SCADA Security | SCADA Testing | Process Control Security

The automated generation of test data for the purposes of software validation and verification has been a major aim of testing research [6]. Path-oriented methods, data flow methods, random testing, adaptive testing, and syntax-based testing are a few of the methods employed for this task.

Syntax-based testing tools process a description of the desired test data expressed in notation such as Backus Naur Form (BNF). Given the test data syntax these tools generate test sets which satisfy the syntax. A major problem in syntax-based testing is respecting contextual dependencies. Solutions include the use of dynamic syntax, addition of rules to test data syntax during test data generation, and attributed grammars, grammars whose definition is overloaded with attributes.

In attribute grammars, the attributes represent contextual information associated with terminals and non-terminals. Attribute grammars can solve the test oracle problem as the contextual information can allow for the production of test data along with the output expected from the DUT. Hence, attribute grammars can also solve the problem of generating semantically meaningful sequences of PDU's, i.e., PTS’s.

blackPeer is an attribute grammar based PTS generator and executor where PTS's are described by an attributed grammar The initial file structure of blackPeer was similar of that employed by Sirer and Bershad [7] and is shown in Figure 1. In this structure, an attribute grammar is passed to the grammar_2_template file which parses the grammar, saving its productions to a template file. The template file is then merged with a tuple file which contains resolutions for each of the templates parameters. The resultant of the merge is a ground file which is passed to an executor. An executor is a program that packages PTS as payloads into the appropriate protocol and sends them to the device under test. The particular executor you employ for a given protocol is always one layer beneath. For example, the executor for a MODBUS/TCP grammar would package PTS in TCP payloads.

Along with the ground file, the executor is passed a configuration file which provides the executor with protocol specifics necessary to communicate with the device under test. For example if the executor employed is an IP executor than the configuration file would contain items such as the device under test's IP address.