There are already a number of cybersecurity activities introduced in the development process in the automotive industry. For example, security testing of automotive components is often performed at the late stages of development. Fuzz testing is often performed as part of the security testing activity. However, since testing occurs late in the development process, it is expensive and, in some cases, may be too late to fix certain identified issues. Another challenge is that some testing requires hardware that is costly and may not be available until late in the development. We suggest fuzz testing virtual ECUs, which overcomes these challenges and allows for more efficient and effective security testing. By incorporating fuzz testing of virtual electronic control units (ECUs) into the overall test platform, automotive companies can employ a continuous security testing approach that enables the organization to shift left to identify and fix vulnerabilities earlier in the software development life cycle. We explain an approach to performing fuzz testing of virtual ECUs as part of the continuous security process. To this end, we present a test setup for fuzz testing virtual ECUs and give an example of a prototype consisting of a Fuzz Testing Tool integrated with a software-in-the-loop (SiL) Tool. We describe methods for testing the upper layers of the ECU software, and as an example, we discuss results from fuzz testing a diagnostics services implementation on a virtual ECU. To highlight the benefits of fuzz testing virtual ECUs, we give an overview of a test platform architecture that allows for continuous security testing, including various types of security testing, of automotive components earlier in the software development life cycle. By using virtual ECUs in this test platform architecture, it is possible to perform fuzz testing earlier without the need for hardware, as well as perform testing in parallel to improve scalability. Moreover, since the usage of virtual ECUs allows for accessing the internals of the target system, it is possible to enable more intricate instrumentation of the target software to help detect exceptions on the ECU. Finally, besides using fuzz testing tools in the test platform architecture for continuous security testing, organizations can use static application security testing (SAST) and software composition analysis (SCA) tools in the continuous integration (CI) step to identify issues in the embedded software at an early stage.


    Access

    Check access

    Check availability in my library

    Order at Subito €


    Export, share and cite



    Title :

    Fuzz Testing Virtual ECUs as Part of the Continuous Security Testing Process


    Additional title:

    Sae Int. J. Transp. Cyber. and Privacy


    Contributors:


    Publication date :

    2020-08-18


    Size :

    10 pages




    Type of media :

    Conference paper


    Type of material :

    Print


    Language :

    English




    Testing networked ECUs in a virtual car environment

    Ploeger,M. / Sauer,J. / Buedenbender,M. et al. | Automotive engineering | 2004


    Testing Networked ECUs in a Virtual Car Environment

    Ploger, M. / Sauer, J. / Budenbender, M. et al. | British Library Conference Proceedings | 2004


    Testing networked ECUs in a virtual car environment

    Caraceni,A. / Costanzo,F. / de Manes,M. et al. | Automotive engineering | 2004


    Testing Networked ECUs in a Virtual Car Environment

    Montieri, A. / Costanzo, F. / Ferrara, F. et al. | SAE Technical Papers | 2004


    Effective bench testing of ECUs

    Aitchison,K. / Goody,K. / Pi Technol.,GB | Automotive engineering | 2000