Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3372297.3417249acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article
Public Access

Cyber-Physical Inconsistency Vulnerability Identification for Safety Checks in Robotic Vehicles

Published: 02 November 2020 Publication History

Abstract

We propose a new type of vulnerability for Robotic Vehicles (RVs), called Cyber-Physical Inconsistency. These vulnerabilities target safety checks in RVs (e.g., crash detection). They can be exploited by setting up malicious environment conditions such as placing an obstacle with a certain weight and a certain angle in the RV's trajectory. Once exploited, the safety checks may fail to report real physical accidents or report false alarms (while the RV is still operating normally). Both situations could lead to life-threatening consequences. The root cause of such vulnerabilities is that existing safety checks are mostly using simple range checks implemented in general-purpose programming languages, which are incapable of describing the complex and delicate physical world. We develop a novel technique that requires the interplay of program analysis, vehicle modeling, and search-based testing to identify such vulnerabilities. Our experiment on 4 real-world control software and 8 vehicles including quadrotors, rover, and fixed-wing airplane has discovered 10 real vulnerabilities. Our technique does not have false positives as it only reports when an exploit can be generated.

Supplementary Material

MOV File (Copy of CCS2020_fp177_HongjunChoi - Brian Hollendyke.mov)
Presentation video

References

[1]
2017. Arduino based Arducopter UAV, the open source multi-rotor - Arducopter, the open source UAV multicopter. http://www.arducopter.co.uk/.
[2]
Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2009. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security (TISSEC)13, 1 (2009), 1--40.
[3]
National Highway Traffic Safety Administration et al. 2007. The new car assessment program suggested approaches for future program enhancements. DOT HS810 (2007), 698.
[4]
Alfred V Aho, Ravi Sethi, and Jeffrey D Ullman. 1986. Compilers, principles, techniques. Addison Wesley 7, 8 (1986), 9.
[5]
Tejasagar Ambati, KVNS Srikanth, and P Veeraraju. 2012. Simulation of vehicular frontal crash-test. International Journal of Applied Research in Mechanical Engineering (IJARME) ISSN(2012), 2231--5950.
[6]
Ali O Atahan. 2009. Vehicle crash test simulation of roadside hardware using LS-DYNA: a literature review. International Journal of Heavy Vehicle Systems 17, 1 (2009), 52--75.
[7]
Robert Gardner Bartle et al. 1976. The elements of real analysis. Wiley.
[8]
Bloomberg 2017. Tesla Is Testing Self-Driving Cars on California Roads. https://www.bloomberg.com/news/articles/2017-02-01/tesla-is-testing-self-driving-cars-on-california-roads.
[9]
Boeing Air Taxi 2019. Boeing's Autonomous Taxi Takes Flight.https://www.wsj.com/articles/boeings-autonomous-taxi-takes-flight-11548249580.
[10]
Boeing737-Ethiopian 2016. Ethiopian Airlines: 'No survivors' on crashed Boeing 737. https://www.bbc.com/news/world-africa-47513508.
[11]
Boeing737-Lion 2016. Lion Air: How could a brand new plane crash? https://www.bbc.com/news/world-asia-46014260.
[12]
California DMV 2019. Testing of Autonomous Vehicles with a Driver. https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/testing.
[13]
Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage, Karl Koscher, Alexei Czeskis, Franziska Roesner, Tadayoshi Kohno, et al. 2011. Comprehensive Experimental Analyses of Automotive Attack Surfaces. In USENIX Security Symposium. San Francisco.
[14]
Peng Chen and Hao Chen. 2018. Angora: Efficient fuzzing by principled search. In 2018 IEEE Symposium on Security and Privacy (SP). IEEE, 711--725.
[15]
Hongjun Choi, Wen-Chuan Lee, Yousra Aafer, Fan Fei, Zhan Tu, Xiangyu Zhang, Dongyan Xu, and Xinyan Xinyan. 2018. Detecting Attacks Against Robotic Vehicles: A Control Invariant Approach. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. ACM, 801--816.
[16]
Abraham A Clements, Naif Saleh Almakhdhub, Khaled S Saab, Prashast Srivas-tava, Jinkyu Koo, Saurabh Bagchi, and Mathias Payer. 2017. Protecting Bare-metal Embedded Systems With Privilege Overlays. In Security and Privacy (SP), 2017 IEEE Symposium on. IEEE, 289--303.
[17]
CNN 2012. Self-driving cars now legal in California. http://www.cnn.com/2012/09/25/tech/innovation/self-driving-car-california/index.html.
[18]
Frederick B Cohen. 1993. Operating system protection through program evolution. Computers & Security 12, 6 (1993), 565--584.
[19]
comma.ai 2018. commaai/openpilot: open source driving agent. https://github.com/commaai/openpilot.
[20]
Mirko Conrad. 2004. A systematic approach to testing automotive control software. Technical Report. SAE Technical Paper.
[21]
Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. 1998. Stack-guard: Automatic adaptive detection and prevention of buffer-overflow attacks. In USENIX security symposium, Vol. 98. San Antonio, TX, 63--78.
[22]
Crash Test 2012. See What Happens When A Boeing 727 Is Crashed Into The Desert On Purpose. https://www.flightglobal.com/video-boeing-727-deliberately-crashed-in-desert-for-tv/105069.article.
[23]
Ang Cui and Salvatore J Stolfo. 2011. Defending embedded systems with software symbiotes. In International Workshop on Recent Advances in Intrusion Detection. Springer, 358--377.
[24]
Drew Davidson, Hao Wu, Robert Jellinek, Vikas Singh, and Thomas Ristenpart. 2016. Controlling UAVs with Sensor Input Spoofing Attacks. In WOOT.
[25]
Kalyanmoy Deb. 2001.Multi-objective optimization using evolutionary algorithms. Vol. 16. John Wiley & Sons.
[26]
Kalyanmoy Deb and Ram Bhushan Agrawal. 1995. Simulated binary crossover for continuous search space. Complex systems 9, 2 (1995), 115--148.
[27]
Kalyanmoy Deb and Mayank Goyal. 1996. A combined genetic adaptive search(GeneAS) for engineering design.Computer Science and informatics26 (1996),30--45.
[28]
Kalyanmoy Deb, Amrit Pratap, Sameer Agarwal, and TAMT Meyarivan. 2002. Afast and elitist multiobjective genetic algorithm: NSGA-II. IEEE transactions on evolutionary computation6, 2 (2002), 182--197.
[29]
Kalyanmoy Deb and Santosh Tiwari. 2008. Omni-optimizer: A generic evolutionary algorithm for single and multi-objective optimization.European Journal of Operational Research 185, 3 (2008), 1062--1087.
[30]
Demo Video 2019. Head-on crash.https://drive.google.com/open?id=1_yHV5eGf13bKISqshB3ieqR62dDYLYgs.
[31]
Demo Video 2019. PX4 free fall check.https://drive.google.com/open?id=1pGLktjVZPvGXhugJq02GYxAn67XL7BTY.
[32]
Demo Video 2019. PX4 free fall check fail. https://drive.google.com/open?id=19WUb3f_KlUL_Nc8zmwlfKyQysM9KPalG.
[33]
Demo Video 2019. PX4 ground contact. https://drive.google.com/open?id=1_T8Lk3FX-ujSxh8nBINRAZUfUoI9sI4g.
[34]
Demo Video 2019. PX4 ground contact fail. https://drive.google.com/open?id=14-lausvtfEjFfGJJtKFdEcLG5k2-XDpf.
[35]
Demo Video 2019. Rover crash check.https://drive.google.com/open?id=1Wiyz0s8fLZlziB9MFBfriVNBZY8RLyPD.
[36]
Demo Video 2019. Rover crash check fail. https://drive.google.com/open?id=1aB2LMoFySZKr0pq_CWOII53qO5URlWXQ.
[37]
Demo Video 2019. Rover crash check fail2. https://drive.google.com/open?id=1OnSgODRY2hUwh-9GrCCgKaqk3nzx3Jgn.
[38]
Demo Video 2019. Side crash. https://drive.google.com/open?id=1mC-qbZdeWK6ZnHA8RCK-JiTbCnG4jtN8.
[39]
Demo Video 2019. Thrust loss check fail. https://drive.google.com/open?id=1odEt6ZMw9nlH7Q7ufXbhD-wHoFzytlbS.
[40]
P Dimitri et al. 1999. Nonlinear programming. Athena Scientific.
[41]
Azim Eskandarian, Dhafer Marzougui, and Nabih E Bedewi. 1997. Finite element model and validation of a surrogate crash test vehicle for impacts with roadside objects. International Journal of Crashworthiness 2, 3 (1997), 239--258.
[42]
Chuchu Fan, Bolun Qi, Sayan Mitra, and Mahesh Viswanathan. 2017. DryVR: Data-Driven Verification and Compositional Reasoning for Automotive Systems. In Computer Aided Verification, Rupak Majumdar and Viktor Kun?ak (Eds.). Springer International Publishing, Cham, 441--461.
[43]
Chuchu Fan, Bolun Qi, Sayan Mitra, Mahesh Viswanathan, and Parasara Sridhar Duggirala. 2016. Automatic reachability analysis for nonlinear hybrid models with C2E2. In International Conference on Computer Aided Verification. Springer, 531--538.
[44]
Goran Frehse, Colas Le Guernic, Alexandre Donzé, Scott Cotton, Rajarshi Ray, Olivier Lebeltel, Rodolfo Ripado, Antoine Girard, Thao Dang, and Oded Maler.2011. SpaceEx: Scalable verification of hybrid systems. In International Conference on Computer Aided Verification. Springer, 379--395.
[45]
Jairo Giraldo, David Urbina, Alvaro Cardenas, Junia Valente, Mustafa Faisal, Justin Ruths, Nils Ole Tippenhauer, Henrik Sandberg, and Richard Candell. 2018. A survey of physics-based attack detection in cyber-physical systems. ACM Computing Surveys (CSUR)51, 4 (2018), 76.
[46]
Zhijian He, Yao Chen, Enyan Huang, Qixin Wang, Yu Pei, and Haidong Yuan. 2019. A system identification based Oracle for control-CPS software fault localization. In Proceedings of the 41st International Conference on Software Engineering. IEEE Press, 116--127.
[47]
Mei-Chen Hsueh, Timothy K Tsai, and Ravishankar K Iyer. 1997. Fault injection techniques and tools. Computer 30, 4 (1997), 75--82.
[48]
Todd E Humphreys, Brent M Ledvina, Mark L Psiaki, Brady W O'Hanlon, and Paul M Kintner Jr. 2008. Assessing the spoofing threat: Development of a portable GPS civilian spoofer. InProceedings of the ION GNSS international technical meeting of the satellite division, Vol. 55. 56.
[49]
Hyundai S-A1 flying taxi 2019. Hyundai S-A1 flying taxis could take flight by2023 for Uber elevate. https://www.digitaltrends.com/cars/hyundai-sa1-flying-taxi-ces-2020/.
[50]
IIHS 2020. Insurance Institute for Highway Safety (IIHS). https://www.iihs.org.
[51]
Rob Millerb Ishtiaq Roufa, Hossen Mustafaa, Sangho Ohb Travis Taylora, Wenyuan Xua, Marco Gruteserb, Wade Trappeb, and Ivan Seskarb. 2010. Security and privacy vulnerabilities of in-car wireless networks: A tire pressure monitoring system case study. In 19th USENIX Security Symposium, Washington DC. 11--13.
[52]
Karen E Jackson, Richard L Boitnott, Edwin L Fasanella, Lisa E Jones, and Karen HLyle. 2004. A history of full-scale aircraft and rotorcraft crash testing and simulation at NASA Langley Research Center. (2004).
[53]
Karim Nice 2001. How Crash Testing Works. https://auto.howstuffworks.com/car-driving-safety/accidents-hazardous-conditions/crash-test1.htm.
[54]
Chung Hwan Kim, Taegyu Kim, Hongjun Choi, Zhongshu Gu, Byoungyoung Lee, Xiangyu Zhang, and Dongyan Xu. 2018. Securing Real-Time Microcontroller Systems through Customized Memory View Switching. In Proceedings of the25th Annual Network and Distributed System Security Symposium(San Diego, California)(NDSS '18). The Internet Society.
[55]
Taegyu Kim, Chung Hwan Kim, Junghwan Rhee, Fan Fei, Zhan Tu, GregoryWalkup, Xiangyu Zhang, Xinyan Deng, and Dongyan Xu. 2019. RVFuzzer: Finding Input Validation Bugs in Robotic Vehicles through Control-Guided Testing. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 425--442. https://www.usenix.org/conference/usenixsecurity19/presentation/kim
[56]
Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, Tadayoshi Kohno, Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, et al.2010. Experimental security analysis of a modern automobile. In Security and Privacy (SP), 2010 IEEE Symposium on. IEEE, 447--462.
[57]
Ivan Victor Krsul. 1998. Software vulnerability analysis. Purdue University West Lafayette, IN.
[58]
L Ljung. 1999. System Identification-Theory for the User, Prentice Hall, Upper Saddle River N. System identification: Theory for the user. 2nd ed. Prentice Hall,Upper Saddle River, NJ. (1999).
[59]
LS-DYNA 2019. Home | Livermore Software Technology Corp. https://www.lstc.com/.
[60]
MATLAB 2017. System Identification Toolbox - MATLAB. https://www.mathworks.com/products/sysid.html.
[61]
Open Dynamics Engine 2014. Open Dynamics Engine. https://www.ode.org.
[62]
Open Source Robotics Foundation 2014. Gazebo. http://gazebosim.org/.
[63]
Open Source Robotics Foundation 2019. SDF Home. http://sdformat.org.
[64]
Carlos Pacheco, Shuvendu K Lahiri, Michael D Ernst, and Thomas Ball. 2007. Feedback-directed random test generation. In 29th International Conference on Software Engineering (ICSE'07). IEEE, 75--84.
[65]
Fabio Pasqualetti, Florian Dörfler, and Francesco Bullo. 2013. Attack detection and identification in cyber-physical systems. IEEE Trans. Automat. Control58, 11(2013), 2715--2729.
[66]
Lee Pike, Pat Hickey, Trevor Elliott, Eric Mertens, and Aaron Tomb. 2016. Trackos: A security-aware real-time operating system. In International Conference on Runtime Verification. Springer, 302--317.
[67]
Md Atiqur Rahman and D Praveen Babu. [n.d.]. Simulation of Car Frontal Fascia During Crash using LS-DYNA. ([n. d.]).
[68]
Ralf Salomon. 1998. Evolutionary algorithms and gradient search: similarities and differences. IEEE Transactions on Evolutionary Computation 2, 2 (1998), 45--55.
[69]
Hovav Shacham, Matthew Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, and Dan Boneh. 2004. On the effectiveness of address-space randomization. In Proceedings of the 11th ACM conference on Computer and communications security. ACM, 298--307.
[70]
Russell Smith et al. 2005. Open dynamics engine. (2005).
[71]
Yunmok Son, Hocheol Shin, Dongkwan Kim, Young-Seok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, Yongdae Kim, et al. 2015. Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors. In USENIX Security Symposium. 881--896.
[72]
Yulei Sui and Jingling Xue. 2016. SVF: interprocedural static value-flow analysis in LLVM. In Proceedings of the 25th international conference on compiler construction. ACM, 265--266.
[73]
Chang-ai Sun, Jingting Jia, Huai Liu, and Xiangyu Zhang. 2018. A Lightweight Program Dependence Based Approach to Concurrent Mutation Analysis. In 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), Vol. 1. IEEE, 116--125.
[74]
Hisashi Tamaki, Hajime Kita, and Shigenobu Kobayashi. 1996. Multi-objective optimization by genetic algorithms: A review. In Proceedings of IEEE international conference on evolutionary computation. IEEE, 517--522.
[75]
Tesla Accident 2016. The technology behind the Tesla crash, explained. https://www.washingtonpost.com/news/the-switch/wp/2016/07/01/the-technology-behind-the-tesla-crash-explained/?noredirect=on&utm_term=.23e1b51bc9e4.
[76]
Romain Testylier and Thao Dang. 2013. Nltoolbox: A library for reachability computation of nonlinear dynamical systems. In Automated Technology for Verification and Analysis. Springer, 469--473.
[77]
Nils Ole Tippenhauer, Christina Pöpper, Kasper Bonne Rasmussen, and SrdjanCapkun. 2011. On the requirements for successful GPS spoofing attacks. In Proceedings of the 18th ACM conference on Computer and communications security. ACM, 75--86.
[78]
David A Van Veldhuizen and Gary B Lamont. 1998. Evolutionary computation and convergence to a pareto front. In Late breaking papers at the genetic programming1998 conference. 221--228.
[79]
Jon S Warner and Roger G Johnston. 2002. A simple demonstration that the global positioning system (GPS) is vulnerable to spoofing. Journal of Security Administration 25, 2 (2002), 19--27.
[80]
Waymo 2017. Waymo (formerly the Google self-driving car project). https://waymo.com.
[81]
Svante Wold, Kim Esbensen, and Paul Geladi. 1987. Principal component analysis. Chemometrics and intelligent laboratory systems 2, 1--3 (1987), 37--52.
[82]
Zhaogui Xu, Shiqing Ma, Xiangyu Zhang, Shuofei Zhu, and Baowen Xu. 2018. Debugging with intelligence via probabilistic inference. In Proceedings of the 40thInternational Conference on Software Engineering. ACM, 1171--1181.
[83]
Sai Zhang, David Saff, Yingyi Bu, and Michael D Ernst. 2011. Combined static and dynamic automated test generation. In Proceedings of the 2011 International Symposium on Software Testing and Analysis. 353--363.

Cited By

View all
  • (2024)ROCAS: Root Cause Analysis of Autonomous Driving Accidents via Cyber-Physical Co-mutationProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695530(1620-1632)Online publication date: 27-Oct-2024
  • (2023)Humanoid Robots: Cybersecurity Concerns And Firewall ImplementationVFAST Transactions on Software Engineering10.21015/vtcs.v11i1.145411:1(85-100)Online publication date: 31-Mar-2023
  • (2023)SCVMON: Data-oriented attack recovery for RVs based on safety-critical variable monitoringProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3607199.3607221(547-563)Online publication date: 16-Oct-2023
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
October 2020
2180 pages
ISBN:9781450370899
DOI:10.1145/3372297
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 02 November 2020

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. CPS security
  2. cyber-physical inconsistency
  3. robotic vehicle

Qualifiers

  • Research-article

Funding Sources

Conference

CCS '20
Sponsor:

Acceptance Rates

Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

Upcoming Conference

CCS '25

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)342
  • Downloads (Last 6 weeks)38
Reflects downloads up to 01 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2024)ROCAS: Root Cause Analysis of Autonomous Driving Accidents via Cyber-Physical Co-mutationProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695530(1620-1632)Online publication date: 27-Oct-2024
  • (2023)Humanoid Robots: Cybersecurity Concerns And Firewall ImplementationVFAST Transactions on Software Engineering10.21015/vtcs.v11i1.145411:1(85-100)Online publication date: 31-Mar-2023
  • (2023)SCVMON: Data-oriented attack recovery for RVs based on safety-critical variable monitoringProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3607199.3607221(547-563)Online publication date: 16-Oct-2023
  • (2023)TileMask: A Passive-Reflection-based Attack against mmWave Radar Object Detection in Autonomous DrivingProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security10.1145/3576915.3616661(1317-1331)Online publication date: 15-Nov-2023
  • (2023)Enabling Fast and Privacy-Preserving Broadcast Authentication With Efficient Revocation for Inter-Vehicle ConnectionsIEEE Transactions on Mobile Computing10.1109/TMC.2023.327521823:4(3309-3327)Online publication date: 11-May-2023
  • (2023)Physical-Sensing Inconsistency Vulnerability Mitigation for Multi-UAV Crowdsensing2023 International Conference on Networking and Network Applications (NaNA)10.1109/NaNA60121.2023.00121(705-710)Online publication date: Aug-2023
  • (2022)TASHAROK: Using Mechanism Design for Enhancing Security Resource Allocation in Interdependent Systems2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833591(249-266)Online publication date: May-2022
  • (2022)PGPatch: Policy-Guided Logic Bug Patching for Robotic Vehicles2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833567(1826-1844)Online publication date: May-2022
  • (2022)Robotics cyber security: vulnerabilities, attacks, countermeasures, and recommendationsInternational Journal of Information Security10.1007/s10207-021-00545-821:1(115-158)Online publication date: 1-Feb-2022

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media