Yangyang Geng

Automatic Exploit Generation (AEG) plays an important role in proactive assessment of software threats by identifying vulnerabilities and constructing functional payloads. Existing Large Language Model (LLM)-based methods, however, often struggle to reason about complex exploit logic and to perform runtime introspection, leaving a gap between static vulnerability analysis and dynamic memory behavior. We present PwnAgent, an LLM-driven multi-agent framework for end-to-end exploit generation that combines offensive domain knowledge with active runtime introspection. PwnAgent uses a hierarchical knowledge base for multi-stage exploit reasoning and a feedback-driven self-correction engine to calibrate dynamic memory parameters during execution. Because broad Capture The Flag (CTF) benchmarks offer limited binary-exploitation depth and pwn-specific evaluation must balance reproducibility, difficulty progression, and exploit diversity, we construct a 66-task pwn benchmark from public CTF-style challenges. The benchmark is primarily composed of Linux x86/x86-64 ELF binaries and stack-oriented tasks, with smaller format-string, heap, integer-overflow, ARM, and MIPS subsets used as limited probes beyond the dominant setting. Under the same recent Kimi-K2.6 backend, PwnAgent achieves a 62.12% end-to-end success rate, compared with 31.82% for the evaluated PwnGPT baseline, a 30.30 percentage-point gain. These paired results indicate that structured knowledge guidance, execution-grounded measurement, and feedback repair improve LLM-based exploit generation in the evaluated setting, while the absolute success rate shows that fully autonomous exploitation remains challenging.

Industrial control protocols (ICPs), especially proprietary protocols, lack public specifications due to security and commercial considerations, posing profound challenges for security audits and vulnerability detection. Although the function code fields in ICPs define critical operational semantics (e.g., PLC start/stop), existing protocol reverse engineering (PRE) methods struggle to accurately infer the functional implications of their value dependencies. To address this critical gap, we propose FuncSeinfer, an operation-traffic correlation-driven method for inferring functional semantics in proprietary ICPs by associating graphical user interface (GUI) operations of programming software with network traffic. FuncSeinfer first employs an entropy-based dynamic field extraction algorithm to generate candidate fields. Subsequently, it applies heuristic rules and clustering scoring rules to accurately infer function code fields. Finally, it identifies semantics through variance analysis of traffic marked with operational labels. We rigorously evaluated FuncSeinfer on 7 widely used ICPs (S7comm, UMAS-A, UMAS-B, Modbus, PCCC, Melsoft, and Fins) in 9 real-world PLCs from 5 leading manufacturers, achieving 100% accuracy in function code field inference, outperforming state-of-the-art PRE tools such as Netzob, FieldHunter, Netplier, and FSIBP. Furthermore, FuncSeinfer can accurately identify the semantic meaning of 78 function codes, which is an average improvement of 20.2% compared to Wireshark. This study fills the gap in functional semantics within ICP reverse engineering, enabling in-depth security analysis without requiring protocol specifications.

Protocol reverse engineering (PRE) aims to automatically reconstruct the structural specifications and behavioral models of unknown protocols from network traffic without prior knowledge, serving as a critical enabling technology for cybersecurity, protocol testing, intrusion detection, and related fields. This paper provides a systematic review of research on PRE based on network traffic. First, a universal four-stage analytical framework is proposed, encompassing data preprocessing and message clustering, protocol format inference, field semantic inference, and protocol state machine inference. Subsequently, research progress is organized around three core tasks: for protocol format inference, methods based on sequence alignment, probabilistic statistics, frequent item mining, and deep learning are reviewed; for field semantics inference, two technical approaches—heuristic rules and side-information-based methods—are summarized; for protocol state machine inference, three categories of techniques—traditional methods, probabilistic models, and tree-based structures—are categorized. Finally, the paper concludes by summarizing the primary challenges facing current research and outlining future development trends.

Programmable logic controllers (PLCs) play a crucial role in various industrial manufacturing processes. Recent attack events show that attackers have a strong interest in controller variables of PLCs, including the device status and internal program logic. Detecting anomalous messages targeting PLC controller variables, which relies on the analysis of controller variable semantics, has proven to be an effective method for identifying such attacks. However, the proprietary nature of industrial control protocols (ICPs) poses a challenge to extracting the required semantics. In this paper, we propose an automated framework named SePanner to extract the semantics of controller variables from proprietary ICPs based on network traffic. Specifically, we first collect multiple groups of interaction traffic of PLCs and perform the starting-aligned comparisons on them to locate the semantic fields directly. Then, we identify and investigate a new problem in semantic extraction — interference resulting from misordered messages — and propose a set of filtering criteria to eliminate it effectively. We evaluate SePanner using the S7COMM protocol, and the results indicate that SePanner can successfully extract the semantics of controller variables with 100% accuracy. Additionally, we employ SePanner to analyze 7 proprietary ICPs, successfully extracting the semantics of 63 controller variables and their 134 states. Additionally, we demonstrate the extensive applications of SePanner in multiple ICS security scenarios and present its better performance compared with existing ICP semantic analyzing tools.

Coordinated cyber-physical attacks (CCPAs) pose a critical threat to the secure operation of smart power grids. While existing studies often assume simultaneous or sequence-agnostic attack strategies, this paper proposes a sequence-aware CCPA framework that explicitly models the temporal coupling between cyber manipulation and physical sabotage. We enhance the classical load redistribution attack (LRA) by addressing four key limitations: detectability due to infeasible power flows, violation of power balance, omission of post-attack system response, and insensitivity to attack sequencing. Specifically, we formulate two distinct bilevel attack models, namely Cyber-to-Physical (C→P) and Physical-to-Cyber (P→C), and solve them via an exact KKT-based Mixed-Integer Linear Programming (MILP) reformulation and a scalable Benders decomposition (BD) framework. Experiments on IEEE 14-, 57-, and 118-bus systems demonstrate that C→P attacks induce significantly more line overloads than P→C, validating the heightened risk of cyber-initiated cascades. Moreover, our BD approach accurately identifies spatial vulnerability hotspots with high fidelity, even when the physical attack budget is extended from R_p = 1 to R_p = 2, confirming the framework’s scalability and practical relevance. The results provide actionable insights for adaptive grid protection against sophisticated, sequential threats.

Cybersecurity incidents targeting the power grid have been increasing in recent years. The IEC 61850 protocol serves as a safeguard for substation communications, and its security plays an important role in the safe and stable operation of the power grid. Aiming at the problem of low accuracy of intrusion detection of IEC 61850 communication protocols, this paper proposes ATCV model by combining feature selection and triadic concept analysis. The ATCV model includes three parts: data preprocessing, feature selection, and FL (Fuzzy Triadic Concept Analysis) classification model construction. Firstly, due to the different forms of datasets, the training set and test set are preprocessed separately, and for the test set the data grammar library is used to standardize it; Then, redundant features are eliminated based on feature contribution to generate a streamlined dataset; Finally, fuzzy triadic backgrounds are generated based on the streamlined dataset, fuzzy triadic concepts are constructed and transformed into feature triadic concept vectors. Construct a vector group based on the representation vectors and set the initial weight values, then dynamically adjust the weight values through the vector group to the classification results of the test data to generate the FL classification model. In order to test the classification effect of the ATCV model, the model was validated through horizontal and longitudinal comparison experiments. Experiments show that the accuracy, precision, recall and F1-Score of the ATCV model reach 93.92, 93.26, 99.96 and 96.5% respectively, which are significantly better than those of the SVM, KNN, CNN, DPL-FSAD and FSL-SCNN models; And the more the amount of data, the better the detection effect of ATCV.