AI-powered robotic systems (RS) are increasingly vulnerable to cyber-attacks targeting their software and hardware. To evaluate the risks of successful cyber-attacks, it is necessary to apply various assessment techniques. This study aims to propose a risk-oriented approach to assess the cyber security and safety of the RS and choose countermeasures to prevent critical failures. The proposed approach includes a classification table for complex analytical techniques such as Intrusion (Failure) Modes and Effect Criticality Analysis (I(F)MECA), Attack Tree Analysis (ATA), and Risks and Vulnerabilities assessment (R&VA), as well as experimental methods such as Penetration Testing (PT) and F&VIT (Faults and Variabilities Injection Testing). The approach also involves combining these methods with PT to reduce execution time, improve completeness and trustworthiness, and decrease the costs of assessment. The paper focuses on RS architecture, using a collaborative robot as an example.
Robotic systems (RS) are used daily in manufacturing to increase the efficiency, speed, and accuracy
of production processes. The increasing use of RS obliges manufacturers to prioritize safety and
cybersecurity issues during the development, deployment, and operation of these systems. Safety is a
key factor in the development and use of the RS. These systems can cause serious injuries to workers
in case of malfunction or improper use. In addition to safety risks, cybersecurity is also a critical issue
for RS, especially in cases where the components of these systems are connected to a single network.
RS must be safe and well-protected. If not, they can become dangerous tools capable of causing chaos
and significant harm to their environment and the people they provide services to. [
States.
Indeed, these incidents demonstrate how dangerous compromised or hacked RS can be. Despite the obvious need for ensuring the safety and cybersecurity of the RS, the heterogeneity of these systems, as well as their large numbers and resource constraints, hinder the implementation of powerful security measures.
Moreover, robots powered by AI are being used by industries to bridge the gap between humans and
technology, solve issues, and adapt business strategies to changing customer expectations. Robots with
AI capabilities operate in shared environments to keep employees safe in industrial workplaces.
Additionally, they work independently to complete complicated operations such as cutting, grinding,
welding, and inspection [
AI is playing an increasingly important role in robotics, enabling robots to perform tasks that would
have been impossible or difficult to achieve without it. But the use of AI entails potentially new threats
to RS. For example, AI technologies can be targeted to bypass AI-based threat detection systems. [
The readiness assessment may include an evaluation of potential threats, identification of critical components and processes that need to be protected, and identification of strategies for detecting and recovering RS after an incident.
Safety and cybersecurity testing can be conducted through various analytical and experimental methods, such as penetration testing (PT), risk and vulnerability assessment (R&VA), Attack Tree Analysis (ATA), Intrusion (Failure) Modes, and Effect Criticality Analysis (I(F)MECA) and Variabilities Injection Testing (F&VIT) as well as a combination of these methods to expand the test coverage and improve the quality of testing.
Our study collected and analyzed existing works in the development and use of methods for ensuring the safety and cybersecurity of the RS.
The authors of the article [
The article [
In this paper [
The authors of this informative paper [
In the study [
In addition, the authors of [
Also, in this article [
Previously, we considered the issue of conducting PT of IoT systems in [
This work is the next step in our research in the field of RS penetration testing. The purpose of this study is to develop a comprehensive method for ensuring the safety and cybersecurity of the RS that will provide maximum test coverage, considering the detection of design anomalies of evolution systems and the evolution of sets and types of vulnerabilities at each level of development, deployment, and use of RS.
During our study, we have researched various methods of safety & cybersecurity assessment. These methods’ classification by the type of method is summarized in Table 1. In the safety and cybersecurity field, the analytical method might involve using mathematical models or logical frameworks to identify potential safety or security risks and to develop risk management strategies. For example, an analyst might use attack tree analysis (ATA) to identify potential threats in a safety-critical system and to develop strategies for preventing those threats. The experimental method might involve conducting controlled experiments to evaluate the effectiveness of safety or security measures or to test the performance of safety-critical systems. For example, an experiment might involve possible system vulnerability exploitation (in the context of PT) testing to assess system response to such actions. The analytical-experimental method might involve combining elements of both approaches to develop and test new safety or security technologies or to refine existing ones. For example, an analyst might use data from experiments to refine a mathematical model of a safety-critical system and to identify potential improvements to the system.
Attack Tree Analysis (ATA) provides a formal, methodical way of describing the security of
systems, based on varying attacks. It represents attacks against a system in a tree structure, with the
goal as the root node and different ways of achieving that goal as leaf nodes [
Define the scope and goal of the analysis: The first step is to clearly define the system or organization being analyzed and the goal of the analysis. This will help to focus the analysis on the most important threats.
Identify the potential threats: The next step is to brainstorm all the potential threats that could occur against the system or organization. This can be done through various methods such as brainstorming sessions or by analyzing historical attack patterns.
Create an AT: The AT is a hierarchical diagram that shows the different stages of an attack, from the initial point of entry to the final objective of the attacker. The tree is built by breaking down the attack scenario into smaller, more manageable pieces.
Analyze each node: Once the AT is created, each node is analyzed to determine the likelihood and impact of the attack occurring. This helps to prioritize the threats and determine which ones require the most attention.
Develop countermeasures: After the analysis is complete, countermeasures are developed to address the identified threats. These can range from technical controls such as firewalls and access controls to procedural controls such as training and awareness programs. Test and validate the countermeasures: Finally, the effectiveness of the countermeasures is tested and validated to ensure that they are effective in addressing the identified threats. This can be done through various methods such as PT or scenario-based exercises.
System analysis is aimed at showing the characteristics of the system as availability, security, and
vulnerability through using two techniques the IMECA (for intrusion) and FMECA (for failure) [
PT is a widely used methodological approach, that allows assessing the security of a system by
simulating a real attack [
FVI testing is a commonly used experimental technique to assess the dependability of microprocessor-based systems [18] such as RS also. The general stages of FVI testing are as follows: • Planning: The FVI testing strategy is defined in this stage. This includes identifying the system components to be tested, selecting the types of faults and variabilities to be introduced, and determining the testing environment. • Injection: This stage involves introducing faults and variabilities into the system. The types of faults and variabilities that can be injected include hardware faults (such as memory errors and disk failures), software faults (such as coding errors and logic errors), and environmental variabilities (such as network latency and power fluctuations). • Observation: In this stage, the system's response to the injected faults and variabilities is observed. This involves monitoring system behavior, gathering performance metrics, and identifying any unexpected behaviors or errors. • Analysis: In this stage, the data gathered during observation is analyzed to identify patterns and root causes of faults and variabilities. This helps determine areas of the system that need improvement and identify potential solutions. • Reporting: Finally, a report is generated that summarizes the findings of the FVI testing.
The report may include recommendations for improving the system's resilience and dependability, as well as any identified areas for further testing and analysis.
During our study, we analyzed each stage of all these methods and developed a combined safety & cybersecurity assessment cycle shown in Figure 6. We summarized similar stages and grouped them, for example, we noticed that all 5 methods have an initial stage when testers perform a pre-processing task/activity without direct interaction with the target system like planning, identifying the assets, etc. We simply named this stage a Pre-processing stage.
Most parts of the other stage were processed in the same way, but we also highlighted the such type of possible testing stages like System Preparation which describes the additional steps to be done (for example, vulnerabilities injection) before the start of the assessment process.
The choice of method depends on the specific problem being addressed and the resources available.
Using a combination of approaches can help to ensure that safety and security risks are effectively
identified and managed and that safety-critical systems are reliable and effective. In our previous
research [
The programmer or the operator issues high-level commands to the controller (e.g., via a REST API,
with a program on the HRI interface, moving the joystick). The controller translates such commands
into low-level inputs for the actuators (e.g., end effectors, servo motors) through dedicated I/O
interfaces. The controller is also reachable through a remote-access interface. [
In this section, we described 4 analytical and experimental methods combinations. The goal of this combination is to reduce PT execution time, improve its completeness and trustworthiness, and decrease the costs of safety and cybersecurity assessment.
Such methods combination is fully applicable for a safety-cybersecurity-critical system such as RS. All the possible attack surfaces (marked in the dashed oval in Fig.7), such as robot/service networks, controllers, or a program task, can be assessed using this method’s combination. I(F)MECA-PEN allows the pentester to assess and perform Intrusion/Failure analysis and assess findings (threats/vulnerabilities/attacks) criticality after PT phases such as scanning, gaining access, and maintaining access. Figure 8 describes the way how I(F)MECA stages can be integrated into the PT flow.
ATA is very often used technique as an addition to the PT activities, especially after the Scanning stage. The stages of ATA-PEN are described in Figure 9.
This combination of methods is so widespread that sometimes PT is confused with VA and vice versa. R&VA-PEN is a very large-scale and long-time-consuming process that covers not only safety & cybersecurity assessment, but also vulnerability monitoring and reporting activities. The stages of R&VA-PEN are described in Figure 10.
The unique stage of the FVI-PEN method is the Injection stage. This technique may be useful to test the completeness and trustworthiness of the PT process. The idea is that the development team injects certain known vulnerabilities before starting the testing phase, and pen-testers must check how the RS will react to their appearance and what exactly they can lead to. Unfortunately, this method is quite risky, because fault or vulnerability injection can lead to unexpected RS behavior, so it is not recommended to perform it on a real existing system. The stages of FVI-PEN are described in Figure 11. Gaining & maintaining access might be an optional step.
We compared and discussed method combinations and summarized their advantages and disadvantages in the tables 2-5.
Advantages Disadvantages + Pentester can predict the impact of - Vulnerabilities can be “known” issues that refer vulnerabilities he found without exploitation of the pentester to the vulnerabilities databases these findings. In cases when the goal is like NVD with already assigned CVE, assessed assessing the impact of possible threats, this criticality level, and described steps to exploit method’s combination can save a lot of time by and there is no critical need for criticality excluding the low criticality scenarios from the analysis before the exploitation. testing scope. + When access to the RS is gained, the - If access to the system is gained for a very short pentester can redo the I(F)MECA analysis again period pentester might have no time to perform to identify the most critical threats and begin an I(F)MECA analysis. the exploitation process from them. + Might be very helpful also after regression testing to understand the level of risk mitigation.
Advantages Disadvantages + This helps the pentester to identify possible - Requires extra time for creating attack trees. attack vectors on the RS like robot/service networks, controller, or a program task, and analyze their components to understand the way to perform an intrusion to the RS. + Applied countermeasures can be validated using ATA-PEN methods combinations.
Advantages Disadvantages + The method has the largest testing coverage. - Cost- and time-consuming method. + Simplifies mitigation of the “false-positive” findings by verifying them using exploitation activities.
Advantages Disadvantages + This method’s combination allows for the - Risky if used in a real RS condition. assessment of the quality of pentesters’ work. + By using this method development team can - Time-consuming method. see how RS will work in unexpected/critical situations. - Requires robotic simulators to be used for testing. 4.3.
Based on the analysis of possible options for combining existing methods of ensuring the safety and cyber security of RS and a review of the advantages and disadvantages of these methods, it is possible to build a generalized matrix of influence on certain aspects of PT.
We evaluated the impact methods combining on the PT metrics (completeness, trustworthiness, execution time, cost) using the scale from -2 to 2, where -2 is a significant decrease in the metric, -1 is a slight decrease in the metric, 0 means that the value of the metric doesn’t change, 1 is a slight increase in the metric, 2 is a significant increase in the metric. Before the evaluation, all the metrics score values are equal to 0. The results are summarized in Table 6.
I(F)MECA-PEN doesn’t significantly increase the execution time and cost of PT but incomparably improves its completeness and trustworthiness. Meanwhile, the ATA-PEN combination also raises PT execution time and cost but also slightly improves its completeness and trustworthiness. R&VA is a very cost- & time-consuming method combination, but it significantly improves PT completeness. FVIPEN is a method combination, which requires an additional environment to be used for PT, but this method can significantly improve RS dependability.
During this study, we analyzed a few analytical and experimental methods of safety and
cybersecurity assessment to be combined with PT and evaluated them. As a preliminary result, we have
determined that the combination of I(F)MECA with PT [
Future research can be dedicated to, firstly, the addition of other methods and analysis of their extended combination, and secondly, simulation and field investigation of the RS cyber security assessment using the suggested approach. Finally, it would be interesting to continue research on cybersecurity analysis and assurance issues for the Internet of Robots as a part of IoT systems [19,20].
[18] A. Aponte-Moreno, J. Isaza-GonzÃlez, A. Serrano-Cases, A. Martínez-Álvarez, S. CuencaAsensi, and F. Restrepo-Calle, Evaluation of fault injection tools for reliability estimation of microprocessor-based embedded systems, Microprocessors and Microsystems 96 (2023), doi: 10.1016/j.micpro.2022.104723. [19] M. Kolisnyk, Vulnerability analysis and method of selection of communication protocols for information transfer in Internet of Things systems, Radioelectronic and Computer Systems, 1 (2021), pp. 133–149, doi: 10.32620/reks.2021.1.12. [20] O. Morozova, A. Nicheporuk, A. Tetskyi, and V. Tkachov, Methods and technologies for ensuring cybersecurity of industrial and web-oriented systems and networks, Radioelectronic and Computer Systems, 4 (2021), pp. 145–156, doi: 10.32620/reks.2021.4.12.