Pipe4Stux: Attacking PLC by Using Key Tag and Attack Semantic

Semantic attacks against programmable logic controllers (PLCs) can manipulate industrial control systems (ICS) and cause severe physical disruptions. Yet, existing researches remain target-agnostic: they fail to determine which PLC tags or physical process are most critical when exploited. To address this gap, we introduce Pipe4Stux, a semantic attack framework that generates effective PLC attacks by leveraging key tags and attack semantics. Pipe4Stux first constructs a lexical analyzer and a data dependency subgraph from PLC control logic to capture the relationships among variables and operations. It then identifies key tags, derives semantic features of attacks, and formulates process-aware attack tactic. Experimental results on real ICS scenarios demonstrate that Pipe4Stux enables destructive and reproducible semantic attacks, revealing the potential impact of compromising key tags during specific physical states. In addition, Pipe4Stux provides the first systematic and objective methodology for semantic attack synthesis, offering practical guidance for defense. The framework can also support continuous monitoring by designating key tags as alarm variables within supervisory control and data acquisition (SCADA) systems such as WINCC.