Work

CNCFuzzer: Directed Black-Box Fuzzing of Computer Numerical Control System Based on Message Behaviour Guidance

Year: 2025

Type: article

Abstract: In the era of the Industrial Internet of Things, Computer Numerical Control (CNC) Systems are confronted with a pervasive threat from attackers. Uncovering their security vulnerabilities before being exploited becomes imperative. Enterprise-level CNC devices often pose significant challenges in obtaining firmware, limiting vulnerability analysis to black-box fuzzing. However, the communication protocols used by CNC devices are characterised by heterogeneity, complexity and proprietary formats. This inherent complexity not only makes it difficult to build high-quality test cases but also significantly exceeds the search space of traditional black-box fuzzing methods, thus reducing their efficiency and effectiveness. In this article, we propose CNCFuzzer, a directed black-box fuzzing approach based on message behaviour guidance. The insights of CNCFuzzer are that if a communication API is high-risk, the probability that other communication APIs with similar behaviour are high-risk increases. First, we design a black-box directed fuzzing method based on the similarity of the behaviour of machining messages. The key to this solution is that we design graphs of message behaviour as the maps for directed fuzzing. Then, a Transformer-based seq2seq model is employed to train a proprietary protocol traffic generator, which generates high-quality test cases that meet protocol formats. Finally, we design a cyber-physical fusion monitor, which observes the current and voltage of the controllers to monitor the vulnerability of CNC devices and proactive network requests to distinguish the functional command injection and memory corruption. We have implemented CNCFuzzer and evaluated it on six enterprise-level CNC devices from three brands. Results show that CNCFuzzer outperforms five existing black-box fuzzing tools and identified 63 previously unknown vulnerabilities, including 30 memory corruption and 33 functional command injection.

Source: ACM Transactions on Software Engineering and Methodology

DOI: 10.1145/3771764