一句话：无需修改固件或开发者标注，通过分析仿真轨迹与协议定义推导变量单位类型，检测无人机固件中的单位类型错误。
单位类型错误（如将米、小时等物理单位的值错误使用）在当今无人机系统（UAS）固件中很常见，占已知缺陷的10%以上，且超过30%的单位类型错误会导致坠机。本文提出SA4U，一个用于真实UAS固件中检测单位类型错误的实用系统。SA4U不需要修改固件，也不需要开发者提供标注；它通过分析仿真轨迹和协议定义来推导程序变量的单位类型，并利用推导出的单位类型识别单位类型错误。在ArduPilot和PX4两个流行开源固件上的评估表明，SA4U发现了14个此前未被检测到的缺陷，验证了其有效性。
Unit type errors, where values with physical unit types (e.g., meters, hours) are used incorrectly in a computation, are common in today’s unmanned aerial system (UAS) firmware. Recent studies show that unit type errors represent over 10% of bugs in UAS firmware. Moreover, the consequences of unit type errors are severe. Over 30% of unit type errors cause UAS crashes. This paper proposes SA4U: a practical system for detecting unit type errors in real-world UAS firmware. SA4U requires no modifications to firmware or developer annotations. It deduces the unit types of program variables by analyzing simulation traces and protocol definitions. SA4U uses the deduced unit types to identify when unit type errors occur. SA4U is effective: it identified 14 previously undetected bugs in two popular open-source firmware (ArduPilot & PX4.)
@inproceedings{paperbot7350,
title = {SA4U: Practical Static Analysis for Unit Type Error Detection},
author = {Max Taylor and Johnathon Aurand and Feng Qin and Xiaorui Wang and Brandon Henry and Xiangyu Zhang},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3556937}
}