Finding Causally Different Tests for an Industrial Control System
arXiv:2302.04175 · doi:10.1109/ICSE48619.2023.00215
Abstract
Industrial control systems (ICSs) are types of cyber-physical systems in which programs, written in languages such as ladder logic or structured text, control industrial processes through sensing and actuating. Given the use of ICSs in critical infrastructure, it is important to test their resilience against manipulations of sensor/actuator inputs. Unfortunately, existing methods fail to test them comprehensively, as they typically focus on finding the simplest-to-craft manipulations for a testing goal, and are also unable to determine when a test is simply a minor permutation of another, i.e. based on the same causal events. In this work, we propose a guided fuzzing approach for finding 'meaningfully different' tests for an ICS via a general formalisation of sensor/actuator-manipulation strategies. Our algorithm identifies the causal events in a test, generalises them to an equivalence class, and then updates the fuzzing strategy so as to find new tests that are causally different from those already identified. An evaluation of our approach on a real-world water treatment system shows that it is able to find 106% more causally different tests than the most comparable fuzzer. While we focus on diversifying the test suite of an ICS, our formalisation may be useful for other fuzzers that intercept communication channels.
arXiv commentAccepted by the 45th IEEE/ACM International Conference on Software Engineering (ICSE 2023)
References in corpus (5)
- Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
- Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System
- Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences
- Causal Testing: Finding Defects' Root Causes
- Active Fuzzing for Testing and Securing Cyber-Physical Systems