publications

2023

1. IV

   Detecting Data Spoofing in Connected Vehicle based Intelligent Traffic Signal Control using Infrastructure-Side Sensors and Traffic Invariants

   Junjie Shen, Ziwen Wan, Yunpeng Luo, Yiheng Feng, Z. Morley Mao, and Qi Alfred Chen

   In IEEE Intelligent Vehicles Symposium (IV) 2023
2. T-ITS

   Anomaly Detection Against GPS Spoofing Attacks on Connected and Autonomous Vehicles Using Learning From Demonstration

   Zhen Yang, Jun Ying, Junjie Shen, Yiheng Feng, Qi Alfred Chen, Z. Morley Mao, and Henry Liu

   IEEE Transactions on Intelligent Transportation Systems 2023

2022

1. ACSAC

   Play the Imitation Game: Model Extraction Attack against Autonomous Driving Localization

   Qifan Zhang, Junjie Shen, Mingtian Tan, Zhe Zhou, Zhou Li, Qi Alfred Chen, and Haipeng Zhang

   In Annual Computer Security Applications Conference (ACSAC) 2022 (Acceptance rate 24.1% = 73/303)

   Abstract Paper Slides

   The security of the Autonomous Driving (AD) system has been gaining researchers’ and public’s attention recently. Given that AD companies have invested a huge amount of resources in developing their AD models, e.g., localization models, these models, in particular, their parameters can become intellectual and deserve strong protection.
   
   In this work, we examine whether the confidentiality of Multi-Sensor Fusion (MSF) models, in particular, Error-State Kalman Filter (ESKF) used by production-grade MSF, like the one in Baidu Apollo, can be stolen from an outside adversary. We propose a new model extraction attack called TaskMaster that can infer the secret ESKF parameters through black-box analysis. In essence, TaskMaster trains a substitutional ESKF model to recover the parameters, by observing the input and output to the targeted AD system. We combine a set of techniques, like gradient-based optimization, search-space reduction and multi-stage optimization, to this end. The evaluation result on real-world vehicle sensor dataset shows the threat from TaskMaster is practical. For example, by collecting data points within the 25-second window of a targeted AV, we can train an ESKF model reaching centimeter-level accuracy to the ground-truth model.

2. Dissertation

   Security Challenges and Defense Opportunities of Connected and Autonomous Vehicle Systems in the Physical World

   Junjie Shen

   2022
3. arXiv

   SoK: On the Semantic AI Security in Autonomous Driving

   Junjie Shen, Ningfei Wang, Ziwen Wan, Yunpeng Luo, Takami Sato, Zhisheng Hu, Xinyang Zhang, Shengjian Guo, Zhenyu Zhong, Kang Li, Ziming Zhao, Chunming Qiao, and Qi Alfred Chen

   arXiv:2203.05314 2022

   Abstract Paper Website

   Autonomous Driving (AD) systems rely on AI components to make safety and correct driving decisions. Unfortunately, today’s AI algorithms are known to be generally vulnerable to adversarial attacks. However, for such AI component-level vulnerabilities to be semantically impactful at the system level, it needs to address non-trivial semantic gaps both (1) from the system-level attack input spaces to those at AI component level, and (2) from AI component-level attack impacts to those at the system level. In this paper, we define such research space as semantic AI security as opposed to generic AI security. Over the past 5 years, increasingly more research works are performed to tackle such semantic AI security challenges in AD context, which has started to show an exponential growth trend.
   
   In this paper, we perform the first systematization of knowledge of such growing semantic AD AI security research space. In total, we collect and analyze 53 such papers, and systematically taxonomize them based on research aspects critical for the security field. We summarize 6 most substantial scientific gaps observed based on quantitative comparisons both vertically among existing AD AI security works and horizontally with security works from closely-related domains. With these, we are able to provide insights and potential future directions not only at the design level, but also at the research goal, methodology, and community levels. To address the most critical scientific methodology-level gap, we take the initiative to develop an open-source, uniform, and extensible system-driven evaluation platform, named PASS, for the semantic AD AI security research community. We also use our implemented platform prototype to showcase the capabilities and benefits of such a platform using representative semantic AD AI attacks.

4. NDSS

   Too Afraid to Drive: Systematic Discovery of Semantic DoS Vulnerability in Autonomous Driving Planning under Physical-World Attacks

   Ziwen Wan, Junjie Shen, Jalen Chuang, Xin Xia, Joshua Garcia, Jiaqi Ma, and Qi Alfred Chen

   In Network and Distributed System Security Symposium (NDSS) 2022 (Acceptance rate 14.1% = 53/377)

   Abstract Paper Code Website

   In high-level Autonomous Driving (AD) systems, behavioral planning is in charge of making high-level driving decisions such as cruising and stopping, and thus highly securitycritical. In this work, we perform the first systematic study of semantic security vulnerabilities specific to overly-conservative AD behavioral planning behaviors, i.e., those that can cause failed or significantly-degraded mission performance, which can be critical for AD services such as robo-taxi/delivery. We call them semantic Denial-of-Service (DoS) vulnerabilities, which we envision to be most generally exposed in practical AD systems due to the tendency for conservativeness to avoid safety incidents. To achieve high practicality and realism, we assume that the attacker can only introduce seemingly-benign external physical objects to the driving environment, e.g., off-road dumped cardboard boxes.
   
   To systematically discover such vulnerabilities, we design PlanFuzz, a novel dynamic testing approach that addresses various problem-specific design challenges. Specifically, we propose and identify planning invariants as novel testing oracles, and design new input generation to systematically enforce problemspecific constraints for attacker-introduced physical objects. We also design a novel behavioral planning vulnerability distance metric to effectively guide the discovery. We evaluate PlanFuzz on 3 planning implementations from practical open-source AD systems, and find that it can effectively discover 9 previouslyunknown semantic DoS vulnerabilities without false positives. We find all our new designs necessary, as without each design, statistically significant performance drops are generally observed. We further perform exploitation case studies using simulation and real-vehicle traces. We discuss root causes and potential fixes.

5. AutoSec

   PASS: A System-Driven Evaluation Platform for Autonomous Driving Safety and Security

   Zhisheng Hu, Junjie Shen, Shengjian Guo, Xinyang Zhang, Zhenyu Zhong, Qi Alfred Chen, and Kang Li

   In Fourth International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) 2022

   Abstract Paper

   Safety and security play critical roles for the success of Autonomous Driving (AD) systems. Since AD systems heavily rely on AI components, the safety and security research of such components has also received great attention in recent years. While it is widely recognized that AI component-level (mis)behavior does not necessarily lead to AD system-level impacts, most of existing work still only adopts component-level evaluation. To fill such critical scientific methodology-level gap from component-level to real system-level impact, a system-driven evaluation platform jointly constructed by the community could be the solution. In this paper, we present PASS (Platform for Auto-driving Safety and Security), a system-driven evaluation prototype based on simulation. By sharing our platform building concept and preliminary efforts, we hope to call on the community to build a uniform and extensible platform to make AI safety and security work sufficiently meaningful at the system level.

2021

1. USENIX Security

   Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack

   Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin, and Qi Alfred Chen

   In USENIX Security Symposium (USENIX Security) 2021 (Acceptance rate 18.7% = 246/1316)

   Abstract Paper Extended Version Code Website 量子位 新华网

   Automated Lane Centering (ALC) systems are convenient and widely deployed today, but also highly security and safety critical. In this work, we are the first to systematically study the security of state-of-the-art deep learning based ALC systems in their designed operational domains under physical-world adversarial attacks. We formulate the problem with a safety-critical attack goal, and a novel and domain-specific attack vector: dirty road patches. To systematically generate the attack, we adopt an optimization-based approach and overcome domain-specific design challenges such as camera frame inter-dependencies due to attack-influenced vehicle control, and the lack of objective function design for lane detection models.
   
   We evaluate our attack on a production ALC using 80 scenarios from real-world driving traces. The results show that our attack is highly effective with over 97.5% success rates and less than 0.903 sec average success time, which is substantially lower than the average driver reaction time. This attack is also found (1) robust to various real-world factors such as lighting conditions and view angles, (2) general to different model designs, and (3) stealthy from the driver’s view. To understand the safety impacts, we conduct experiments using software-in-the-loop simulation and attack trace injection in a real vehicle. The results show that our attack can cause a 100% collision rate in different scenarios, including when tested with common safety features such as automatic emergency braking. We also evaluate and discuss defenses.

2. IV

   End-to-end Uncertainty-based Mitigation of Adversarial Attacks to Automated Lane Centering

   Ruochen Jiao, Hengyi Liang, Takami Sato, Junjie Shen, Qi Alfred Chen, and Qi Zhu

   In IEEE Intelligent Vehicles Symposium (IV) 2021
3. AutoSec

   Fooling Perception via Location: A Case of Region-of-Interest Attacks on Traffic Light Detection in Autonomous Driving

   Kanglan Tang, Junjie Shen, and Qi Alfred Chen

   In Third International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) 2021

   Abstract Paper Website

   The perception module is the key to the security of Autonomous Driving systems. It perceives the environment through sensors to help make safe and correct driving decisions on the road. The localization module is usually considered to be independent of the perception module. However, we discover that the correctness of perception output highly depends on localization due to the widely used Region-of-Interest design adopted in perception. Leveraging this insight, we propose an ROI attack and perform a case study in the traffic light detection in Autonomous Driving systems. We evaluate the ROI attack on a production-grade Autonomous Driving system, named Baidu Apollo, under end-to-end simulation environments. We found our attack is able to make the victim a red light runner or cause denial-of-service with a 100% success rate.

4. AutoSec

   WIP: End-to-End Analysis of Adversarial Attacks to Automated Lane Centering Systems

   Hengyi Liang*, Ruochen Jiao*, Takami Sato, Junjie Shen, Qi Alfred Chen, and Qi Zhu

   In Third International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) 2021

   Best Short Paper Award

   Abstract Paper

   Machine learning techniques, particularly those based on deep neural networks (DNNs), are widely adopted in the development of advanced driver-assistance systems (ADAS) and autonomous vehicles. While providing significant improvement over traditional methods in average performance, the usage of DNNs also presents great challenges to system safety, especially given the uncertainty of the surrounding environment, the disturbance to system operations, and the current lack of methodologies for predicting DNN behavior. In particular, adversarial attacks to the sensing input may cause errors in systems’ perception of the environment and lead to system failure. However, existing works mainly focus on analyzing the impact of such attacks on the sensing and perception results and designing mitigation strategies accordingly. We argue that as system safety is ultimately determined by the actions it takes, it is essential to take an end-to-end approach and address adversarial attacks with the consideration of the entire ADAS or autonomous driving pipeline, from sensing and perception to planing, navigation and control. In this paper, we present our initial findings in quantitatively analyzing the impact of a type of adversarial attack (that leverages road patch) on system planning and control, and discuss some of the possible directions to systematically address such attack with an end-to-end view.

5. AutoSec

   WIP: Deployability Improvement, Stealthiness User Study, and Safety Impact Assessment on Real Vehicle for Dirty Road Patch Attack

   Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin, and Qi Alfred Chen

   In Third International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) 2021

   Abstract Paper

   Automated Lane Centering (ALC) systems are convenient and widely deployed today, but also highly security and safety critical. Recently, Dirty Road Patch (DRP) attack is proposed as a state-of-the-art adversarial attack against ALC systems. In this work, we report our recent progress of improving the DRP attack on attack deployability, attack stealthiness, and end-to-end effectiveness on real vehicle. We also discuss future research directions.

2020

1. arXiv

   Hold Tight and Never Let Go: Security of Deep Learning based Automated Lane Centering under Physical-World Attack

   Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin, and Qi Alfred Chen

   arXiv:2009.06701 2020

   Abstract Paper Website 量子位

   Automated Lane Centering (ALC) systems are convenient and widely deployed today, but also highly security and safety critical. In this work, we are the first to systematically study the security of state-of-the-art deep learning based ALC systems in their designed operational domains under physical-world adversarial attacks. We formulate the problem with a safety-critical attack goal, and a novel and domain-specific attack vector: dirty road patches. To systematically generate the attack, we adopt an optimization-based approach and overcome domain-specific design challenges such as camera frame inter-dependencies due to dynamic vehicle actuation, and the lack of objective function design for lane detection models.
   
   We evaluate our attack method on a production ALC system using 80 attack scenarios from real-world driving traces. The results show that our attack is highly effective with over 92% success rates and less than 0.95 sec average success time, which is substantially lower than the average driver reaction time. Such high attack effectiveness is also found (1) robust to motion model inaccuracies, different lane detection model designs, and physical-world factors, and (2) stealthy from the driver’s view. To concretely understand the end-to-end safety consequences, we further evaluate on concrete real-world attack scenarios using a production-grade simulator, and find that our attack can successfully cause the victim to hit the highway concrete barrier or a truck in the opposite direction with 98% and 100% success rates. We also discuss defense directions.

2. USENIX Security

   Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing

   Junjie Shen, Jun Yeon Won, Zeyuan Chen, and Qi Alfred Chen

   In USENIX Security Symposium (USENIX Security) 2020 (Acceptance rate 16.1% = 157/977)

   Abstract Paper Extended Version Slides Website Talk Demo 1 Demo 2 Dataset 新华网 Synced

   For high-level Autonomous Vehicles (AV), localization is highly security and safety critical. One direct threat to it is GPS spoofing, but fortunately, AV systems today predominantly use Multi-Sensor Fusion (MSF) algorithms that are generally believed to have the potential to practically defeat GPS spoofing. However, no prior work has studied whether today’s MSF algorithms are indeed sufficiently secure under GPS spoofing, especially in AV settings. In this work, we perform the first study to fill this critical gap. As the first study, we focus on a production-grade MSF with both design and implementation level representativeness, and identify two AV-specific attack goals, off-road and wrong-way attacks.
   
   To systematically understand the security property, we first analyze the upper-bound attack effectiveness, and discover a take-over effect that can fundamentally defeat the MSF design principle. We perform a cause analysis and find that such vulnerability only appears dynamically and non-deterministically. Leveraging this insight, we design FusionRipper, a novel and general attack that opportunistically captures and exploits take-over vulnerabilities. We evaluate it on 6 real-world sensor traces, and find that FusionRipper can achieve at least 97% and 91.3% success rates in all traces for off-road and wrong-way attacks respectively. We also find that it is highly robust to practical factors such as spoofing inaccuracies. To improve the practicality, we further design an offline method that can effectively identify attack parameters with over 80% average success rates for both attack goals, with the cost of at most half a day. We also discuss promising defense directions.

3. ICSE

   A Comprehensive Study of Autonomous Vehicle Bugs

   Joshua Garcia, Yang Feng, Junjie Shen, Sumaya Almanee, Yuan Xia, and Qi Alfred Chen

   In ACM/IEEE International Conference on Software Engineering (ICSE) 2020 (Acceptance rate 23.5% = 129/550)

   Abstract Paper Dataset

   Self-driving cars, or Autonomous Vehicles (AVs), are increasingly becoming an integral part of our daily life. About 50 corporations are actively working on AVs, including large companies such as Google, Ford, and Intel. Some AVs are already operating on public roads, with at least one unfortunate fatality recently on record. As a result, understanding bugs in AVs is critical for ensuring their security, safety, robustness, and correctness. While previous studies have focused on a variety of domains (e.g., numerical software; machine learning; and error-handling, concurrency, and performance bugs) to investigate bug characteristics, AVs have not been studied in a similar manner. Recently, two software systems for AVs, Baidu Apollo and Autoware, have emerged as frontrunners in the opensource community and have been used by large companies and governments (e.g., Lincoln, Volvo, Ford, Intel, Hitachi, LG, and the US Department of Transportation). From these two leading AV software systems, this paper describes our investigation of 16,851 commits and 499 AV bugs and introduces our classification of those bugs into 13 root causes, 20 bug symptoms, and 18 categories of software components those bugs often affect. We identify 16 major findings from our study and draw broader lessons from them to guide the research community towards future directions in software bug detection, localization, and repair.

4. ICLR

   Fooling Detection Alone is Not Enough: Adversarial Attack against Multiple Object Tracking

   Yunhan Jia*, Yantao Lu*, Junjie Shen, Qi Alfred Chen, Hao Chen, Zhenyu Zhong, and Tao Wei

   In International Conference on Learning Representations (ICLR) 2020 (Acceptance rate 26.5% = 687/2594)

   Abstract Paper Code

   Recent work in adversarial machine learning started to focus on the visual perception in autonomous driving and studied Adversarial Examples (AEs) for object detection models. However, in such visual perception pipeline the detected objects must also be tracked, in a process called Multiple Object Tracking (MOT), to build the moving trajectories of surrounding obstacles. Since MOT is designed to be robust against errors in object detection, it poses a general challenge to existing attack techniques that blindly target objection detection: we find that a success rate of over 98% is needed for them to actually affect the tracking results, a requirement that no existing attack technique can satisfy. In this paper, we are the first to study adversarial machine learning attacks against the complete visual perception pipeline in autonomous driving, and discover a novel attack technique, tracker hijacking, that can effectively fool MOT using AEs on object detection. Using our technique, successful AEs on as few as one single frame can move an existing object in to or out of the headway of an autonomous vehicle to cause potential safety hazards. We perform evaluation using the Berkeley Deep Drive dataset and find that on average when 3 frames are attacked, our attack can have a nearly 100% success rate while attacks that blindly target object detection only have up to 25%.

5. IEEE Access

   Exploring Convolution Neural Network for Branch Prediction

   Yonghua Mao, Huiyang Zhou, Xiaolin Gui, and Junjie Shen

   IEEE Access 2020

   Abstract Paper

   Recently, there have been significant advances in deep neural networks (DNNs) and they have shown distinctive performance in speech recognition, natural language processing, and image recognition. In this paper, we explore DNNs to push the limit for branch prediction. We treat branch prediction as a classification problem and employ both deep convolutional neural networks (CNNs), ranging from LeNet to ResNet-50, and deep belief network (DBN) for branch prediction. We compare the effectiveness of DNNs with the state-of-the-art branch predictors, including the perceptron, our prior work, Multi-poTAGE+SC, and MTAGE+SC branch predictors. The last two are the most recent winners of championship branch prediction (CBP) contests. Several interesting observations emerged from our study. First, for branch prediction, the DNNs outperform the perceptron model as high as 60–80%. Second, we analyze the impact of the depth of CNNs (i.e., number of convolutional layers and pooling layers) on the misprediction rates. The results confirm that deeper CNN structures can lead to lower misprediction rates. Third, the DBN could outperform our prior work, but not outperform the state-of-the-art TAGE-like branch predictor; the ResNet-50 could not only outperform our prior work, but also the Multi-poTAGE+SC and MTAGE+SC.

6. NDSS

   Poster: Security of Deep Learning based Lane Keeping Assistance System under Physical-World Adversarial Attack

   Takami Sato*, Junjie Shen*, Ningfei Wang, Yunhan Jack Jia, Xue Lin, and Qi Alfred Chen

   In Network and Distributed System Security Symposium (NDSS) 2020

   Best Technical Poster Award

   Abstract Poster

   Lane-Keeping Assistance System (LKAS) is convenient and widely available today, but also extremely security and safety critical. In this work, we design and implement the first systematic approach to attack real-world DNN-based LKASes. We evaluate our approach on a state-of-the-art LKAS and our preliminary results show that our attack can successfully cause it to drive off lane boundaries within as short as 1.3 seconds.

2019

1. AdvMLCV

   Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking

   Yunhan Jia*, Yantao Lu*, Junjie Shen, Qi Alfred Chen, Zhenyu Zhong, and Tao Wei

   In CVPR Adversarial Machine Learning in Real-World Computer Vision Systems Workshop 2019

   Oral Presentation

   Abstract Paper

   Recent work in adversarial machine learning started to focus on the visual perception in autonomous driving and studied Adversarial Examples (AEs) for object detection models. However, in such visual perception pipeline the detected objects must also be tracked, in a process called Multiple Object Tracking (MOT), to build the moving trajectories of surrounding obstacles. Since MOT is designed to be robust against errors in object detection, it poses a general challenge to existing attack techniques that blindly target objection detection: we find that a success rate of over 98% is needed for them to actually affect the tracking results, a requirement that no existing attack technique can satisfy. In this paper, we are the first to study adversarial machine learning attacks against the complete visual perception pipeline in autonomous driving, and discover a novel attack technique, tracker hijacking, that can effectively fool MOT using AEs on object detection. Using our technique, successful AEs on as few as one single frame can move an existing object in to or out of the headway of an autonomous vehicle to cause potential safety hazards. We perform evaluation using the Berkeley Deep Drive dataset and find that on average when 3 frames are attacked, our attack can have a nearly 100% success rate while attacks that blindly target object detection only have up to 25%.

2. USENIX ATC

   LXDs: Towards Isolation of Kernel Subsystems

   Vikram Narayanan, Abhiram Balasubramanian, Charlie Jacobsen, Sarah Spall, Scott Bauer, Michael Quigley, Aftab Hussain, Abdullah Younis, Junjie Shen, Moinak Bhattacharyya, and Anton Burtsev

   In USENIX Annual Technical Conference (USENIX ATC) 2019 (Acceptance rate 19.9% = 71/356)

   Abstract Paper Website

   Modern operating systems are monolithic. Today, however, lack of isolation is one of the main factors undermining security of the kernel. Inherent complexity of the kernel code and rapid development pace combined with the use of unsafe, low-level programming language results in a steady stream of errors. Even after decades of efforts to make commodity kernels more secure, i.e., development of numerous static and dynamic approaches aimed to prevent exploitation of most common errors, several hundreds of serious kernel vulnerabilities are reported every year. Unfortunately, in a monolithic kernel a single exploitable vulnerability potentially provides an attacker with access to the entire kernel.
   
   Modern kernels need isolation as a practical means of confining the effects of exploits to individual kernel subsystems. Historically, introducing isolation in the kernel is hard. First, commodity hardware interfaces provide no support for efficient, fine-grained isolation. Second, the complexity of a modern kernel prevents a naive decomposition effort. Our work on Lightweight Execution Domains (LXDs) takes a step towards enabling isolation in a full-featured operating system kernel. LXDs allow one to take an existing kernel subsystem and run it inside an isolated domain with minimal or no modifications and with a minimal overhead. We evaluate our approach by developing isolated versions of several performance-critical device drivers in the Linux kernel.

3. IPDPS

   Combining Prefetch Control and Cache Partitioning to Improve Multicore Performance

   Gongjin Sun, Junjie Shen, and Alex Veidenbaum

   In IEEE International Parallel & Distributed Processing Symposium (IPDPS) 2019 (Acceptance rate 27.7% = 103/372)

   Abstract Paper

   Modern commercial multi-core processors are equipped with multiple hardware prefetchers on each core. The prefetchers can significantly improve application performance. However, shared resources, such as last-level cache (LLC) and off-chip memory bandwidth and controller, can lead to prefetch interference. Multiple techniques have been proposed to reduce such interference and improve the performance isolation across cores, such as coordinated control among prefetchers and cache partitioning (CP). Each of them has its advantages and disadvantages. This paper proposes combining these two techniques in a coordinated way. Prefetchers and LLC are treated as separate resources and a multi-resource management mechanism is proposed to control prefetching and cache partitioning. This control mechanism is implemented as a Linux kernel module and can be applied to a wide variety of prefetch architectures. An implementation on Intel Xeon E5 v4 processor shows that combining LLC partitioning and prefetch throttling provides a significant improvement in performance and fairness.

4. NDSS

   Poster: Security Analysis of Multi-Sensor Fusion based Localization in Autonomous Vehicles

   Junjie Shen, Jun Yeon Won, Shinan Liu, Qi Alfred Chen, and Alexander Veidenbaum

   In Network and Distributed System Security Symposium (NDSS) 2019

   Distinguished Poster Presentation Award

   Abstract Poster

   Precise and robust localization is highly critical for making correct and safe driving decisions in Autonomous Vehicles (AVs). To achieve this goal, they are usually equipped with redundant and complementary sensors, e.g., LiDAR, GPS, and IMU, and use Multi-Sensor Fusion (MSF) algorithms to combine the observations. However, it is largely unclear how robust these MSF algorithms are in presence of practical sensor attacks such as GPS spoofing. In this poster, we share our recent progress in performing the first security analysis of representative MSF designs in AV systems under GPS spoofing attack.

2018

1. LCPC

   New Opportunities for Compilers in Computer Security

   Junjie Shen, Zhi Chen, Nahid Farhady Ghalaty, Rosario Cammarota, Alex Nicolau, and Alex Veidenbaum

   In Languages and Compilers for Parallel Computing (LCPC) 2018

   Abstract Paper

   Compiler techniques have been deployed to prevent various security attacks. Examples include mitigating memory access corruption, control flow integrity checks, race detection, software diversity, etc.
   
   Hardware fault and side-channel attacks, however, are typically thought to require hardware protection. Attempts have been made to mitigate some timing and fault attacks via compiler techniques, but these typically adversely affected performance and often created opportunities for other types of attacks. More can and should be done in this area by the compiler community.
   
   This paper presents such a compiler approach that simultaneously mitigates two types of attacks, namely a fault and a side-channel attacks. Continued development in this area using compiler techniques can further improve security.

2. IEEE Access

   A Study on Deep Belief Net for Branch Prediction

   Yonghua Mao, Junjie Shen, and Xiaolin Gui

   IEEE Access 2018

   Abstract Paper

   Since 2006, there have been significant advances in deep learning algorithms, and they have shown superior performance in audio and image processing. In this paper, we explore the feasibility of applying deep learning algorithms to branch prediction. We treat branch prediction as a classification problem and compare the effectiveness of deep learning with existing branch predictors. We make several interesting observations from our study. The first is that for branch prediction, the deep learning algorithm based on deep belief networks outperforms the prior work, but only outperforms state-of-the-art branch predictors, such as the TAgged GEometric length (TAGE) predictors, for several benchmarks. Compared with the much simpler perceptron branch classifier, the deep learning classifier reduces the average misprediction rate by 3%-4% for the benchmarks in this paper. Second, we analyze the impact of the length of hashed program counter, local history register, global history register, and branch global addresses of deep learning classifiers on the misprediction rate. Our results show that an adaptive length of the history information is a better choice than the longest history. Third, compared with TAGE, the hardware budget of our model is less than 1% of the TAGE predictor.

2017

1. FDTC

   CAMFAS: A Compiler Approach to Mitigate Fault Attacks Via Enhanced SIMDization

   Zhi Chen, Junjie Shen, Alex Nicolau, Alex Veidenbaum, Nahid Farhady Ghalaty, and Rosario Cammarota

   In Fault Diagnosis and Tolerance in Cryptography (FDTC) 2017

   Abstract Paper Slides

   The trend of supporting wide vector units in general purpose microprocessors suggests opportunities for developing a new and elegant compilation approach to mitigate the impact of faults to cryptographic implementations, which we present in this work. We propose a compilation flow, CAMFAS, to automatically and selectively introduce vectorization in a cryptographic library - to translate a vanilla library into a library with vectorized code that is resistant to glitches. Unlike in traditional vectorization, the proposed compilation flow uses the extent of the vectors to introduce spatial redundancy in the intermediate computations. By doing so, without significantly increasing code size and execution time, the compilation flow provides sufficient redundancy in the data to detect errors in the intermediate values of the computation. Experimental results show that the proposed approach only generates an average of 26% more dynamic instructions over a series of asymmetric cryptographic algorithms in the Libgcrypt library.