Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

Abstract

The threat of attack faced by cyber-physical systems (CPSs), especially when they play a critical role in automating public infrastructure, has motivated research into a wide variety of attack defence mechanisms. Assessing their effectiveness is challenging, however, as realistic sets of attacks to test them against are not always available. In this paper, we propose smart fuzzing, an automated, machine learning guided technique for systematically finding 'test suites' of CPS network attacks, without requiring any knowledge of the system's control programs or physical processes. Our approach uses predictive machine learning models and metaheuristic search algorithms to guide the fuzzing of actuators so as to drive the CPS into different unsafe physical states. We demonstrate the efficacy of smart fuzzing by implementing it for two real-world CPS testbeds-a water purification plant and a water distribution system-finding attacks that drive them into 27 different unsafe states involving water flow, pressure, and tank levels, including six that were not covered by an established attack benchmark. Finally, we use our approach to test the effectiveness of an invariant-based defence system for the water treatment plant, finding two attacks that were not detected by its physical invariant checks, highlighting a potential weakness that could be exploited in certain conditions.

PGFUZZ: Policy-Guided Fuzzing for Robotic Vehicles

“…Additionally, fuzzing approaches that specifically target CPS [21], [22], [41] cannot discover this kind of safety violations for two main reasons. First, policy violations are often triggered by the composition of different types of system inputs.…”

“…Traditional fuzzing techniques [5], [44], [48] including those for CPS [21], [22], [41] have two main limitations that prevent their adoption for policy-guided fuzzing in real-world systems. First, their bug oracles are not designed to detect undesired system states that do not cause a system crash, memory-access violation, or physical instability.…”

“…Unimplemented command Conventional Fuzzing Methods [5], [44], [48] AR-SI [36] RVFuzzer [41] MAYDAY [40] Control Invariant [24] Cyber-Physical inconsistency [23] Fuzzing for CPSs [22] PGFuzz…”

“…In comparison to other approaches including traditional fuzzing methods [5], [44], [48], CPS fuzzing works [21], [22], and control instability detection works [23], [24], [36], [40], [41] as presented in Table X, PGFUZZ tests the whole control software by allowing users to define any functional requirements in the form of MTL formulas. This enables PGFUZZ to discover additional types of bugs such as checking for safety conditions (e.g., when a drone opens the parachute, as explained in Section VII-C1), drone physical crashes due to parameters' incorrect ranges (Section VII-C2), and incorrect altitude calculation (Section VII-C3).…”

Cascading effects of cyber-attacks on interconnected critical infrastructure

“…Control theoretic models (Kwon et al 2013) reduce the entire attack space to a mathematically tractable noise and abstract the physical aspects whereas the attacks designed in this paper are from a cyber physical attacker model (Adepu and Mathur 2016b) and affords an opportunity to widen the attack surface. The investigation of attacks (Kang et al 2016;Adepu et al 2020) and automatic generation of attacks (Chen et al 2019) have been studied.…”