Rigorous testing methods are essential for ensuring the security and reliability of industrial controller software. Fuzzing, a technique that automatically discovers software bugs, has also proven effective in finding software vulnerabilities. Unsurprisingly, fuzzing has been applied to a wide range of platforms, including programmable logic controllers (PLCs). However, current approaches, such as coverage-guided evolutionary fuzzing implemented in the popular fuzzer American Fuzzy Lop Plus Plus (AFL++), are often inadequate for finding logical errors and bugs in PLC control logic applications. They primarily target generic programming languages like C/C++, Java, and Python, and do not consider the unique characteristics and behaviors of PLCs, which are often programmed using specialized programming languages like Structured Text (ST). Furthermore, these fuzzers are ill suited to deal with complex input structures encapsulated in ST, as they are not specifically designed to generate appropriate input sequences. This renders the application of traditional fuzzing techniques less efficient on these platforms. To address this issue, this paper presents a fuzzing framework designed explicitly for PLC software to discover logic bugs in applications written in ST specified by the IEC 61131-3 standard. The proposed framework incorporates a custom-tailored PLC runtime and a fuzzer designed for the purpose. We demonstrate its effectiveness by fuzzing a collection of ST programs that were crafted for evaluation purposes. We compare the performance against a popular fuzzer, namely, AFL++. The proposed fuzzing framework demonstrated its capabilities in our experiments, successfully detecting logic bugs in the tested PLC control logic applications written in ST. On average, it was at least 83 times faster than AFL++, and in certain cases, for example, it was more than 23,000 times faster.

Ensuring the security and safety of a real-time operating system (RTOS) is crucial for protecting against potential cyber-attacks. A robust system can provide reliable and uninterrupted operations in the system as well as protect sensitive data and critical functions. To help programmers develop robust programs and systems, multiple secure coding standards have been developed by different organizations. These coding standards offer guidelines for writing secure code to eliminate vulnerabilities and prevent undefined behaviors from happening. The goal of this research is to understand whether several free common RTOSs follow these secure coding standards. We chose MISRA-C:2012 for our experiment because it is a widely recognized coding standard specifically designed for the safe use of the C programming language in critical systems. To investigate whether existing RTOSs adhere to MISRA-C:2012, we utilized a static code analysis tool, Cppcheck, to analyze 16 open-source RTOSs (written in C) for compliance with 153 rules in MISRA-C: 2012. The results indicate that most of the RTOSs conform to mandatory rules of MISRA-C. However, quite a few of the required rules are still violated by many of the RTOSs. Some of the violated rules can potentially result in critical issues in the RTOSs, but most of them can be avoided by simply writing better and safer C code. This paper discusses the major issues in the implementation of RTOSs found in our experiment. The analysis of the results will help programmers and researchers understand the primary concerns inRTOSs’ code and learn how to avoid them by implementing better code.

In the context of Internet of Things (IoT) intelligent systems, the latest research regarding delegation using an access control model has gained attention, reflecting the need for models to support more functionalities in relation to hierarchical delegation. With respect to delegation procedures within access control, issues arise after delegation concerning the permissions to others with respect to revocation. Redundancy and conflict arising from delegation can occur depending on the delegation policies used within the hierarchical structure. This article discusses implementation of positive delegation represented by “YES” and negative delegation represented by “NO”. Furthermore, we also consider permission to delegate positively and negatively represented by (YES and NO). These challenges are addressed by creating additional features in a hierarchical policy model (HPol). The implementation was created using Python (ver. 3.10) code to verify the advantages of the approach, through experimentation under different scenarios. The model also has the capability to manage and adapt features of the Internet of Things (IoT) to a blockchain architecture, enhancing security and verification during the delegation process and increasing the scalability of Internet of Things (IoT) intelligent environment systems.

Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop ("Image missing"). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from $$1.46\times $$ 1.46 × to $$68.53\times $$ 68.53 × for branch conditions, $$1.39\times $$ 1.39 × to $$254.62\times $$ 254.62 × for branch depths, $$14,879.59\times $$ 14 , 879.59 × to $$30,295.88\times $$ 30 , 295.88 × for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from $$12,260\times $$ 12 , 260 × to $$22,856.07\times $$ 22 , 856.07 × over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.

Software testing is an important step in the software development life cycle to ensure the quality and security of software. Fuzzing is a security testing technique that finds vulnerabilities automatically without accessing the source code. We built a fuzzer, called JIMA-Fuzzing, which is an effective fuzzing tool that utilizes grammar detected from sample input. Based on the detected grammar, JIMA-Fuzzing selects a portion of the valid user input and fuzzes that portion. For example, the tool may greatly increase the size of the input, truncate the input, replace numeric values with new values, replace words with numbers, etc. This paper discusses how JIMA-Fuzzing works and shows the evaluation results after testing against the DARPA Cyber Grand Challenge (CGC) dataset. JIMA-Fuzzing is capable of extracting grammar from sample input files, meaning that it does not require access to the source code to generate effective fuzzing files. This feature allows it to work with proprietary or non-open-source programs and significantly reduces the effort needed from human testers. In addition, compared to fuzzing tools guided with symbolic execution or taint analysis, JIMA-Fuzzing takes much less computing power and time to analyze sample input and generate fuzzing files. However, the limitation is that JIMA-Fuzzing relies on good sample inputs and works primarily on programs that require user interaction/input.