Modern vehicles are governed by a network of Electronic Control Units (ECUs), which are programmed to sense inputs from the driver and the environment, to process these inputs, and to control actuators that, e.g., regulate the engine or even control the steering system. ECUs within a vehicle communicate via automotive bus systems such as the Controller Area Network (CAN), and beyond the vehicles boundaries through upcoming vehicle-to-vehicle and vehicle-to-infrastructure channels. Approaches to manipulate the communication between ECUs for the purpose of security testing and reverse-engineering of vehicular functions have been presented in the past, all of which struggle with automating the detection of system change in response to message injection. In this paper we present our findings with fuzzing CAN networks, in particular while observing individual ECUs with a sensor harness. The harness detects physical responses, which we then use in a oracle functions to inform the fuzzing process. We systematically define fuzzers, fuzzing configurations and oracle functions for testing ECUs. We evaluate our approach based on case studies of commercial instrument clusters and with an experimental framework for CAN authentication. Our results show that the approach is capable of identifying interesting ECU states with a high level of automation. Our approach is applicable in distributed cyber-physical systems beyond automotive computing.

中文翻译：

---

汽车控制单元的自动模糊测试

现代车辆由电子控制单元（ECU）网络控制，该网络经过编程可感应驾驶员和环境的输入，处理这些输入并控制执行器，例如，调节引擎甚至控制转向系统。车辆中的ECU通过诸如控制器局域网（CAN）之类的汽车总线系统进行通信，并通过即将到来的车辆到车辆和车辆到基础设施通道超越车辆边界。过去已经提出了为了安全测试和车辆功能的逆向工程而操纵ECU之间的通信的方法，所有这些方法都难以响应消息注入而自动检测系统变化。在本文中，我们通过模糊的CAN网络展示了我们的发现，特别是在使用传感器线束观察各个ECU的同时。该工具检测物理响应，然后我们在oracle函数中使用它来通知模糊处理。我们为测试ECU系统地定义了模糊器，模糊配置和oracle函数。我们基于商业仪器集群的案例研究以及用于CAN身份验证的实验框架来评估我们的方法。我们的结果表明，该方法能够以高度自动化程度识别有趣的ECU状态。我们的方法适用于汽车计算以外的分布式网络物理系统。模糊配置和用于测试ECU的oracle功能。我们基于商业仪器集群的案例研究以及用于CAN身份验证的实验框架来评估我们的方法。我们的结果表明，该方法能够以高度自动化程度识别有趣的ECU状态。我们的方法适用于汽车计算以外的分布式网络物理系统。模糊配置和用于测试ECU的oracle功能。我们基于商业仪器集群的案例研究以及用于CAN身份验证的实验框架来评估我们的方法。我们的结果表明，该方法能够以高度自动化程度识别有趣的ECU状态。我们的方法适用于汽车计算以外的分布式网络物理系统。