootkit. Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Malchow, J.O., Marzin, D., Klick, J., Kovacs, R., and Roth, V. (2015, January 28\u201330). PLC Guard: A practical defense against attacks on cyber-physical systems. Proceedings of the 2015 IEEE Conference on Communications and Network Security (CNS), Florence, Italy.","DOI":"10.1109\/CNS.2015.7346843"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"125","DOI":"10.1016\/j.tcs.2021.08.021","article-title":"A process calculus approach to detection and mitigation of PLC malware","volume":"890","author":"Lanotte","year":"2021","journal-title":"Theor. Comput. Sci."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Stollon, N. (2011). On-Chip Instrumentation. Design and Debug for Systems on Chip, Springer Publishing Company.","DOI":"10.1007\/978-1-4419-7563-8"},{"key":"ref_15","unstructured":"Abbasi, A., and Hashemi, M. (2016). Ghost in the plc designing an undetectable programmable logic controller rootkit via pin control attack. Black Hat Europe, Black Hat."},{"key":"ref_16","unstructured":"Formby, D., Durbha, S., and Beyah, R. (2017, January 14\u201317). Out of control: Ransomware for industrial control systems. Proceedings of the RSA Conference, San Francisco, CA, USA."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Smith, K., and Wilson, I. (2022). The Challenges of the Internet of Things Considering Industrial Control Systems. Privacy, Security And Forensics in The Internet of Things (IoT), Springer.","DOI":"10.1007\/978-3-030-91218-5_4"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"108270","DOI":"10.1016\/j.ress.2021.108270","article-title":"Hybrid ontology for safety, security, and dependability risk assessments and security threat analysis (STA) method for Industrial Control Systems","volume":"220","author":"Alanen","year":"2022","journal-title":"Reliab. Eng. Syst. Saf."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"012025","DOI":"10.1088\/1742-6596\/1976\/1\/012025","article-title":"A survey of offensive security research on PLCs","volume":"1976","author":"Ma","year":"2021","journal-title":"J. Phys. Conf. Ser."},{"key":"ref_20","unstructured":"Tiegelkamp, M., and John, K.H. (2010). IEC 61131-3: Programming Industrial Automation Systems, Springer."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"2467","DOI":"10.1007\/s00170-021-08001-6","article-title":"Automated detection-in-depth in industrial control systems","volume":"118","author":"Jadidi","year":"2022","journal-title":"Int. J. Adv. Manuf. Technol."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1109\/45.481370","article-title":"Programmable logic controllers","volume":"15","author":"Erickson","year":"1996","journal-title":"IEEE Potentials"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Bolton, W. (2015). Programmable Logic Controllers, Newnes.","DOI":"10.1016\/B978-0-12-802929-9.00001-7"},{"key":"ref_24","unstructured":"Dahbura, A.T., Uyar, M.U., and Yau, C.W. (1989, January 29\u201331). An optimal test sequence for the JTAG\/IEEE P1149. 1 test access port controller. Proceedings of the \u2018Meeting the Tests of Time\u2019, International Test Conference, Washington, DC, USA."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Gupta, A. (2019). JTAG debugging and exploitation. The IoT Hacker\u2019s Handbook, Apress.","DOI":"10.1007\/978-1-4842-4300-8_6"},{"key":"ref_26","unstructured":"Cui, A., Costello, M., and Stolfo, S. (2013, January 24\u201327). When firmware modifications attack: A case study of embedded exploitation. Proceedings of the 20th Annual Network & Distributed System Security Symposium 2013, San Diego, CA, USA."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"102","DOI":"10.1002\/sec.149","article-title":"malnets: Large-scale malicious networks via compromised wireless access points","volume":"3","author":"Traynor","year":"2010","journal-title":"Secur. Commun. Netw."},{"key":"ref_28","unstructured":"Wegner, S. (2008). Security-Analysis of a Telephone-Firmware with Focus on Backdoors. [Ph.D. Thesis, Ruhr-Universit\u00e4t Bochum]. Available online: https:\/\/git.fabrik17.de\/mrgitlab\/embedded-multimedia\/raw\/437afd92da4b438f95fa3efad28564a9d0baffbd\/Dokumentation\/thesistemplate.pdf."},{"key":"ref_29","unstructured":"Peck, D., and Peterson, D. Leveraging ethernet card vulnerabilities in field devices. Proceedings of the SCADA Security Scientific Symposium, Miami, FL, USA. Available online: https:\/\/link.springer.com\/chapter\/10.1007\/978-3-642-28920-0_8."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1016\/j.ijcip.2013.04.004","article-title":"Firmware modification attacks on programmable logic controllers","volume":"6","author":"Basnight","year":"2013","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1016\/j.ijcip.2014.01.004","article-title":"An evaluation of modification attacks on programmable logic controllers","volume":"7","author":"Schuett","year":"2014","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_32","unstructured":"Santamarta, R. (2012, January 21\u201326). Here be backdoors: A journey into the secrets of industrial firmware. Proceedings of the Black Hat USA, Las Vegas, NV, USA."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Rajput, P.H.N., Sarkar, E., Tychalas, D., and Maniatakos, M. (2021, January 6\u201310). Remote Non-Intrusive Malware Detection for PLCs based on Chain of Trust Rooted in Hardware. Proceedings of the 2021 IEEE European Symposium on Security and Privacy (EuroS&P), Vienna, Austria.","DOI":"10.1109\/EuroSP51992.2021.00033"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Guri, M., Poliak, Y., Shapira, B., and Elovici, Y. (2015, January 20\u201322). JoKER: Trusted detection of kernel rootkits in android devices via JTAG interface. Proceedings of the 2015 IEEE Trustcom\/BigDataSE\/ISPA, Washington, DC, USA.","DOI":"10.1109\/Trustcom.2015.358"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Konstantinou, C., Chielle, E., and Maniatakos, M. (2018, January 19\u201323). Phylax: Snapshot-based profiling of real-time embedded devices via jtag interface. Proceedings of the 2018 Design, Automation & Test in Europe Conference & Exhibition (DATE), Dresden, Germany.","DOI":"10.23919\/DATE.2018.8342128"},{"key":"ref_36","first-page":"301336","article-title":"PEM: Remote forensic acquisition of PLC memory in industrial control systems","volume":"40","author":"Zubair","year":"2022","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Unni, R.K., Vijayanand, P., and Dilip, Y. (2018, January 6\u201310). FPGA Implementation of an improved watchdog timer for safety-critical applications. Proceedings of the 2018 31st International Conference on VLSI Design and 2018 17th International Conference on Embedded Systems (VLSID), Pune, India.","DOI":"10.1109\/VLSID.2018.37"},{"key":"ref_38","unstructured":"Faas, M.S., Kraus, J., Schoenhals, A., and Baumann, M. (2021, January 8\u201313). Calibrating Pedestrians\u2019 Trust in Automated Vehicles: Does an Intent Display in an External HMI Support Trust Calibration and Safe Crossing Behavior?. Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, New York, NY, USA."},{"key":"ref_39","first-page":"1","article-title":"Blackbox JTAG reverse engineering","volume":"1","author":"Domke","year":"2009","journal-title":"Update"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1016\/j.diin.2006.01.003","article-title":"Forensic imaging of embedded systems using JTAG (boundary-scan)","volume":"3","author":"Breeuwsma","year":"2006","journal-title":"Digit. Investig."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"3420","DOI":"10.1109\/TCAD.2020.3013046","article-title":"Em-fuzz: Augmented firmware fuzzing via memory checking","volume":"39","author":"Gao","year":"2020","journal-title":"IEEE Trans.-Comput.-Aided Des. Integr. Circuits Syst."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Taylor, J., Turnbull, B., and Creech, G. (2018, January 27\u201330). Volatile memory forensics acquisition efficacy: A comparative study towards analysing firmware-based rootkits. Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany.","DOI":"10.1145\/3230833.3232810"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Muduli, S.K., Subramanyan, P., and Ray, S. (2019, January 22\u201325). Verification of authenticated firmware loaders. Proceedings of the 2019 Formal Methods in Computer Aided Design (FMCAD), San Jose, CA, USA.","DOI":"10.23919\/FMCAD.2019.8894262"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Benkraouda, H., Chakkantakath, M.A., Keliris, A., and Maniatakos, M. (2020, January 5\u20138). Snifu: Secure network interception for firmware updates in legacy plcs. Proceedings of the 2020 IEEE 38th VLSI Test Symposium (VTS), San Diego, CA, USA.","DOI":"10.1109\/VTS48691.2020.9107609"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"42","DOI":"10.1016\/j.diin.2018.04.002","article-title":"New flash memory acquisition methods based on firmware update protocols for LG Android smartphones","volume":"25","author":"Park","year":"2018","journal-title":"Digit. Investig."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"S50","DOI":"10.1016\/j.diin.2015.01.010","article-title":"Acquisition and analysis of compromised firmware using memory forensics","volume":"12","author":"Denzel","year":"2015","journal-title":"Digit. Investig."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/15\/1\/145\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T17:57:40Z","timestamp":1760119060000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/15\/1\/145"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,3]]},"references-count":46,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,1]]}},"alternative-id":["sym15010145"],"URL":"https:\/\/doi.org\/10.3390\/sym15010145","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,3]]}}}