Crystal (ball)

Abstract

Recent major attacks against unmanned aerial vehicles (UAV) and their controller software necessitate domain-specific cyber-physical security protection. Existing offline formal methods for (untrusted) controller code verification usually face state-explosion. On the other hand, runtime monitors for cyber-physical UAVs often lead to too-late notifications about unsafe states that makes timely safe operation recovery impossible. We present Crystal, a just-ahead-of-time control flow predictor and proactive recovery for UAVs. Crystal monitors the execution state of the flight controller and predicts the future control flows ahead of time-based on the UAV's physical dynamics. Crystal deploys the operator's countermeasures proactively in case of an upcoming unsafe state. Crystal's just-ahead-of-time model checking explores the future control flows in parallel ahead of the UAV's actual operation by some time margin. The introduced time margin enables Crystal to accommodate operator's feedback latency by the time the actual execution reaches to the identified unsafe state. Crystal periodically queries the controller's execution state. It emulates the UAV physical dynamical model and predicts future sensor measurements (controller inputs) and upcoming feasible controller's execution paths. This drives Crystal's model-checking exploration away from unreachable future states. Crystal's selective model checking saves computational time to stay ahead of execution by concentrating on relevant upcoming control flows only. This eliminates the state-explosion problem in traditional offline formal methods. We evaluated a multi-threaded prototype of Crystal between the control station server and the UAV. Crystal was able to predict upcoming hazardous states caused by the thirdparty controller program and proactively restored the safe states successfully with minimal overhead.

Hardware/Software frameworks for control techniques to support real-time systems and runtime verification

“…Many have recognized the necessity of prediction in RV, though the context widely varies. Several works consider prediction of untimed properties through static analysis of the system's code or model checking [68,141,35]. Offline runtime verification via comparing runs with models has successfully reduced the size and increased the accuracy of model-checking models [143].…”

“…If the system model is only partially known, or even considered as a black box, the approximate system behavior can be learned using Neural Network, or Markov Model approaches. As in [35], Etigowni et al train a neural network model of Unmanned Aerial Vehicle (UAV), and use it to predict sensor values under abnormal conditions. In [8], they abstract the target into a Hidden Markow Model and infer the model during prediction.…”

“…For this case, each future path would want to be verified. The works of [141,101,35,8] take into account multiple possible future paths. In this case, the computation complexity of the predictive RV trends closer to that of model checking [101], which is typically infeasible to compute in real-time.…”

“…In this case, the computation complexity of the predictive RV trends closer to that of model checking [101], which is typically infeasible to compute in real-time. For example, a tool called CRYSTAL [35] implements predictive RV on an embedded platform but is limited to verifying software via symbolic execution. To improve the speed, they need to reuse the outdated prediction result.…”

“…A closely related work to MR-MPRV is in [35], where they proposed a predictive RV tool named "Crystal". Crystal conducts the predictive runtime verification by exploring the feasible execution paths constructed from the controller code.…”