This project developed new techniques to analyze the security of complex cyber-physical systems, with a special focus on automobile and aircraft systems. Project researchers used these techniques to expose the software mechanism used by Volkswagen and Fiat to evade diesel emissions tests, making their vehicle appear to produce fewer harmful emissions that they do in real-world driving conditions. Project researchers produced the first public technical description of the defeat devices used in these two makes of vehicles. Results of this work were used to regulators in the US and other jurisdictions to understand how these defeat devices worked, how to identify them, and what effect they have on emissions.

One of things that makes cyber-physical systems difficult to test for vulnerabilities is that the software is designed to operate in a specific environment, where it "talks" to sensors, actuators, and other information systems. To test how such systems might behave under attack, researchers need to be able to simulate the target system's operating environment. This project has developed two kinds of techniques to make this possible.

First, the project developed a physical testbed and a set of software tools for testing aircraft systems for security vulnerabilities, which the team uses to test commercial aircraft systems. The testbed simulates a realistic aircraft environment (from the point of view of a particular system under test) and allows researchers to test what-if cyber-attack scenarios and understand how aircraft systems would respond to potential cyber-attacks.

Second, the project also developed new analysis techniques for testing complex cyber-physical systems for security vulnerabilities, which are being used on systems ranging from aircraft to power grid components. These techniques use information implicitly present in the software of a system to infer how the hardware of the system needs to behave for the software to work correctly. This allows researchers to automatically create a hardware environment that behaves the way the software expects, and this makes it possible to use certain advanced testing and analysis techniques on the software to check for security vulnerabilities.

Third, project personnel participated in the first Aviation Village at DEFCON 2019, the premier industry security conference. By participating in both industry venues as well as academic venues, we introduced some of the challenges in aviation security to a broader set of researchers than if we had focused exclusively on traditional academic conferences. We plan to continue our participation in 2020.

Fourth, the project has provided training to a large group of undergraduate, masters, and doctoral students at UC San Diego, the University of Illinois, the University of Illinois at Chicago, and Oberlin College. The project has led to an exchange of students where undergraduates at the University of Illinois and UC San Diego have graduated and are now pursuing Ph.D.s at the other institution while continuing to work on the project.

Finally, project personnel have provided technical guidance to Boeing, Pacific Northwest National Laboratories, and the Department of Homeland Security on matters of aviation cyber-security.

Last Modified: 05/25/2020
Modified by: Kirill Levchenko