Publication Type

Conference Proceeding Article

Version

acceptedVersion

Publication Date

7-2023

Abstract

Industrial control systems (ICSs) are types of cyber-physical systems in which programs, written in languages such as ladder logic or structured text, control industrial processes through sensing and actuating. Given the use of ICSs in critical infrastructure, it is important to test their resilience against manipulations of sensor/actuator inputs. Unfortunately, existing methods fail to test them comprehensively, as they typically focus on finding the simplest-to-craft manipulations for a testing goal, and are also unable to determine when a test is simply a minor permutation of another, i.e. based on the same causal events. In this work, we propose a guided fuzzing approach for finding 'meaningfully different' tests for an ICS via a general formalisation of sensor/actuator-manipulation strategies. Our algorithm identifies the causal events in a test, generalises them to an equivalence class, and then updates the fuzzing strategy so as to find new tests that are causally different from those already identified. An evaluation of our approach on a real-world water treatment system shows that it is able to find 106% more causally different tests than the most comparable fuzzer. While we focus on diversifying the test suite of an ICS, our formalisation may be useful for other fuzzers that intercept communication channels.

Keywords

Cyber-physical systems, fuzzing, test diversity, equivalence classes, causality

Discipline

Software Engineering

Research Areas

Software and Cyber-Physical Systems

Publication

ICSE '23: Proceedings of the 45th International Conference on Software Engineering, Melbourne, Australia, 2023 May 14-20

First Page

2578

Last Page

2590

ISBN

9781665457019

Identifier

10.1109/ICSE48619.2023.00215

Publisher

IEEE

City or Country

Melbourne, Australia

Copyright Owner and License

Authors

Additional URL

https://doi.org/10.1109/ICSE48619.2023.00215

Download

Share

COinS