Abstract:This paper presents a novel tool, named Rampo, that can perform binary code analysis to identify cyber kinetic vulnerabilities in CPS. The tool takes as input a Signal Temporal Logic (STL) formula that describes the kinetic effect, i.e., the behavior of the physical system, that one wants to avoid. The tool then searches the possible cyber trajectories in the binary code that may lead to such physical behavior. This search integrates binary code analysis tools and hybrid systems falsification tools using a Counter-Example Guided Abstraction Refinement (CEGAR) approach. Rampo starts by analyzing the binary code to extract symbolic constraints that represent the different paths in the code. These symbolic constraints are then passed to a Satisfiability Modulo Theories (SMT) solver to extract the range of control signals that can be produced by each path in the code. The next step is to search over possible physical trajectories using a hybrid systems falsification tool that adheres to the behavior of the cyber paths and yet leads to violations of the STL formula. Since the number of cyber paths that need to be explored increases exponentially with the length of physical trajectories, we iteratively perform refinement of the cyber path constraints based on the previous falsification result and traverse the abstract path tree obtained from the control program to explore the search space of the system. To illustrate the practical utility of binary code analysis in identifying cyber kinetic vulnerabilities, we present case studies from diverse CPS domains, showcasing how they can be discovered in their control programs. Our tool could compute the same number of vulnerabilities while leading to a speedup that ranges from 3x to 98x.

PSY-TaLiRo: A Python Toolbox for Search-Based Test Generation for Cyber-Physical Systems

Coverage Explorer: Coverage-guided Test Generation for Cyber Physical Systems

SyPSE: A Symbolic Computation Toolbox for Process Systems Engineering Part I-Architecture and Algorithm Development

SyPSE: A Symbolic Computation Toolbox for Process Systems Engineering Part II─Design for PSE Applications

Stark: a tool for the analysis of CPSs robustness

Data Driven Testing of Cyber Physical Systems

Testing CPS with Design Assumptions-Based Metamorphic Relations and Genetic Programming

A Flexible and Efficient Temporal Logic Tool for Python: PyTeLo

SBFT Tool Competition 2024 -- Python Test Case Generation Track

CPSim: Simulation Toolbox for Security Problems in Cyber-Physical Systems

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

Perception-enhancement Based Task Learning and Action Scheduling for Robotic Limb in CPS Environment

Rampo: A CEGAR-based Integration of Binary Code Analysis and System Falsification for Cyber-Kinetic Vulnerability Detection

The Ten Lockheed Martin Cyber-Physical Challenges: Formalized, Analyzed, and Explained

CoqPyt: Proof Navigation in Python in the Era of LLMs

PDF: Path-Oriented, Derivative-Free Approach for Safety Falsification of Nonlinear and Nondeterministic CPS

A Systematic and Semi-Automatic Safety-Based Test Case Generation Approach Based on Systems-Theoretic Process Analysis

Investigating Robustness in Cyber-Physical Systems: Specification-Centric Analysis in the face of System Deviations

A Survey of Algorithms for Black-Box Safety Validation of Cyber-Physical Systems

Stress Testing Control Loops in Cyber-Physical Systems

PRoTECT: Parallelized Construction of Safety Barrier Certificates for Nonlinear Polynomial Systems