Cite this article
JIN Zengwang, JIANG Lingyang, DING Junyi, et al. A Review of Research on Industrial Control System Security [J]. Netinfo Security, 2025, 25(3): 341-363.
Background Introduction
Industrial Control Systems (ICS) are widely used in industrial and critical infrastructure sectors, encompassing various control systems that play a crucial role in modern industrial production. Industrial Control Protocols (ICP), as the communication core of ICS, are vital for the stable operation of systems and data security. However, ICPs are often designed with a focus on functionality and interoperability, with insufficient security considerations, leading to ICS facing various cyber threats such as malware and denial-of-service attacks. Historically, attacks targeting ICS have occurred frequently, severely jeopardizing corporate interests and even national security. With the development of the Industrial Internet, the integration of ICS with information technology systems has deepened, and attack methods have become increasingly diverse, making traditional security measures inadequate. In this context, researchers are actively exploring ICP security issues, proposing various solutions, and leveraging emerging technologies such as deep learning, artificial intelligence, and large language models to advance ICS security protection towards intelligent and automated directions. However, due to the complex and diverse nature of industrial control environments, existing security solutions still struggle to meet the needs of all scenarios.
Paper Overview
This paper provides a review focused on the security of industrial control protocols, covering basic concepts of protocols, vulnerability discovery techniques, security protection measures, and the application of large language models, as detailed below:
1. Basics of Industrial Control Protocols: Introduces the basic concepts and classifications of Industrial Control Protocols (ICP), analyzing the security features and vulnerabilities of common ICPs (such as Modbus, DNP3, S7Comm, Profinet) to provide background and basis for subsequent research.
2. Vulnerability Discovery Techniques: Focuses on the application of vulnerability discovery techniques in identifying potential security risks, including static analysis and symbolic execution, protocol reverse engineering, and fuzz testing strategies. These techniques uncover security vulnerabilities in ICS from different perspectives, collectively building a multi-layered security defense system.
3. Security Protection Measures: Discusses security protection measures for ICPs, including encryption and authentication, intrusion detection, and deep defense strategies. Encryption and authentication technologies protect data security at the protocol level, while intrusion detection mechanisms identify and respond to potential security threats at the code level.
4. Application of Large Language Models: Focuses on the cutting-edge applications of large language models (LLM) in ICS security, such as in industrial code generation, control logic optimization, and honeypot design, providing more adaptive and intelligent security solutions for ICS.
Typical Industrial Control Network Topology
Corresponding Author:
Zhang Huixiang [email protected]
Author Profiles:
JIN Zengwang (1990-), male, Fujian, associate professor, PhD, main research direction is industrial protocol security analysis and industrial control system security analysis.
JIANG Lingyang (1999-), male, Henan, master’s student, main research direction is industrial control security and fuzz testing.
DING Junyi (2003-), female, Anhui, master’s student, main research direction is industrial control security and fuzz testing.
Zhang Huixiang (1981-), male, Shaanxi, associate professor, PhD, main research direction is network and system security.
ZHAO Bo (1992-), male, Shandong, associate professor, PhD, main research direction is unmanned system security analysis and integrated network security transmission protocols.
FANG Pengfei (1986-), male, Beijing, engineer, master’s degree, main research direction is protocol reverse engineering and industrial control system security.
Long press to read the original text
Information Network Security
“Information Network Security” was founded in 2001, supervised by the Ministry of Public Security, co-sponsored by the Third Research Institute of the Ministry of Public Security and the China Computer Federation, and is one of the first domestic information security journals published both domestically and internationally. It became a core journal of Chinese science and technology in 2015, a source journal of the Chinese Science Citation Database in 2017, a core journal in Chinese in 2018, and was included in the CCF high-quality scientific journal grading directory in the computing field in 2022.
Chinese Core Journal
Chinese Science and Technology Core Journal
Source Journal of the Chinese Science Citation Database
CCF High-Quality Scientific Journal in Computing Field
We are constantly striving for improvement and look forward to your attention and support!