CNS Core: Small: Collaborative Research: Scalable Penetration Test Generation for Automotive Systems

该项目为现代汽车系统的安全验证开发了一个全面的框架。随着自动化程度的提高，汽车系统正在演变成非常复杂的分布式系统。 它们包含一百多个电子控制单元（ECU），传感器和执行器的异构集合，几个车载通信网络和几百兆字节的软件。 目前，这些系统的安全验证主要依赖于人类的专业知识来识别设计和实现中的漏洞。 显然，这并不能扩展到大型复杂系统。该项目通过引入能够处理爆炸式汽车系统复杂性的自动渗透测试方法来解决这个问题。该项目开发技术，用于系统分析当前和紧急车辆的各种安全性，安全性和可靠性要求。 它使人们能够尽早理解不同需求之间的冲突、权衡和潜在的内部不一致。该框架包括：（1）自适应虚拟原型基础设施，可实现ECU、传感器和执行器模型的平滑集成;以及（2）concolic测试设施，可为目标对手模型自动生成渗透测试。在研究中开发的分析技术横切硬件，软件和物理（感官和精算）文物。 该框架汇集了目前在安全，机器智能和决策科学方面的不同研究。该项目有望通过大幅提高各种网络物理系统（特别是汽车系统）的安全性、可靠性和可靠性，产生变革性的技术和社会影响。 研究成果将纳入研究生和本科生课程。 将引入一个新的研讨会，汇集汽车安全，安全性和可靠性以及跨领域的专家。将使用汽车模拟器平台开发针对本科生和高中生的实践培训模块。 将积极鼓励代表性不足的学生参与该项目。将利用并积极寻求行业联系进行技术转让。该项目过程中产生的所有工件和数据将公开提供，使更广泛的社区能够复制和扩展研究成果。这包括开发的所有软件和工具，架构和平台模型，以及支持研究结论的任何实验数据。为了传播这一信息，在网址www.example.com上建立了一个公共资料库，并将在授标期后至少维持三年。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This project develops a comprehensive framework for security validation of modern automotive systems. With increasing autonomy, automotive systems are evolving into very complex distributed systems. They contain more than a hundred electronic control units (ECU), a heterogeneous collection of sensors and actuators, several in-vehicle communication networks, and several hundred megabytes of software. Currently security validation of these systems depends primarily on human expertise to identify vulnerabilities in design and implementation. Clearly this does not scale to large complex systems. The project addresses this problem by introducing automated penetration testing methods capable of handling the exploding automotive system complexities. This project develops technology for systematic analysis of diverse safety, security, and reliability requirements in current and emergent vehicles. It enables early comprehension of conflict, trade-offs, and potential internal inconsistencies among the different requirements. The framework includes: (1) an adaptive virtual prototyping infrastructure that enables smooth integration of ECU, sensor, and actuator models; and (2) a concolic testing facility to generate penetration tests automatically for targeted adversary models. The analysis techniques developed in the research cross-cut hardware, software, and physical (sensory and actuarial) artifacts. The framework brings together currently disparate research in security, machine intelligence, and decision science. This project promises transformative technical and societal impacts through drastically improved safety, security, and reliability of diverse cyber-physical systems in general and automotive systems in particular. Research results will be integrated into graduate and undergraduate courses. A new workshop will be introduced to bring together experts in automotive safety, security, and reliability, and cross-cutting areas. Hands-on training modules for undergraduate and high school students will be developed using automotive simulator platforms. Participation of underrepresented students in the project will be actively encouraged. Industry connections will be used and actively pursued for technology transfer.All artifacts and data generated during the course of this project will be made publicly available, enabling the broader community to reproduce and extend research results. This includes all software and tools developed, architecture and platform models, and any experimental data supporting the research conclusions. A public repository has been set up at the URL https://github.com/RaySandip/AutoSec19.git for this dissemination, and will be maintained for at least three years beyond the award period. Backup copies of the data is expected to be retained indefinitely.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.