CNS Core: Small: Collaborative Research: Scalable Penetration Test Generation for Automotive Systems

该项目为现代汽车系统的安全验证开发了一个全面的框架。随着自动化程度的提高，汽车系统正在演变成非常复杂的分布式系统。它们包含一百多个电子控制单元（ECU），传感器和执行器的异构集合，几个车载通信网络和几百兆字节的软件。目前，这些系统的安全验证主要依赖于人类的专业知识来识别设计和实现中的漏洞。显然，这并不适用于大型复杂系统。该项目通过引入能够处理爆炸性汽车系统复杂性的自动化渗透测试方法来解决这个问题。该项目开发了一种技术，用于系统分析当前和紧急车辆的各种安全、保障和可靠性要求。它使人们能够早期理解不同需求之间的冲突、权衡和潜在的内部不一致。该框架包括：(1)自适应虚拟样机基础设施，可实现ECU、传感器和执行器模型的顺利集成；(2)为目标对手模型自动生成渗透测试的集成测试设备。在研究中开发的分析技术横切硬件、软件和物理（感觉和精算）工件。该框架汇集了目前在安全、机器智能和决策科学方面的不同研究。该项目通过大幅提高各种网络物理系统（特别是汽车系统）的安全性、安全性和可靠性，有望带来变革性的技术和社会影响。研究成果将整合到研究生和本科课程中。将引入一个新的研讨会，汇集汽车安全、安全、可靠性和交叉领域的专家。将利用汽车模拟器平台开发面向本科生和高中生的动手训练模块。将积极鼓励代表性不足的学生参与该项目。积极利用行业联系促进技术转让。在这个项目过程中产生的所有工件和数据都将公开提供，使更广泛的社区能够复制和扩展研究结果。这包括所有开发的软件和工具，架构和平台模型，以及支持研究结论的任何实验数据。已在网址https://github.com/RaySandip/AutoSec19.git建立了一个公共资料库，以供分发，并将在奖励期后至少维持三年。预计数据的备份副本将无限期保留。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This project develops a comprehensive framework for security validation of modern automotive systems. With increasing autonomy, automotive systems are evolving into very complex distributed systems. They contain more than a hundred electronic control units (ECU), a heterogeneous collection of sensors and actuators, several in-vehicle communication networks, and several hundred megabytes of software. Currently security validation of these systems depends primarily on human expertise to identify vulnerabilities in design and implementation. Clearly this does not scale to large complex systems. The project addresses this problem by introducing automated penetration testing methods capable of handling the exploding automotive system complexities. This project develops technology for systematic analysis of diverse safety, security, and reliability requirements in current and emergent vehicles. It enables early comprehension of conflict, trade-offs, and potential internal inconsistencies among the different requirements. The framework includes: (1) an adaptive virtual prototyping infrastructure that enables smooth integration of ECU, sensor, and actuator models; and (2) a concolic testing facility to generate penetration tests automatically for targeted adversary models. The analysis techniques developed in the research cross-cut hardware, software, and physical (sensory and actuarial) artifacts. The framework brings together currently disparate research in security, machine intelligence, and decision science. This project promises transformative technical and societal impacts through drastically improved safety, security, and reliability of diverse cyber-physical systems in general and automotive systems in particular. Research results will be integrated into graduate and undergraduate courses. A new workshop will be introduced to bring together experts in automotive safety, security, and reliability, and cross-cutting areas. Hands-on training modules for undergraduate and high school students will be developed using automotive simulator platforms. Participation of underrepresented students in the project will be actively encouraged. Industry connections will be used and actively pursued for technology transfer.All artifacts and data generated during the course of this project will be made publicly available, enabling the broader community to reproduce and extend research results. This includes all software and tools developed, architecture and platform models, and any experimental data supporting the research conclusions. A public repository has been set up at the URL https://github.com/RaySandip/AutoSec19.git for this dissemination, and will be maintained for at least three years beyond the award period. Backup copies of the data is expected to be retained indefinitely.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.