A Vulnerability Mining System Based on Fuzzing for IEC 61850 Protocol

Tu, Tengfei; Zhang, Hua; Qin, Boqin; Chen, Zhuo

doi:10.2991/fmsmt-17.2017.119

Cited by 8 publications

(4 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This research has demonstrated that the GOOSE protocol of IEC 61850 entails vulnerabilities and is prone to malicious attacks even under the compliance of the IEC 62351 security standard; these vulnerabilities need to be addressed in subsequent standards and protocol revisions. Reference [100] introduces a fuzzing tester termed as "IECFuzzer" which can be used to exploit the potential denial-of-service vulnerabilities of IEC61850 protocol, but also to verify the robustness of PLC devices using IEC61850 protocol.…”

Section: Discussionmentioning

confidence: 99%

“…Our future work will include the security analysis of additional software in the power grid domain, as well as the examination of software in other domains. We also plan to consider the combined assessment of results concerning communication protocol security through relevant simulation-based tools (e.g., Scyther) on the one hand (e.g., [99][100][101]), and results from the software implementation security assessment on the other hand, towards the computation of a comprehensive risk level of 5G and smart grid systems. Finally, the effectiveness of model-based checking tools such as [93][94][95] in the identification of security-related issues, and the interplay between secure software development practices and the operation of forensics in the domain of 5G and Smart Grid computing [107] will be studied.…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids

et al. 2021

View full text Add to dashboard Cite

The 5G communication network will underpin a vast number of new and emerging services, paving the way for unprecedented performance and capabilities in mobile networks. In this setting, the Internet of Things (IoT) will proliferate, and IoT devices will be included in many 5G application contexts, including the Smart Grid. Even though 5G technology has been designed by taking security into account, design provisions may be undermined by software-rooted vulnerabilities in IoT devices that allow threat actors to compromise the devices, demote confidentiality, integrity and availability, and even pose risks for the operation of the power grid critical infrastructures. In this paper, we assess the current state of the vulnerabilities in IoT software utilized in smart grid applications from a source code point of view. To that end, we identified and analyzed open-source software that is used in the power grid and the IoT domain that varies in characteristics and functionality, ranging from operating systems to communication protocols, allowing us to obtain a more complete view of the vulnerability landscape. The results of this study can be used in the domain of software development, to enhance the security of produced software, as well as in the domain of automated software testing, targeting improvements to vulnerability detection mechanisms, especially with a focus on the reduction of false positives.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Discussionmentioning

confidence: 99%

On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids

et al. 2021

View full text Add to dashboard Cite

show abstract

“…There are several studies published regarding the creation of fuzzing data (Ai-Fen Sui et al, 2011;Blumbergs and Vaarandi, 2017) and testbeds (Yang et al, 2015;Mathur and Tippenhauer, 2016) where the ICS devices can be tested, but they rarely explore the indication of the corruption of the inspected device. Tu et al (2017) introduced the IECFuzzer containing four modules: the mutator module, the mutator selection module, the data reorganisation module and the survival verification module. Here the survival verifier module communicates with the target PLC in real-time and obtains the status of the PLC.…”

Section: Related Workmentioning

confidence: 99%

Space Cyber Threats and Need for Enhanced Resilience of Space Assets

2021

Proceedings of the European Conference on Information Warfare and Security

View full text Add to dashboard Cite

No reproduction, copy or transmission may be made without written permission from the individual authors. Review ProcessPapers submitted to this conference have been double-blind peer reviewed before final acceptance to the conference. Initially, abstracts were reviewed for relevance and accessibility and successful authors were invited to submit full papers. Many thanks to the reviewers who helped ensure the quality of all the submissions. Ethics and Publication Malpractice PolicyACIL adheres to a strict ethics and publication malpractice policy for all publications -details of which can be found here: http://www.academic-conferences.org/policies/ethics-policy-for-publishing-in-the-conferenceproceedings-of-academic-conferences-and-publishing-international-limited/ Self-Archiving and Paper RepositoriesWe actively encourage authors of papers in ACIL conference proceedings and journals to upload their published papers to university repositories and research bodies such as ResearchGate and Academic.edu. Full reference to the original publication should be provided. Conference ProceedingsThe Conference Proceedings is a book published with an ISBN and ISSN. The proceedings have been submitted to a number of accreditation, citation and indexing bodies including Thomson ISI Web of Science and Elsevier Scopus.

show abstract

“…At present, the commonly used vulnerability mining techniques are divided into static analysis, dynamic analysis, binary comparison, fuzzy testing, and so on [6][7][8][9][10][11][12]. Fuzzy testing has the advantages of high automation, low system consumption, low false-alarm rate, and being independent of the source code of the object program [7].…”

Section: Introductionmentioning

confidence: 99%

A Test Cases Generation Method for Industrial Control Protocol Test

Shang

Zhang

Wang

et al. 2021

Scientific Programming

View full text Add to dashboard Cite

The coverage of test cases is an important indicator for the security and robustness test of industrial control protocols. It is an important research topic to complete the test with less use cases. Taking Modbus protocol as an example, a calculation method of case similarity and population dispersion based on weight division is proposed in this paper. The method can describe the similarity of use cases and the dispersion degree of individuals in the population more accurately. Genetic algorithm is used to generate and optimize test cases, and individual similarity and population dispersion are used as fitness functions of genetic algorithm. Experimental results show that the proposed method can increase the population dispersion by 3.45% compared with the conventional methods and effectively improve the coverage of test cases.

show abstract

A Vulnerability Mining System Based on Fuzzing for IEC 61850 Protocol

Cited by 8 publications

References 9 publications

On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids

On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids

Space Cyber Threats and Need for Enhanced Resilience of Space Assets

A Test Cases Generation Method for Industrial Control Protocol Test

Contact Info

Product

Resources

About