Metasploit for Cyber-Physical Security Testing with Real-Time Constraints

被引:1
作者
Shrestha, Sulav Lal [1 ]
Lee, Taylor [1 ]
Fischmeister, Sebastian [1 ]
机构
[1] Univ Waterloo, Waterloo, ON, Canada
来源
SCIENCE OF CYBER SECURITY, SCISEC 2022 | 2022年 / 13580卷
关键词
Cyber-physical systems; Security; Controller area network;
D O I
10.1007/978-3-031-17551-0_17
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
Metasploit is a framework for cybersecurity testing. The Metasploit Framework provides the Hardware Bridge API to enable security testing of cyber-physical systems. Cyber-physical systems and tests/attacks on the systems are subject to real-time constraints. Hence, this research aims to study the timing characteristics of tests implemented using the framework. Several factors, such as the programming language used to write tests, overhead added by the framework, scheduling policies etc., affect the latency and jitter. This paper considers the Controller Area Network used in automotive systems to study the effect of those factors on the timing characteristics. The study evaluates (i) latency and jitter for transmission and reception of the messages in the network and (ii) the jitter in the periodicity in periodic transmission of messages. Based on the results, the study determines the best combination of the factors to minimize the latency and jitter in the tasks considered. The paper performs a case study on actual tests/attacks subject to real-time constraints and analyses the suitability of executing the tests using Metasploit. The study analyses the performance of tasks implemented as Metasploit modules and shows how choices of some factors can significantly improve the temporal characteristics without modifying the Metasploit Framework. The experimental results show some interesting findings related to Ruby and the Metasploit Framework.
引用
收藏
页码:260 / 275
页数:16
相关论文
共 50 条
[41]   Continuous-Time Computational Aspects of Cyber-Physical Security [J].
Green, Sam ;
Cicek, Ihsan ;
Koc, Cetin Kaya .
2016 WORKSHOP ON FAULT AND TOLERANCE IN CRYPTOGRAPHY (FDTC), 2016, :59-62
[42]   Cyber-Security Incidents: A Review Cases in Cyber-Physical Systems [J].
Al-Mhiqani, Mohammed Nasser ;
Ahmad, Rabiah ;
Yassin, Warusia ;
Hassan, Aslinda ;
Abidin, Zaheera Zainal ;
Ali, Nabeel Salih ;
Abdulkareem, Karrar Hameed .
INTERNATIONAL JOURNAL OF ADVANCED COMPUTER SCIENCE AND APPLICATIONS, 2018, 9 (01) :499-508
[43]   Modeling security in cyber-physical systems [J].
Burmester, Mike ;
Magkos, Ernmanouil ;
Chrissikopoulos, Vassilis .
INTERNATIONAL JOURNAL OF CRITICAL INFRASTRUCTURE PROTECTION, 2012, 5 (3-4) :118-126
[44]   A Survey on Cyber-Physical Systems Security [J].
Yu, Zhenhua ;
Gao, Hongxia ;
Cong, Xuya ;
Wu, Naiqi ;
Song, Houbing Herbert .
IEEE INTERNET OF THINGS JOURNAL, 2023, 10 (24) :21670-21686
[45]   CyPhERS: A cyber-physical event reasoning system providing real-time situational awareness for attack and fault response [J].
Mueller, Nils ;
Bao, Kaibin ;
Matthes, Jorg ;
Heussen, Kai .
COMPUTERS IN INDUSTRY, 2023, 151
[46]   A Stream Learning Approach for Real-Time Identification of False Data Injection Attacks in Cyber-Physical Power Systems [J].
Hallaji, Ehsan ;
Razavi-Far, Roozbeh ;
Wang, Meng ;
Saif, Mehrdad ;
Fardanesh, Bruce .
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, 2022, 17 :3934-3945
[47]   Security Games for Cyber-Physical Systems [J].
Vigo, Roberto ;
Bruni, Alessandro ;
Yuksel, Ender .
SECURE IT SYSTEMS, NORDSEC 2013, 2013, 8208 :17-32
[48]   Security Synthesis for Cyber-Physical Systems [J].
Li, Jitao ;
Wang, Zhenhua ;
Shen, Yi ;
Xie, Lihua .
IEEE TRANSACTIONS ON SYSTEMS MAN CYBERNETICS-SYSTEMS, 2023, 53 (02) :1027-1037
[49]   Security in Cloud-based Cyber-physical Systems [J].
Puttonen, Juha ;
Afolaranmi, Samuel Olaiya ;
Moctezuma, Luis Gonzalez ;
Lobov, Andrei ;
Lastra, Jose L. Martinez .
2015 10TH INTERNATIONAL CONFERENCE ON P2P, PARALLEL, GRID, CLOUD AND INTERNET COMPUTING (3PGCIC), 2015, :671-676
[50]   Intelligent Security Measures for Smart Cyber-Physical Systems [J].
Shafique, Muhammad ;
Khalid, Faiq ;
Rehman, Semeen .
2018 21ST EUROMICRO CONFERENCE ON DIGITAL SYSTEM DESIGN (DSD 2018), 2018, :280-287