SaTC: CORE: Small: Enhanced Security and Reliability for Embedded Control Systems

如今，嵌入式设备无处不在。这些设备本质上是联网的，这使它们容易受到恶意软件的攻击。迄今为止，Windows设备仍然是恶意软件攻击的最主要目标。但这种竞争环境正在迅速改变，正如固件攻击私人接入点或闭路电视摄像机所证明的那样。据报道，对工业和政府基础设施的其他入侵还包括电网、工业控制和汽车系统，甚至是联网的私人家庭中的小型设备，这些设备通常被称为物联网。随着我们的日常生活越来越依赖于这些设备，恶意软件攻击构成了严重的风险。然而，有限的计算能力限制了嵌入式安全措施。更糟糕的是，在控制系统中执行恶意软件代码可能会导致控制动作的时间滞后。这种延误可能导致财产损失、灾难性故障甚至生命损失。因此，恶意软件不仅对系统功能，而且对时间的影响是至关重要的。该项目将重塑网络控制设备的保护格局，因为跨整个软件堆栈的新型基于时序的保护机制将补充传统的网络安全方法，从而显着提高安全性和可靠性。研究者将促进来自代表性不足群体的学生的参与，重点是教育和培训来自这些群体的博士生。研究人员还将与长期的行业合作伙伴合作，通过技术转让和其他外展手段将这些努力转化为实际影响。这项工作的总体目标是通过开发打败网络攻击的实时监控技术，显著提高嵌入式和网络化计算设备的网络安全性。该项目假设这些设备可以通过一种新型的恶意软件检测方法来增强，这种方法依赖于这些设备的细粒度定时信息。前提是嵌入式设备受制于具有软甚至硬实时约束的控制系统。因此，这种控制代码在嵌入式设备上的执行路径遵循严格和可预测的行为，可以通过时序分析来表征。一旦确定了执行路径上的时间上限，这些信息不仅有助于验证时间约束，而且还可以用来检测与已认证的时间行为的偏差。因此，基于时间的恶意软件检测为不间断的系统完整性提供了一种手段。更重要的是，它可以在早期入侵检测点触发转换到安全操作模式，以防止异常行为升级。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Today, embedded devices are ubiquitous. These devices are inherently networked, which exposes them to malware attacks. Windows devices remain the most prominent targets of malware attacks to date. But this playing field is quickly changing, as demonstrated with firmware attacks to private access points or closed-circuit television cameras. Other intrusions to industrial and governmental infrastructure have been reported in the power grid, for industrial control and automotive systems, even in small devices in private homes that are networked, often referred to as the Internet-of-Things. As our daily lives increasingly rely on such devices, malware attacks pose a severe risk. Yet, limited computational capabilities constrain embedded security measures. Even worse, execution of malware code in control systems may result in a time lag of control actions. Such delays may result in property damage, catastrophic failures and even lost lives. Hence, the effect of malware on not just system functionality but also timings is critical.This project will reshape the landscape of protection for networked control devices as novel timing-based protection mechanisms across the entire software stack will complement traditional cybersecurity methods to significantly enhance safety and reliability. The investigator will promote participation of students from under-represented groups, with emphasis on educating and training PhD students from these groups. The investigator will also work with long-term industry partners to turn these efforts into practical impact through transfer of techniques and other means of outreachThe overall objective of this work is to significantly increase cyber security across embedded and networked computing devices by developing real-time monitoring techniques that defeat cyber-attacks. The project hypothesizes that these devices can be enhanced by a novel class of malware detection approaches that rely on fine-grained timing information of such devices. The premise is that embedded devices are subject to control systems with soft or even hard real-time constraints. The execution path of such control code on embedded devices thus follows a stringent and predictable behavior, which can be characterized by timing analysis. Once upper bounds on timings along execution paths are established, this information not only aids in the verification of timing constraints, but it can also be exploited to detect deviations from the certified timing behavior. Timing-based malware detection thus provides a means for non-stop system integrity. What is more, it can be used to trigger transitions into a safe operating mode at an early intrusion detection point to prevent anomalous behavior from escalating.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.