CRV: Automated Cyber-Resiliency Reasoning for System Design Models

We present the design and implementation of an automated static analysis approach and corresponding diagnostic tool, called Cyber Resiliency Verifier (CRV), to check whether a system design satisfies its end-to-end guarantees when the integrity of one or more of its components cannot be guaranteed. CRV’s key insight is to reason about effects of integrity attacks instead of concrete attacks, enabling it to reason also about the impact of future attacks having the same captured effects. We demonstrate CRV’s effectiveness with a case study on a realistic design of an unmanned aerial delivery drone.

我们介绍了一种自动化静态分析方法以及相应的诊断工具（称为网络弹性验证器，CRV）的设计与实现，用于在一个或多个组件的完整性无法保证时，检查系统设计是否满足其端到端的保证。CRV的关键见解是对完整性攻击的影响进行推理，而非具体的攻击，这使其能够对具有相同所捕获影响的未来攻击的影响进行推理。我们通过对一架无人驾驶航空投递无人机的实际设计进行案例研究，证明了CRV的有效性。