Publications

2024

1. IOT

   Detecting Cyber-Attacks Against Cyber-Physical Manufacturing System: A Machining Process Invariant Approach

   Zedong Li, Xin Chen, Yuqi Chen, Shijie Li, Hangyu Wang, Shichao Lv, and Limin Sun

   IEEE Internet of Things Journal, 2024
2. ICSE

   ACAV: A Framework for Automatic Causality Analysis in Autonomous Vehicle Accident Recordings

   Huijia Sun, Christopher M. Poskitt, Yang Sun, Jun Sun, and Yuqi Chen

   In Proceedings of the 46th International Conference on Software Engineering, 2024

   Abs

   The rapid progress of autonomous vehicles (AVs) has brought the prospect of a driverless future closer than ever. Recent fatalities, however, have emphasized the importance of safety validation through large-scale testing. Multiple approaches achieve this fully automatically using high-fidelity simulators, i.e., by generating diverse driving scenarios and evaluating autonomous driving systems (ADSs) against different test oracles. While effective at finding violations, these approaches do not identify the decisions and actions that caused them—information that is critical for improving the safety of ADSs. To address this challenge, we propose ACAV, an automated framework designed to conduct causality analysis for AV accident recordings in two stages. First, we apply feature extraction schemas based on the messages exchanged between ADS modules, and use a weighted voting method to discard frames of the recording unrelated to the accident. Second, we use safety specifications to identify safety-critical frames and deduce causal events by applying CAT—our causal analysis tool—to a station-time graph. We evaluate ACAV on the Apollo ADS, finding that it can identify five distinct types of causal events in 93.64% of 110 accident recordings generated by an AV testing engine. We further evaluated ACAV on 1206 accident recordings collected from versions of Apollo injected with specific faults, finding that it can correctly identify causal events in 96.44% of the accidents triggered by prediction errors, and 85.73% of the accidents triggered by planning errors.

3. POPL

   EasyBC: A Cryptography-Specific Language for Security Analysis of Block Ciphers against Differential Cryptanalysis

   Sun Pu, Song Fu, Yuqi Chen, and Chen Taolue

   ACM SIGPLAN Symposium on Principles of Programming Languages, 2024

2023

1. IOT

   Control Logic Attack Detection and Forensics through Reverse-engineering and Verifying PLC Control Applications

   Yangyang Geng, Xin Che, Rongkuan Ma, Qiang Wei, Mufeng Wang, and Yuqi Chen

   IEEE Internet of Things Journal, 2023
2. TSE

   Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

   Fan Zhang, Qianmei Wu, Xuan Bohan, Yuqi Chen, Wei Lin, Christopher Poskitt, Jun Sun, and Binbin Chen

   IEEE Transactions on Software Engineering, 2023
3. TSE

   Specification-Based Autonomous Driving System Testing

   Yuan Zhou, Yang Sun, Yun Tang, Yuqi Chen, Jun Sun, Christopher M. Poskitt, Yang Liu, and Zijiang Yang

   IEEE Transactions on Software Engineering, 2023
4. ICSE

   Finding Causally Different Tests for an Industrial Control System

   Christopher M. Poskitt, Yuqi Chen, Jun Sun, and Yu Jiang

   In Proceedings of the 45th International Conference on Software Engineering, 2023

   Abs

   Industrial control systems (ICSs) are types of cyber-physical systems in which programs, written in languages such as ladder logic or structured text, control industrial processes through sensing and actuating. Given the use of ICSs in critical infrastructure, it is important to test their resilience against manipulations of sensor/actuator inputs. Unfortunately, existing methods fail to test them comprehensively, as they typically focus on finding the simplest-to-craft manipulations for a testing goal, and are also unable to determine when a test is simply a minor permutation of another, i.e. based on the same causal events. In this work, we propose a guided fuzzing approach for finding ’meaningfully different’ tests for an ICS via a general formalisation of sensor/actuator-manipulation strategies. Our algorithm identifies the causal events in a test, generalises them to an equivalence class, and then updates the fuzzing strategy so as to find new tests that are causally different from those already identified. An evaluation of our approach on a real-world water treatment system shows that it is able to find 106% more causally different tests than the most comparable fuzzer. While we focus on diversifying the test suite of an ICS, our formalisation may be useful for other fuzzers that intercept communication channels.

2022

1. ASE

   LawBreaker: An Approach for Specifying Traffic Laws and Fuzzing Autonomous Vehicles

   Yang Sun, Christopher M. Poskitt, Jun Sun, Yuqi Chen, and Zijiang Yang

   In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, 2022

   Abs

   Autonomous driving systems (ADSs) must be tested thoroughly before they can be deployed in autonomous vehicles. High-fidelity simulators allow them to be tested against diverse scenarios, including those that are difficult to recreate in real-world testing grounds. While previous approaches have shown that test cases can be generated automatically, they tend to focus on weak oracles (e.g. reaching the destination without collisions) without assessing whether the journey itself was undertaken safely and satisfied the law. In this work, we propose LawBreaker, an automated framework for testing ADSs against real-world traffic laws, which is designed to be compatible with different scenario description languages. LawBreaker provides a rich driver-oriented specification language for describing traffic laws, and a fuzzing engine that searches for different ways of violating them by maximising specification coverage. To evaluate our approach, we implemented it for Apollo+LGSVL and specified the traffic laws of China. LawBreaker was able to find 14 violations of these laws, including 173 test cases that caused accidents.

2. IOT

   Defending Cyber–Physical Systems Through Reverse-Engineering-Based Memory Sanity Check

   Yangyang Geng, Yuqi Chen, Rongkuan Ma, Qiang Wei, Jie Pan, Jingyi Wang, Peng Cheng, and Qingxian Wang

   IEEE Internet of Things Journal, 2022

2021

1. ASE

   FIGCPS: Effective Failure-inducing Input Generation for Cyber-Physical Systems with Deep Reinforcement Learning

   Shaohua Zhang, Shuang Liu, Jun Sun, Yuqi Chen, Wenzhi Huang, Jinyi Liu, Jian Liu, and Jianye Hao

   In 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2021
2. IJCIP

   Adversarial attacks and mitigation for anomaly detectors of cyber-physical systems

   Yifan Jia, Jingyi Wang, Christopher M. Poskitt, Sudipta Chattopadhyay, Jun Sun, and Yuqi Chen

   Int. J. Crit. Infrastructure Prot., 2021
3. ESEC/FSE

   Code integrity attestation for PLCs using black box neural network predictions

   Yuqi Chen, Christopher M. Poskitt, and Jun Sun

   In ESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, August 23-28, 2021, 2021

2020

1. ISSTA

   Active fuzzing for testing and securing cyber-physical systems

   Yuqi Chen, Bohan Xuan, Christopher M. Poskitt, Jun Sun, and Fan Zhang

   In ISSTA ’20: 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, USA, July 18-22, 2020, 2020

2019

1. ASE

   Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

   Yuqi Chen, Christopher M. Poskitt, Jun Sun, Sridhar Adepu, and Fan Zhang

   In 34th IEEE/ACM International Conference on Automated Software Engineering, ASE 2019, San Diego, CA, USA, November 11-15, 2019, 2019

2018

1. S&P

   Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System

   Yuqi Chen, Christopher M. Poskitt, and Jun Sun

   In 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA, 2018

2017

1. ICDM

   Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

   Jun Inoue, Yoriyuki Yamagata, Yuqi Chen, Christopher M. Poskitt, and Jun Sun

   In 2017 IEEE International Conference on Data Mining Workshops, ICDM Workshops 2017, New Orleans, LA, USA, November 18-21, 2017, 2017

2016

1. FM

   Towards Learning and Verifying Invariants of Cyber-Physical Systems by Code Mutation

   Yuqi Chen, Christopher M. Poskitt, and Jun Sun

   In FM 2016: Formal Methods - 21st International Symposium, Limassol, Cyprus, November 9-11, 2016, Proceedings, 2016