Man Zhou

Industrial control protocols (ICPs), especially proprietary protocols, lack public specifications due to security and commercial considerations, posing profound challenges for security audits and vulnerability detection. Although the function code fields in ICPs define critical operational semantics (e.g., PLC start/stop), existing protocol reverse engineering (PRE) methods struggle to accurately infer the functional implications of their value dependencies. To address this critical gap, we propose FuncSeinfer, an operation-traffic correlation-driven method for inferring functional semantics in proprietary ICPs by associating graphical user interface (GUI) operations of programming software with network traffic. FuncSeinfer first employs an entropy-based dynamic field extraction algorithm to generate candidate fields. Subsequently, it applies heuristic rules and clustering scoring rules to accurately infer function code fields. Finally, it identifies semantics through variance analysis of traffic marked with operational labels. We rigorously evaluated FuncSeinfer on 7 widely used ICPs (S7comm, UMAS-A, UMAS-B, Modbus, PCCC, Melsoft, and Fins) in 9 real-world PLCs from 5 leading manufacturers, achieving 100% accuracy in function code field inference, outperforming state-of-the-art PRE tools such as Netzob, FieldHunter, Netplier, and FSIBP. Furthermore, FuncSeinfer can accurately identify the semantic meaning of 78 function codes, which is an average improvement of 20.2% compared to Wireshark. This study fills the gap in functional semantics within ICP reverse engineering, enabling in-depth security analysis without requiring protocol specifications.

The dynamic network of heterogeneous and mobile energy nodes, such as drones, electric vehicles, and ground energy stations, forms the basis of air–ground collaborative cyber-physical energy systems. It is difficult to optimize system energy efficiency and economic operation while maintaining resilience under information and physical disturbances. The problem becomes more complex under strong spatiotemporal coupling, limited local information, and non-ideal communication. This paper proposes a strategy-prior-guided generative collaborative energy management framework, named PG-TSCD. The framework adopts a two-stage structure-aware decision process. At the system level, a spatiotemporal graph-based conditional diffusion model captures the dynamic coupling among nodes and global safety constraints. It describes the feasible scheduling space under complex constraints and generates a coordinated discharge and recharge power prior sequence. At the node level, each agent combines the global prior with incomplete local observations through a lightweight adaptive reconstruction module. It then produces executable scheduling actions that remain robust under disturbances. In this way, distributed agents achieve system objectives through coordinated decision making. Theoretical analysis shows that PG-TSCD approximates centralized optimal scheduling with a bounded performance gap and ensures stable distributed learning. Experiments show that the model converges in about 85 training rounds, reaches a peak energy efficiency of 3.5, and maintains a task completion rate above 93% under high load. The performance remains stable under 300 ms communication delay and 12% packet loss.

With the rapid advancement of 6G networks and artificial intelligence technologies, Space-Air-Ground Integrated Networks (SAGIN) are revolutionizing communication services. SAGIN seamlessly integrates satellite, Unmanned Aerial Vehicle (UAV), and terrestrial infrastructures to offer expansive coverage, ultra-low latency, and highly reliable connectivity. This paper introduces SACVTH, a novel chain-verifiable and trustworthy heterogeneous federated learning framework aimed at tackling critical challenges within the SAGIN context, including resource optimization, privacy protection, and security verification. In particular, we initially devise a sophisticated community partitioning mechanism tailored to task requirements and device capabilities to optimize resource utilization and ensure timely task execution. Subsequently, we propose an innovative lightweight verifiable secure aggregation protocol, that leverages sparse matrices and pseudorandom generators to compress verification data. Additionally, we implement a chain-based group broadcast mechanism that significantly reduces the frequency of direct communications and the volume of data transmissions between trainers and servers by facilitating intra-group model sharing and aggregation. This is achieved by enabling intra-group model sharing and aggregation, allowing trainers to communicate through intermediary relay nodes, thereby enhancing both communication efficiency and scalability within the federated learning framework. Rigorous security analysis demonstrates that SACVTH ensures the verifiability of aggregation results. Comparative evaluations with other state-of-the-art methods reveal that SACVTH protocol significantly outperforms others in resource optimization and security verification, leading to substantial improvements in the efficiency, robustness, and reliability of federated learning frameworks.

Due to the dynamic and uncertain nature of the autonomous driving environment, traditional detection methods are ineffective in detecting complex and diverse anomalies. Additionally, existing detection methods relying on deep neural network may lack interpretability, making it challenging to infer the accuracy of the algorithms or the reasonableness of anomalies. To address these issues, this paper proposes an unsupervised anomaly detection method based on the physical invariant subspace. This method utilizes a Kalman Variational Autoencoder (KVAE) to learn the normal trajectory of vehicles and incorporates a subspace extraction (SSE) layer in the encoder to identify and capture discriminative subspaces relevant to the anomaly detection task in the latent space representation. The entire anomaly detection framework consists of a data preprocessing module, a KVAE with a SSE layer (SKVAE), an iteratively reweighted least squares state estimator, and an adaptive non-parametric cumulative sum anomaly detector. Firstly, the SKVAE separates spatial representation from action recognition and employs a Gaussian state space model to capture latent dynamic information in the sequential data, filtering out outliers and noise to enhance the accuracy and robustness of anomaly detection. Moreover, the adaptive non-parametric cumulative sum detector automatically adjusts the detection threshold to adapt to different distributions and variations in the anomaly data. This method demonstrates perfect detection accuracy and efficiency in numerical experiments, and the proposed detection model offers interpretability of the predicted results through the physical invariant characteristics and the extracted interpretable subspaces.