一句话：提出引导式模糊测试方法，基于传感器/执行器操纵策略的形式化，发现因果不同的ICS测试。
工业控制系统（ICS）程序通过传感和执行控制工业过程，需测试其对传感器/执行器输入操纵的韧性。现有方法多寻找最易构造的操纵，且无法判断测试是否只是同一因果事件的微小排列，因此测试不全面。本文提出引导式模糊测试方法，形式化传感器/执行器操纵策略；算法识别测试中的因果事件，将其泛化为等价类，并更新模糊测试策略以发现与已有测试因果不同的新测试。在真实水处理系统上，该方法比最可比的模糊测试器多找到106%的因果不同测试。该形式化也可用于其他拦截通信通道的模糊测试器。
Industrial control systems (ICSs) are types of cyber-physical systems in which programs, written in languages such as ladder logic or structured text, control industrial processes through sensing and actuating. Given the use of ICSs in critical infrastructure, it is important to test their resilience against manipulations of sensor/actuator inputs. Unfortunately, existing methods fail to test them comprehensively, as they typically focus on finding the simplest-to-craft manipulations for a testing goal, and are also unable to determine when a test is simply a minor permutation of another, i.e. based on the same causal events. In this work, we propose a guided fuzzing approach for finding 'meaningfully different’ tests for an ICS via a general formalisation of sensor/actuator-manipulation strategies. Our algorithm identifies the causal events in a test, generalises them to an equivalence class, and then updates the fuzzing strategy so as to find new tests that are causally different from those already identified. An evaluation of our approach on a real-world water treatment system shows that it is able to find 106% more causally different tests than the most comparable fuzzer. While we focus on diversifying the test suite of an ICS, our formalisation may be useful for other fuzzers that intercept communication channels.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2302-04175,
title = {Finding Causally Different Tests for an Industrial Control System},
author = {Christopher M. Poskitt and Yuqi Chen and Jun Sun and Yu Jiang},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00215}
}