Industrial control private protocol reverse engineering method and system based on retrieval enhancement generation
By constructing a knowledge base of structured fields and semantic descriptions of known industrial protocols, and combining it with a Large Language Model (LLM), the problem of insufficient field semantic inference and cross-protocol generalization ability in existing reverse engineering methods for industrial control private protocols is solved, and efficient and accurate inference of unknown protocol structure and semantics is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Chinese People's Liberation Army Cyberspace Force Information Engineering University
- Filing Date
- 2026-01-26
- Publication Date
- 2026-05-01
AI Technical Summary
Existing reverse engineering methods for proprietary industrial control protocols have shortcomings in field semantic inference, cross-protocol generalization ability, and degree of automation. In particular, they are difficult to effectively utilize the structural commonalities of industrial protocols in scenarios with sparse samples.
We employ Retrieval Enhanced Generation (RAG) technology to construct a knowledge base of structured fields and semantic descriptions of known industrial protocols. We then use Large Language Model (LLM) to perform structural and semantic inference and leverage the structural commonalities of industrial protocols to achieve cross-protocol knowledge transfer.
It enables efficient and accurate inference of the structure and semantics of unknown industrial control private protocols in sparse sample scenarios, improving the automation level of protocol reverse engineering and the ability of cross-protocol semantic inference.
Smart Images
Figure CN121967565A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of reverse engineering technology for proprietary industrial control protocols, and in particular to a method and system for reverse engineering proprietary industrial control protocols based on retrieval enhancement generation. Background Technology
[0002] Industrial control systems (ICS) are widely used in critical national infrastructure sectors such as power, water conservancy, and manufacturing, and their security is directly related to the stable operation of society. However, many ICS devices use vendor-proprietary communication protocols (such as Delta_P, Hollysys_P, and Melsoft), which are typically transmitted in compact binary formats and lack publicly available specification documentation, severely hindering security assessments and vulnerability discovery. Against this backdrop, protocol reverse engineering (PRE) becomes a necessary prerequisite for understanding the behavior of proprietary protocols, detecting abnormal traffic, and building defense mechanisms.
[0003] Despite the existence of various protocol reverse engineering methods, current technologies still face significant challenges. Network tracing-based methods (such as PI, Netzob, and Discoverer) struggle with field semantics and complex dependencies; program analysis-based methods (such as Polyglot, AutoFormat, and Tupni) are limited by closed-source environments and have low automation; while recent deep learning-based methods (such as those by Wang et al., Zhao et al., and FSIBP) can identify some field boundaries, they generally lack external knowledge guidance and perform poorly in cross-protocol generalization—especially in real-world private protocol scenarios with sparse samples, where their field semantic inference capabilities are significantly limited. More importantly, existing methods generally overlook a crucial prior knowledge: different industrial protocols share a high degree of commonality at the message structure level, such as commonly including core fields like length, sequence number, and function code. This structural isomorphism provides a natural foundation for knowledge transfer, but it has not yet been effectively utilized.
[0004] Retrieval Enhanced Generation (RAG) technology is a hybrid architecture that combines external knowledge retrieval with the generation capabilities of Large Language Models (LLM). The core process consists of three stages: (1) Retrieval: Given a user query, semantically relevant document fragments are retrieved from a large-scale knowledge base; (2) Enhancement: The retrieval results are embedded as contextual prompts; (3) Generation: The LLM generates accurate and reliable answers based on the enhanced context. By constructing a knowledge base of structured fields and semantic descriptions of known industrial protocols, RAG technology provides a new approach for reverse engineering of industrial control private protocols. When faced with an unknown private protocol, the system first retrieves known protocol fields with similar structures, and then guides the LLM to perform reasoning based on analogy. This design fully utilizes the structural commonalities of industrial protocols and realizes cross-protocol knowledge transfer and semantic inference.
[0005] Based on the above observations, this invention proposes a method and system for reverse engineering industrial control proprietary protocols based on retrieval enhancement, for the reverse engineering of industrial control proprietary protocols. Summary of the Invention
[0006] This invention addresses the shortcomings of existing reverse engineering methods for industrial control private protocols in terms of field semantic inference, cross-protocol generalization capability, and automation. It proposes a reverse engineering method and system for industrial control private protocols based on retrieval enhancement generation, which utilizes the commonalities of industrial protocol structures and retrieval enhancement generation technology to achieve efficient and accurate inference of the structure and semantics of unknown industrial control private protocols in sparse sample scenarios.
[0007] To achieve the above objectives, the technical solution adopted is:
[0008] This invention provides a reverse engineering method for industrial control private protocols based on retrieval enhancement, comprising the following steps:
[0009] Preprocessing: Converting data packets of known industry protocols into structured text;
[0010] Knowledge base construction: Load structured text, perform structure-aware segmentation, embed text into vectors, and store the embedding vectors of text blocks and their corresponding text content in a vector database to build an industrial protocol knowledge base;
[0011] Vector retrieval: Receives queries about unknown private protocols to be analyzed, performs two-stage semantic retrieval on the industrial protocol knowledge base, retrieves existing protocol text blocks related to the query semantics, and summarizes key field features based on the retrieval results;
[0012] Enhancement and Generation: The key field features summarized are combined with the original data of the unknown private protocol to be analyzed and the prompt word templates are input into the large language model LLM to generate inference results on the structure of the unknown private protocol.
[0013] According to the reverse engineering method for industrial control private protocols based on retrieval enhancement of the present invention, the preprocessing step further includes: using the Tshark command-line tool to parse the PCAP format data packets of known industrial protocols, extracting application layer data and converting it into JSON text; referring to the Wireshark official documentation, replacing the field names in the JSON text with semantic descriptions, and adding protocol layer comments.
[0014] According to the reverse engineering method of industrial control private protocols based on retrieval enhancement of the present invention, the loading of structured text in the knowledge base construction step specifically includes: traversing the file directory storing multiple structured texts, using a loader to parse the structured text files according to a predefined parsing mode, and extracting specific fields in the files as document objects, wherein the document objects contain content fields and metadata fields.
[0015] According to the reverse engineering method of industrial control private protocols based on retrieval enhancement of the present invention, the structure-aware segmentation in the knowledge base construction step further includes: setting a maximum size threshold max_chunk and a minimum size threshold min_chunk for text blocks; recursively decomposing the text using fields defining key elements in the structured text as delimiters until the size of each block is less than max_chunk; if the length of the decomposed text block is less than min_chunk, it is merged with the adjacent text block; and regenerating a new text block containing overlapping context based on the segmented text block.
[0016] According to the reverse engineering method of industrial control private protocol based on retrieval enhancement of the present invention, the text embedding vectorization in the knowledge base construction step specifically includes: the vector conversion adopts the open source pre-trained model bce-embedding-base_v1, and the segmented text blocks are converted into fixed-dimensional vector representations in batches by calling the model embedding interface.
[0017] According to the industrial control private protocol reverse engineering method based on retrieval enhancement of the present invention, the two-stage semantic retrieval in the vector retrieval step specifically includes:
[0018] Phase 1: Convert the optimized query text into a query vector, calculate its similarity to the text block vectors in the vector database, and initially recall the K text blocks with the highest similarity.
[0019] The second stage involves using the bce-reranker-base_v1 model to evaluate and re-rank the K initially recalled text blocks, selecting the N most relevant text blocks as the final retrieval results, and summarizing key field features based on the retrieval results.
[0020] According to the reverse engineering method of industrial control private protocols based on retrieval enhancement of the present invention, further optimizing the query text includes: using LLM to analyze the potential intent of the user query, rewriting and expanding the original query that is vague or too simple, and generating optimized query text.
[0021] According to the industrial control private protocol reverse engineering method based on retrieval enhancement of the present invention, the enhancement and generation steps further include:
[0022] Construct a prompt word template, which includes: LLM role definition, contextual knowledge summarized based on the final search results, raw data of the unknown private protocol to be analyzed, and task objectives;
[0023] The enhanced context constructed based on the prompt word template is input into the LLM, which generates preliminary protocol structure inference results.
[0024] According to the reverse engineering method for industrial control private protocols based on retrieval enhancement according to the present invention, the enhancement and generation steps further include iterative optimization:
[0025] Based on the preliminary protocol structure inference results generated by LLM, a new round of retrieval and summarization steps are initiated to obtain more accurate key field features;
[0026] By combining the key field features summarized in the new round with the original data of the unknown private protocol to be analyzed, and using the prompt word template, the data is input into LLM again for reasoning, gradually deepening and outputting a complete inference of the industrial private protocol structure.
[0027] Furthermore, the present invention also provides a reverse engineering system for industrial control proprietary protocols based on retrieval enhancement generation, for implementing the above method, the system comprising:
[0028] The preprocessing module is used to convert data packets of known industry protocols into structured text;
[0029] The knowledge base construction module is used to load structured text, perform structure-aware segmentation, embed text into vectors, and store the embedding vectors of text blocks and their corresponding text content into a vector database to build an industrial protocol knowledge base.
[0030] The vector retrieval module is used to receive queries about unknown private protocols to be analyzed, perform two-stage semantic retrieval on the industrial protocol knowledge base, retrieve existing protocol text blocks related to the query semantics, and summarize key field features based on the retrieval results.
[0031] The enhancement and generation module is used to input the summarized key field features and the original data of the unknown private protocol to be analyzed, along with the prompt word template, into the large language model LLM to generate inference results on the structure of the unknown private protocol.
[0032] The beneficial effects achieved by adopting the above technical solution are:
[0033] 1. This invention relates to a reverse engineering method and system for industrial control private protocols based on retrieval enhancement generation. Existing protocol reverse analysis methods generally overlook an important prior knowledge: different industrial protocols have a high degree of commonality at the message structure level. For example, they generally contain core fields such as length field, sequence number, and function code. This structural isomorphism provides a natural basis for knowledge transfer, but it has not been effectively utilized. This invention constructs a knowledge base containing the structured fields and semantic descriptions of known industrial protocols, and realizes the structural and semantic transfer from known protocols to private protocols based on RAG technology.
[0034] 2. To address the issues of LLM context window limitations and the potential disruption of meaningful field divisions in the protocol structure and loss of contextual information caused by traditional character-based segmentation strategies, this invention proposes a structure-aware text segmentation strategy. Furthermore, to address the potential problems of unclear user queries and inaccurate search results during the retrieval process, a two-stage retrieval architecture comprising preliminary recall and re-ranking is proposed.
[0035] 3. To address the issue of poor performance when directly inputting search results as prompts into the model during LLM enhancement, this invention designs a prompt template for inferring unknown protocol structures. This template includes key information such as the model's role, contextual knowledge, data to be analyzed, and task objectives, providing LLM with a contextual environment rich in accurate knowledge, with clearly defined task objectives and boundaries, thus laying the foundation for generating high-quality parsing results. Attached Figure Description
[0036] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.
[0037] Figure 1 This is a flowchart illustrating the reverse engineering method for industrial control private protocols based on retrieval enhancement in an embodiment of the present invention.
[0038] Figure 2 This is a schematic diagram of the knowledge base construction process according to an embodiment of the present invention;
[0039] Figure 3 This is a schematic diagram of the vector retrieval process according to an embodiment of the present invention. Detailed Implementation
[0040] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.
[0041] This invention discloses a reverse engineering method for industrial control proprietary protocols based on retrieval enhancement, such as... Figure 1 As shown, it mainly includes four stages: preprocessing, knowledge base construction, vector retrieval, and enhancement and generation. The specific steps are as follows:
[0042] Step S1: Preprocessing: Use the Tshark tool to convert data packets of known industrial protocols into structured JSON text to support the subsequent construction of the knowledge base.
[0043] Specifically, the data sources for known industrial protocols mainly include two aspects: one is capture from real ICS environments, and the other is acquisition from GitHub repositories. It is assumed that the data packets for these known industrial protocols are already available and can be parsed using Tshark. Since the data streams of industrial protocols typically reside at the application layer, the Tshark command-line tool is used to batch parse the collected known industrial protocol data packets, retaining only the protocol structure containing application layer data. Because the raw data packets are stored in PCAP format, which is not a text format directly usable for building a knowledge base, the results parsed by Tshark are further saved as structured JSON text—a function supported by the Tshark command-line tool.
[0044] Furthermore, although the JSON text explicitly indicates the division results of different fields, the semantics of the fields are unclear, which is detrimental to the use of the constructed knowledge base in subsequent retrieval and generation stages. To address the above issues, the JSON text is further optimized using the following method: To our knowledge, all known industrial protocols that Tshark can parse provide explanations of field names and meanings on the Wireshark website; by referring to the official documentation, field names can be replaced in batches with corresponding semantic descriptions, while annotations are added to the protocol layer.
[0045] Step S2, Knowledge Base Construction: First, the JSON text of the protocol is loaded. Then, a structure-aware segmentation method is used to segment the text into different text blocks. Next, each text block is encoded into a corresponding embedding vector through a text embedding model. Finally, the embedding vectors of the text blocks and their corresponding text content are stored in a vector database to construct an industrial protocol knowledge base for subsequent retrieval. Figure 2 As shown, this step includes four sub-steps: text loading, text segmentation, text embedding, and vector storage.
[0046] Step S201, Text Loading: Load the preprocessed JSON text into the system to provide a foundation for subsequent text segmentation.
[0047] First, the directory storing all data packet JSON files is traversed, and the file content is read one by one. Then, the JSONLoader API provided by LangChain is used to convert the preprocessed JSON data into LangChainDocument objects. This loader uses the specified jq schema to parse the JSON file, thereby extracting specific fields into the content fields and metadata fields of the LangChain Document, forming standardized text data for subsequent processing. Specifically, the specific values of the protocol fields in the JSON file and the complete semantic description text are integrated and filled into the content fields; non-textual core information such as protocol level comments, field type identifiers, original data packet numbers, JSON file storage paths, and parsing timestamps, which have retrieval and traceability value, are filled into the metadata fields.
[0048] Step S202, Text Segmentation: Segment the text content loaded into the system into text blocks that can be further processed by the LLM context window.
[0049] Due to the limitations of the LLM context window, traditional character-based segmentation strategies may disrupt meaningful field divisions within the protocol structure and potentially lead to the loss of contextual information. Therefore, a structure-aware text segmentation strategy is proposed. This method decomposes text into appropriately sized chunks, ensuring the integrity of the protocol structure remains intact while preserving a sufficient level of contextual information. First, a maximum chunk size is defined as `max_chunk`. Then, the text is recursively decomposed using specific delimiters until the size of each chunk is smaller than `max_chunk`. These delimiters consist of fields defining key elements in the JSON text, such as the original message and protocol level. Second, to prevent excessively small chunks from being generated in the absence of sufficient context, a predefined minimum threshold, called `min_chunk`, is established for the chunk size. If the chunk length is below `min_chunk`, it is merged with adjacent chunks to ensure consistency. Finally, to maintain contextual continuity between chunks, new text chunks are regenerated based on previously segmented chunks, ensuring a certain degree of overlap between them. This method decomposes text into appropriately sized chunks, ensuring the integrity of the protocol structure remains intact while preserving a sufficient level of contextual information.
[0050] Step S203, Text Embedding: Use a text embedding model to convert the segmented text blocks into vector representations, providing a foundation for subsequent vector storage.
[0051] Text embedding is a crucial step in transforming protocol knowledge into a machine-understandable and computable form. This process enables the system to understand the deeper intent of the query, rather than relying solely on keyword matching, thereby finding the most semantically relevant protocol message fragments. This invention uses the open-source pre-trained model bce-embedding-base_v1, optimized specifically for RAG tasks, as the text embedding model. This model is adaptable to more real-world business scenarios and can be efficiently integrated with the LangChain framework. During text embedding, by calling the model's embedding interface, all text blocks segmented in the previous stage are batch-converted into fixed-dimensional vector representations. In this vector space, protocol messages with similar semantics (such as Modbus requests with the same function code) will have vector representations that are closer in distance, while messages with significant semantic differences will be farther apart. This characteristic provides the foundation for subsequent semantic similarity-based retrieval and is the core mechanism for achieving high-quality semantic retrieval.
[0052] Step S204, Vector Storage: The embedded vectors generated from different text blocks and their corresponding text content are stored together in the vector database to provide a foundation for subsequent vector retrieval.
[0053] Vector storage aims to persistently save the generated embedded vectors and their corresponding original text blocks, and to build an efficient vector index database. This type of database specifically provides optimized similarity search capabilities (such as cosine similarity calculation) for large-scale vectors. Combined with a metadata storage mechanism, the vector database not only serves as a semantic search engine but also constitutes a context-rich industrial protocol knowledge base, providing accurate and traceable data support for the subsequent RAG generation stage. This invention uses a professional Chroma vector database for storage; during storage, in addition to the embedded vectors, the original message of the corresponding text block and key fields extracted from JSON (such as Function Code) are also stored as metadata. This design enables the retrieval process to not only return the top K semantically similar vectors but also simultaneously retrieve their corresponding original protocol data, thereby significantly improving the efficiency and reliability of result verification and in-depth analysis.
[0054] Step S3, Vector Retrieval: First, using the same text embedding model, queries about the unknown private protocol to be analyzed are mapped to query vectors. Then, a two-stage semantic retrieval is performed on the industrial protocol knowledge base: relevant content is initially recalled from the vector database based on semantic similarity, and then a re-ranking mechanism is used to filter and re-rank the initial recall results. Finally, key field features are summarized based on the retrieval results. The process of this step is as follows: Figure 3 As shown.
[0055] Before performing a retrieval, LLM is used to analyze the user's underlying query intent, and the user's input query is rewritten and expanded to improve retrieval performance. When the user's original query expression is not clear enough or too simple, rewriting and expansion can generate more effective retrieval queries. Then, using the same text embedding model as when building the knowledge base, the optimized query text is converted into query vectors.
[0056] During the retrieval process, initial content recall is achieved by calculating the cosine similarity between the query vector and all text block vectors in the vector database. At this point, the value of K needs to be considered; a value that is too small may lead to the omission of effective information, while a value that is too large will introduce noise interference. To fully cover the structural information of known industrial protocols to support subsequent private protocol inference, and based on the actual task requirements, the K value is set to 50, meaning that the 50 text blocks with the highest similarity are initially recalled.
[0057] After the retrieval is completed, the bce-reranker-base_v1 model is used to re-rank the initial recall results. This model evaluates the relevance of each candidate text block to the user query and outputs a meaningful semantic relevance score based on this relevance. Then, based on this score, the candidate text blocks are filtered and ranked, placing text blocks more relevant to the user query at the top, thus optimizing the text block selection. The top 10 text blocks are then selected as the retrieval results, and the features of each field are summarized based on these results for use in subsequent enhancement and generation stages.
[0058] Step S4, Enhancement and Generation: In the enhancement stage, the system combines the summarized key field features and the original data of the unknown private protocol to be analyzed with the prompt word template and inputs them into the LLM for inference analysis; in the generation stage, the system generates preliminary protocol reverse analysis results based on the provided input, and can also initiate a new round of retrieval based on the preliminary analysis results to gradually deepen the understanding of the protocol structure, and finally output the inferred protocol structure of the industrial private protocol.
[0059] Context enhancement serves as a bridge between retrieval and generation, aiming to create an information-rich and clearly structured working context for LLM (Local Protocol Modeling). This invention abandons the simplistic approach of directly inputting retrieval results into the model, instead employing a prompt word engineering strategy. A structured prompt word template is designed, clearly defining the model's role, the contextual knowledge summarized from the final retrieval results, the raw data of the unknown proprietary protocol to be analyzed, and the task objective. System role setting: Clearly instructing the model to act as a professional protocol reverse engineering expert, which helps activate the model's knowledge in relevant fields. Relevant context: This is key to enhancement; features of each field are summarized based on the top 10 most relevant text blocks retrieved and embedded into the prompt words. Industrial proprietary protocol data: This is the part to be analyzed; the captured industrial proprietary protocol data stream is inserted into the prompt words in its raw data format. Task instructions: Clearly and unambiguously describing the user's specific requirements, such as analyzing the format of the unknown protocol data and outputting it in JSON format. Through the above enhancement mechanism, an environment rich in precise knowledge, with clearly defined task objectives and boundaries is provided for LLM, laying the foundation for generating high-quality parsing results.
[0060] This invention employs the open-source large-scale language model DeepSeek-R1-0528 for inferring unknown protocol structures. This model receives increased computational power during post-training, significantly enhancing its depth of thought and reasoning ability. In this example, the model temperature is set to 0.2 to ensure that the model provides the most accurate and reliable answer based on the provided context, rather than relying on arbitrary guesswork. Based on the constructed prompt word template, preliminary protocol parsing results are first generated. Based on the uncertainties discovered in the preliminary parsing results, new and more precise search queries are generated. Subsequently, a new round of retrieval and induction steps can be initiated using these new search queries, and a chain-of-thought mechanism is introduced to gradually deepen the understanding of the protocol structure, ultimately outputting a complete inference of the industry-specific protocol structure.
[0061] Corresponding to the above method, embodiments of the present invention also disclose a reverse engineering system for industrial control proprietary protocols based on retrieval enhancement generation, the system comprising:
[0062] The preprocessing module is used to convert data packets of known industry protocols into structured text;
[0063] The knowledge base construction module is used to load structured text, perform structure-aware segmentation, embed text into vectors, and store the embedding vectors of text blocks and their corresponding text content into a vector database to build an industrial protocol knowledge base.
[0064] The vector retrieval module is used to receive queries about unknown private protocols to be analyzed, perform two-stage semantic retrieval on the industrial protocol knowledge base, retrieve existing protocol text blocks related to the query semantics, and summarize key field features based on the retrieval results.
[0065] The enhancement and generation module is used to input the summarized key field features and the original data of the unknown private protocol to be analyzed, along with the prompt word template, into the large language model LLM to generate inference results on the structure of the unknown private protocol.
[0066] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A reverse engineering method for industrial control proprietary protocols based on retrieval enhancement generation, characterized in that, Includes the following steps: Preprocessing: Converting data packets of known industry protocols into structured text; Knowledge base construction: Load structured text, perform structure-aware segmentation, embed text into vectors, and store the embedding vectors of text blocks and their corresponding text content in a vector database to build an industrial protocol knowledge base; Vector retrieval: Receives queries about unknown private protocols to be analyzed, performs two-stage semantic retrieval on the industrial protocol knowledge base, retrieves existing protocol text blocks related to the query semantics, and summarizes key field features based on the retrieval results; Enhancement and Generation: The key field features summarized are combined with the original data of the unknown private protocol to be analyzed and the prompt word templates are input into the large language model LLM to generate inference results on the structure of the unknown private protocol.
2. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 1, characterized in that, The preprocessing steps specifically include: using the Tshark command-line tool to parse PCAP format data packets of known industrial protocols, extracting application layer data and converting it into JSON text; referring to the Wireshark official documentation, replacing field names in the JSON text with semantic descriptions, and adding protocol layer comments.
3. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 1, characterized in that, The loading of structured text in the knowledge base construction step specifically includes: traversing the file directory storing multiple structured texts, using a loader to parse the structured text files according to a predefined parsing mode, and extracting specific fields from the files as document objects, wherein the document objects contain content fields and metadata fields.
4. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 1, characterized in that, The structure-aware segmentation in the knowledge base construction step specifically includes: setting a maximum size threshold max_chunk and a minimum size threshold min_chunk for text blocks; recursively decomposing the text using fields defining key elements in the structured text as delimiters until the size of each block is less than max_chunk; if the length of the decomposed text block is less than min_chunk, it is merged with the adjacent text block; and regenerating a new text block containing overlapping context based on the segmented text blocks.
5. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 1, characterized in that, The text embedding vectorization in the knowledge base construction steps specifically includes: vector conversion using the open-source pre-trained model bce-embedding-base_v1, which converts the segmented text blocks into fixed-dimensional vector representations in batches by calling the model embedding interface.
6. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 1, characterized in that, The two-stage semantic retrieval in the vector retrieval step specifically includes: Phase 1: Convert the optimized query text into a query vector, calculate its similarity to the text block vectors in the vector database, and initially recall the K text blocks with the highest similarity. The second stage involves using the bce-reranker-base_v1 model to evaluate and re-rank the K initially recalled text blocks, selecting the N most relevant text blocks as the final retrieval results, and summarizing key field features based on the retrieval results.
7. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 6, characterized in that, Optimizing query text involves: using LLM to analyze the user's potential query intent, rewriting and expanding the original query that is vague or too simple, and generating optimized query text.
8. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 6, characterized in that, The enhancement and generation steps specifically include: Construct a prompt word template, which includes: LLM role definition, contextual knowledge summarized based on the final search results, raw data of the unknown private protocol to be analyzed, and task objectives; The enhanced context constructed based on the prompt word template is input into the LLM, which generates preliminary protocol structure inference results.
9. The industrial control private protocol reverse engineering method based on retrieval enhancement generation according to claim 8, characterized in that, The enhancement and generation steps also include iterative optimization: Based on the preliminary protocol structure inference results generated by LLM, a new round of retrieval and summarization steps are initiated to obtain more accurate key field features; By combining the key field features summarized in the new round with the original data of the unknown private protocol to be analyzed, and using the prompt word template, the data is input into LLM again for reasoning, gradually deepening and outputting a complete inference of the industrial private protocol structure.
10. A reverse engineering system for industrial control proprietary protocols based on retrieval enhancement generation, characterized in that, For implementing the method as described in any one of claims 1-9, the system comprises: The preprocessing module is used to convert data packets of known industry protocols into structured text; The knowledge base construction module is used to load structured text, perform structure-aware segmentation, embed text into vectors, and store the embedding vectors of text blocks and their corresponding text content into a vector database to build an industrial protocol knowledge base. The vector retrieval module is used to receive queries about unknown private protocols to be analyzed, perform two-stage semantic retrieval on the industrial protocol knowledge base, retrieve existing protocol text blocks related to the query semantics, and summarize key field features based on the retrieval results. The enhancement and generation module is used to input the summarized key field features and the original data of the unknown private protocol to be analyzed, along with the prompt word template, into the large language model LLM to generate inference results on the structure of the unknown private protocol.