Authors:
Kazutaka Matsuzaki
1
and
Shinichi Honiden
2
Affiliations:
1
Faculty of Global Informatics, Chuo University, Tokyo, Japan
;
2
Faculty of Science and Engineering, Waseda University, Tokyo, Japan
Keyword(s):
Industrial Control Systems, Pseudo-Greybox Fuzzing, Maintenance Testing, Security Diagnostics, Stateful Protocol Fuzzer, Network Fuzzer, ICS Monitoring.
Abstract:
This paper presents a novel Pseudo-Greybox Fuzzer (pseudo-GBF) methodology designed to improve the security diagnosis of Industrial Control Systems (ICS) during maintenance testing. The proposed method combines stateful protocol fuzzing, network fuzzing, and ICS monitoring to optimize the coverage of state transitions in the system under test (SUT) while operating within the constraints of on-site maintenance testing. Pseudo-GBF enhances security testing by utilizing replayable seeds to trigger specific state transitions, enabling efficient and practical testing. By incorporating Pseudo-Greybox Fuzzing during maintenance testing, the methodology addresses the challenges faced in ICS security diagnostics, leading to improved security and resilience of critical infrastructure systems. This paper provides a comprehensive overview of the system design, including integrating stateful protocol fuzzing, network fuzzing, and ICS monitoring, demonstrating its potential to advance ICS security
testing.
(More)