We propose a framework for security vulnerability analysis for Cyber-Physical Systems (CPS). Our framework imposes only minimal assumptions on the structure of the CPS. Namely, we consider CPS with feedback control loops, state observers, and anomaly detection algorithms. Moreover, our framework does not require any knowledge about the dynamics or the algorithms used in the CPS. Under this common CPS architecture, we develop tools that can identify vulnerabilities in the system and their impact on the functionality of the CPS. We pose the CPS security problem as a falsification (or Search Based Test Generation (SBTG)) problem guided by security requirements expressed in Signal Temporal Logic (STL). We propose two different categories of security requirements encoded in STL: (1) detectability (stealthiness) and (2) effectiveness (impact on the CPS function). Finally, we demonstrate in simulation on an inverted pendulum and on an Unmanned Aerial Vehicle (UAV) that both specifications are falsifiable using our SBTG techniques.

In the paper titled " Stealthy attacks formalized as STL formulas for Falsification of CPS Security", we investigate a broad class of attacks on the sensor and actuation blocks in the form of additive perturbation that impacts the measurement and control, respectively. In this demo, we demonstrate the usage of our framework and the underlying technologies along with a case study on aviation systems using Microsoft Flight Simulator (MSFS).

Requirements-driven search-based testing (SBT), also known as falsification, has proven to be a practical and effective method for discovering erroneous behaviors in Cyber-Physical Systems. However, SBT techniques do not provide guarantees on correctness if no falsifying behavior is found within the test budget. Hence, the applicability of SBT methods for evidence generation supporting assurance cases is limited. In this work, we make progress towards developing finite-time guarantees for SBT techniques with associated confidence metrics. We demonstrate the applicability of our approach to the F16 GCAS benchmark challenge.