CPFuzz: Combining Fuzzing and Falsification of Cyber-Physical Systems

Abstract

Coverage-guided grey-box fuzzing for computer systems has been explored for decades. However, existing techniques do not adequately explore the space of continuous behaviors in Cyber-Physical Systems (CPSs), which may miss safety-critical bugs. Optimization-guided falsification is promising to find violations of safety specifications, but not suitable for identifying traditional program bugs. This article presents a fuzzing process for finding safety violations at the development phase, which is guided by two quantities: a branch coverage metric to explore discrete program behaviors and a Linear Temporal Logic (LTL) robust satisfaction metric to identify undesirable continuous plant behaviors. We implement CPFuzz to demonstrate the utility of the idea and estimate its effectiveness on seven control system benchmarks. The results show up to a better performance in average time to find violations on all benchmarks than S-TaLiRo and six benchmarks than S3CAMX. Finally, we exploit CPFuzz to synthesize the sensor spoofing attack on a DC motor with fixed-point overflow vulnerability as a case study. INDEX TERMSCoverage guided fuzzing, cyber-physical systems, linear temporal logic, optimizationguided falsification VOLUME 4, 2016This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.

CPS Attacks Mitigation Approaches on Power Electronic Systems With Security Challenges for Smart Grid Applications: A Review

“…The industrial control system depends on standard protocols like the TCP/IP and ICCP, which makes the industrial control system insecure due to insecure protocols. The TCP/IP's vulnerabilities have been inspected in [131], [132], but this protocol still has security concerns as it is not anticipated to be secure via the design. Indeed, the remote procedure call (RPC) protocol has security vulnerabilities, although it contributed to the renowned Stuxnet attack [133].…”