Search

Coverage-guided grey-box fuzzing for computer systems has been explored for decades. However, existing techniques do not adequately explore the space of continuous behaviors in Cyber-Physical Systems (CPSs), which may miss safety-critical bugs. Optimization-guided falsification is promising to find violations of safety specifications, but not suitable for identifying traditional program bugs. This article presents a fuzzing process for finding safety violations at the development phase, which is guided by two quantities: a branch coverage metric to explore discrete program behaviors and a Linear Temporal Logic (LTL) robust satisfaction metric to identify undesirable continuous plant behaviors. We implement CPFuzz to demonstrate the utility of the idea and estimate its effectiveness on seven control system benchmarks. The results show up to a better performance in average time to find violations on all benchmarks than S-TaLiRo and six benchmarks than S3CAMX. Finally, we exploit CPFuzz to synthesize the sensor spoofing attack on a DC motor with fixed-point overflow vulnerability as a case study.

This paper investigates physical layer security of cooperative NOMA in a severe scenario where there is no direct link from the source to far destination while the direct link between the eavesdropper and source exists. An energy harvesting (EH) jammer aided cooperative NOMA (namely EJCN) scheme is proposed to enable secure communications for the scenario. In particular, the EH jammer can opportunistically harvest energy from ambient radio frequency (RF) signals without occupying special time and power resources, and the harvested energy is exploited to emit the artificial noise (AN) for confusing the eavesdropper. The closed-form expressions of secrecy throughput achieved by the EJCN scheme are derived to evaluate the secrecy performance for the scenario. An iterative algorithm is presented to obtain the optimal codeword rate. The analysis and simulation results show that the EJCN scheme can achieve better secrecy performance than conventional transmission scheme without an EH jammer, indicating the superiority of the proposed scheme. In addition, the codeword rate of users should be carefully designed to maximize the secrecy throughput.

Vulnerability of various machine learning methods to adversarial examples has been recently explored in the literature. Power systems which use these vulnerable methods face a huge threat against adversarial examples. To this end, we first propose a more accurate and computationally efficient method called Adaptive Normalized Attack (ANA) to attack power systems using generate adversarial examples. We then adopt adversarial training to defend against attacks of adversarial examples. Experimental analyses demonstrate that our attack method provides less perturbation compared to the state-of-the-art FGSM (Fast Gradient Sign Method) and DeepFool, while our proposed method increases misclassification rate of learning methods for attacking power systems. In addition, the results show that the proposed adversarial training improves robustness of power systems to adversarial examples compared to using state-of-the-art methods.

In this paper, a two-way amplify-and-forward (AF) energy harvesting (EH) relaying system with the presence of co-channel interference (CCI) is studied. Firstly, a lower bound of outage probability is developed, which is shown to be very tight over the entire signal-to-noise ratio (SNR) regions. Then, a simple and informative high-SNR outage approximation is derived, indicating that the outage probability decays as ρ-1lnρ s , with ρ s being the transmit SNR. Based on this high-SNR approximation, the optimal power splitting (PS) factor minimizing the system outage probability is characterized. Analytical results manifest that the optimal PS factor is irrelevant to the CCI and is an increasing function with respect to ρ s . In addition, it is numerically shown that the optimal PS factor is a decreasing function of the energy conversion efficiency. Finally, all the analytical results are validated through Monte-Carlo simulations.