{"id":1565,"date":"2025-02-18T12:53:57","date_gmt":"2025-02-18T11:53:57","guid":{"rendered":"https:\/\/ai4cyber.eu\/?p=1565"},"modified":"2025-03-17T09:42:49","modified_gmt":"2025-03-17T08:42:49","slug":"blog-on-ai4sim-knxsmartfuzzer-from-ppc-uowm","status":"publish","type":"post","link":"https:\/\/ai4cyber.eu\/?p=1565","title":{"rendered":"AI4CYBER blogpost: AI4SIM KNXSmartFuzzer for simulating cyber attacks against building automation systems"},"content":{"rendered":"<p><span data-contrast=\"auto\"><img fetchpriority=\"high\" fetchpriority=\"high\" decoding=\"async\" class=\"size-full wp-image-1566 alignleft\" src=\"https:\/\/ai4cyber.eu\/wp-content\/uploads\/2025\/02\/Screenshot-215.png\" alt=\"\" width=\"351\" height=\"346\" \/>The AI4CYBER project is evaluated in three use cases that cover three critical sectors, namely the Energy, Banking and Healthcare. In the Energy use case, AI4CYBER is demonstrated on various threat scenarios that cover the energy sector, including the simulation of advanced multi-step campaign against the Information Technology (IT) infrastructure of Wide Area Measurement Systems (WAMS), fuzzing attacks against KNX-based devices used in building automation, and adversarial attacks against detection systems that monitor Open Charge Point Protocol (OCPP)-based Electric Vehicle (EV) charging infrastructure.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">One of the AI4CYBER components developed within the context of the Energy use case is the KNXSmartFuzzer, a sub-component that belongs to <\/span><a href=\"https:\/\/ai4cyber.eu\/?p=1223\"><span data-contrast=\"none\">AI4SIM<\/span><\/a><span data-contrast=\"auto\">. The first version of the KNXSmartFuzzer includes the implementation of 6 cyberattacks that target a KNX infrastructure, including a KNX\/IP gateway and several underlying KNX devices.\u00a0\u00a0<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><span data-contrast=\"auto\">The first implementation of the KNXSmartFuzzer includes the following attacks:<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">knx-01-fuzzing-bof<\/span><\/b><span data-contrast=\"auto\">: Based on the Bioboite Opener Framework (BOF) by Orange Cyberferense, this attack sends mutated KNX messages, aiming to trigger possible errors or exploit undiscovered vulnerabilities [1].<\/span><span data-ccp-props=\"{&quot;134233279&quot;:false,&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559685&quot;:714,&quot;335559739&quot;:120,&quot;335559991&quot;:357}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">knx-02-unauthorized<\/span><\/b><span data-contrast=\"auto\">: This attack implements an unauthorized access attack, by sending unauthorized commands to the KNX devices [1].<\/span><span data-ccp-props=\"{&quot;134233279&quot;:false,&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559685&quot;:714,&quot;335559739&quot;:120,&quot;335559991&quot;:357}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">knx-03-net-scanning<\/span><\/b><span data-contrast=\"auto\">: This attack aims to discover other KNX\/IP gateways [2].<\/span><span data-ccp-props=\"{&quot;134233279&quot;:false,&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559685&quot;:714,&quot;335559739&quot;:120,&quot;335559991&quot;:357}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">knx-04-bus-scanning<\/span><\/b><span data-contrast=\"auto\">: Following the KNX-03 attack, this attack scans the KNX bus to discover other KNX devices connected on the same physical KNX bus [3].<\/span><span data-ccp-props=\"{&quot;134233279&quot;:false,&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559685&quot;:714,&quot;335559739&quot;:120,&quot;335559991&quot;:357}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">knx-05-flooding-valid<\/span><\/b><span data-contrast=\"auto\">: This is a Denial of Service (DoS) attack that floods the KNX bus with commands targeting legitimate KNX devices. Goal of this attack is to exhaust network and computing resources of the KNX system [3].<\/span><span data-ccp-props=\"{&quot;134233279&quot;:false,&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559685&quot;:714,&quot;335559739&quot;:120,&quot;335559991&quot;:357}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"6\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">knx-06-flooding-invalid<\/span><\/b><span data-contrast=\"auto\">: As a variation of KNX-05, this DoS randomizes the attributes in the KNX messages, including both valid and invalid targets [3].\u00a0<\/span><span data-ccp-props=\"{&quot;134233279&quot;:false,&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559685&quot;:714,&quot;335559739&quot;:120,&quot;335559991&quot;:357}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">For more technical details and practical insights about the implementation of these attacks, as well as for the respective source code, the readers can visit the GitLab repository of the KNXSmartFuzzer v1: <\/span><a href=\"https:\/\/gitlab.ithaca.ece.uowm.gr\/ai4cyber\/knxsmartfuzzer-v1\"><span data-contrast=\"none\">https:\/\/gitlab.ithaca.ece.uowm.gr\/ai4cyber\/knxsmartfuzzer-v1<\/span><\/a><span data-contrast=\"auto\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Reference:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<ol>\n<li data-leveltext=\"[%1]\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;[%1]&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Claire Vacherot. Sneak into buildings with KNXnet\/IP. Sneak into buildings with KNXnet\/IP, Nov 2020, Lyon, France. \u27e8hal-03022310\u27e9<\/span><\/li>\n<li data-leveltext=\"[%1]\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;[%1]&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span class=\"TextRun SCXW126291053 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW126291053 BCX8\">Alessio Antonini, Federico Maggi and Stefano <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW126291053 BCX8\">Zanero<\/span><span class=\"NormalTextRun SCXW126291053 BCX8\">. A Practical Attack Against a KNX-based Building Automation System. 2014. DOI: 10.14236\/<\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW126291053 BCX8\">ewic<\/span><span class=\"NormalTextRun SCXW126291053 BCX8\">\/ICSCSR2014.7<\/span><\/span><span class=\"EOP SCXW126291053 BCX8\" data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"[%1]\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;[%1]&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">V. Graveto, T. Cruz and P. Sim\u00f5es, &#8220;A Network Intrusion Detection System for Building Automation and Control Systems,&#8221; in IEEE Access, vol. 11, pp. 7968-7983, 2023, doi: 10.1109\/ACCESS.2023.3238874.<\/span><\/li>\n<\/ol>\n<p>Authors: <span class=\"TextRun SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243383132 BCX8\">Christos <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW243383132 BCX8\">Dalamagkas<\/span><\/span><span class=\"TextRun SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243383132 BCX8\"> (<\/span><\/span><a class=\"Hyperlink SCXW243383132 BCX8\" href=\"https:\/\/www.dei.gr\/el\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW243383132 BCX8\" data-ccp-charstyle=\"Hyperlink\">PPC<\/span><\/span><\/a><span class=\"TextRun SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243383132 BCX8\">)<\/span><span class=\"NormalTextRun SCXW243383132 BCX8\">, <\/span><\/span><span class=\"TextRun SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243383132 BCX8\">Panagiotis <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW243383132 BCX8\">Radoglou-Grammatikis<\/span><\/span><span class=\"TextRun SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243383132 BCX8\"> (<\/span><\/span><a class=\"Hyperlink SCXW243383132 BCX8\" href=\"https:\/\/ithaca.ece.uowm.gr\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW243383132 BCX8\" data-ccp-charstyle=\"Hyperlink\">UOWM<\/span><\/span><\/a><span class=\"TextRun SCXW243383132 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW243383132 BCX8\">)<\/span><\/span><span class=\"EOP SCXW243383132 BCX8\" data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The AI4CYBER project is evaluated in three use cases that cover three critical sectors, namely the Energy, Banking and Healthcare. In the Energy use case, AI4CYBER is demonstrated on various threat scenarios that cover the energy sector, including the simulation of advanced multi-step campaign against the Information Technology (IT) infrastructure of Wide Area Measurement Systems [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[11],"tags":[],"class_list":["post-1565","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=\/wp\/v2\/posts\/1565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1565"}],"version-history":[{"count":7,"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=\/wp\/v2\/posts\/1565\/revisions"}],"predecessor-version":[{"id":1650,"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=\/wp\/v2\/posts\/1565\/revisions\/1650"}],"wp:attachment":[{"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1565"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ai4cyber.eu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}