Cross-Abstraction Artifacts to Detect Adverse Manipulation

Abstract

As cyber-physical systems (CPS) such as aircraft and autonomous vehicles become increasingly intertwined with critical infrastructure and software, ensuring the security posture of their underlying hardware components and software programs is of paramount importance. Cyber-physical systems integrate computational processes with physical entities, presenting unique challenges because of the dual exposure to both cyber threats, such as vulnerability exploitation, and physical threats, such as counterfeit components. This dissertation introduces a multi-faceted approach to enhance the security and assurance of CPS by leveraging artifacts at three abstraction levels: physical components, software binaries, and software source code.

First, we introduce a method for unique component identification using electromechanical impedance, providing a mechanism to authenticate and verify the integrity of physical components within a CPS and mitigate the use of undetected counterfeit components in the construction of safety-critical systems.

Second, we introduce a technique to analyze evasive malware binaries by strategically configuring virtual machines that do not expose artifacts detected by a malicious program. We develop a dynamic analysis pipeline that uses optimal virtual machine configurations to faithfully execute evasive malware samples, enabling the collection of execution traces to inform the development of defensive measures.

Third, we introduce a novel approach to vulnerability prediction in software source code by employing augmented Abstract Syntax Trees (AST) and Large Language Model (LLM) text embeddings to capture syntactic and semantic nuances of engineered software. Taken together, these features comprise the input to a lightweight Transformer model that predicts vulnerabilities in individual functions of software source code to minimize the frequency of vulnerabilities found in software.