一句话：提出机器学习引导的智能模糊测试，自动发现CPS网络攻击测试套件，无需控制程序或物理过程知识。
评估信息物理系统（CPS）攻击防御机制的有效性面临挑战，因为往往缺乏真实的攻击测试集。本文提出 smart fuzzing，一种自动化、机器学习引导的技术，用于系统性地生成CPS网络攻击的“测试套件”。该方法利用预测性机器学习模型和元启发式搜索算法引导执行器模糊测试，从而驱使CPS进入不同的非安全物理状态，且不需要了解系统的控制程序或物理过程。作者在两个真实CPS测试台上实现并评估该方法：水净化厂和水分配系统，发现了可使其进入27种不同非安全状态的攻击，涉及水流量、压力和储罐液位，其中6种未被已有攻击基准覆盖。最后，作者用该方法测试水处理厂基于不变式的防御系统，发现两个未被其物理不变式检查检测到的攻击，揭示了特定条件下可能被利用的潜在弱点。
The threat of attack faced by cyber-physical systems (CPSs), especially when they play a critical role in automating public infrastructure, has motivated research into a wide variety of attack defence mechanisms. Assessing their effectiveness is challenging, however, as realistic sets of attacks to test them against are not always available. In this paper, we propose smart fuzzing, an automated, machine learning guided technique for systematically finding 'test suites' of CPS network attacks, without requiring any knowledge of the system's control programs or physical processes. Our approach uses predictive machine learning models and metaheuristic search algorithms to guide the fuzzing of actuators so as to drive the CPS into different unsafe physical states. We demonstrate the efficacy of smart fuzzing by implementing it for two real-world CPS testbeds—a water purification plant and a water distribution system—finding attacks that drive them into 27 different unsafe states involving water flow, pressure, and tank levels, including six that were not covered by an established attack benchmark. Finally, we use our approach to test the effectiveness of an invariant-based defence system for the water treatment plant, finding two attacks that were not detected by its physical invariant checks, highlighting a potential weakness that could be exploited in certain conditions.
@inproceedings{paperbot5289,
title = {Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences},
author = {Yuqi Chen and Christopher M. Poskitt and Jun Sun and Sridhar Adepu and Fan Zhang},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00093}
}