| DOI | Trouver le DOI : https://doi.org/10.1145/3689942.3694745 |
|---|
| Auteur | Rechercher : Hallajiyan, MohammadrezaIdentifiant ORCID : https://orcid.org/0000-0003-1570-7351; Rechercher : Dharmalingam, Athish PranavIdentifiant ORCID : https://orcid.org/0009-0000-7326-4662; Rechercher : Mitra, GargiIdentifiant ORCID : https://orcid.org/0000-0001-8011-4590; Rechercher : Alemzadeh, HomaIdentifiant ORCID : https://orcid.org/0000-0001-5279-842X; Rechercher : Iqbal, Shahrear1Identifiant ORCID : https://orcid.org/0000-0001-7819-5715; Rechercher : Pattabiraman, KarthikIdentifiant ORCID : https://orcid.org/0000-0003-2380-3415 |
|---|
| Affiliation | - Conseil national de recherches Canada. Technologies numériques
|
|---|
| Format | Texte, Article |
|---|
| Conférence | CCS '24: ACM SIGSAC Conference on Computer and Communications Security, October 14-18, 2024, Salt Lake City, UT, USA |
|---|
| Sujet | ML-enabled medical devices; false data injection; STPA-sec; security assesssment |
|---|
| Résumé | The increasing use of machine learning (ML) in medical systems necessitates robust security measures to mitigate potential threats. Current research often overlooks the risk of adversaries injecting false inputs through peripheral devices at inference time, leading to mispredictions in patients’ conditions. These risks are hard to foresee and mitigate during the design phase since the system is assembled by end users at the time of use. To address this gap, we introduce SAM, a technique that enables security analysts to perform System Theoretic Process Analysis for Security (STPA-Sec) on ML-enabled medical devices during the design phase. SAM models the medical system as a control structure, with the ML engine as the controller and peripheral devices as potential points for false data injection. It interfaces with state-of-the-art vulnerability databases and Large Language Models (LLMs) to automate the discovery of vulnerabilities and generate a list of possible attack paths. We demonstrate the usefulness of SAM through case studies on two FDA-cleared medical devices: a blood glucose management system and a bone mineral density measurement software. SAM allows security analysts to expedite the security assessment of ML-enabled medical devices at the design phase. This proactive approach mitigates potential patient harm and reduces costs associated with post-deployment security measures. |
|---|
| Date de publication | 2023-11-21 |
|---|
| Maison d’édition | ACM |
|---|
| Dans | |
|---|
| Langue | anglais |
|---|
| Publications évaluées par des pairs | Oui |
|---|
| Exporter la notice | Exporter en format RIS |
|---|
| Signaler une correction | Signaler une correction (s'ouvre dans un nouvel onglet) |
|---|
| Identificateur de l’enregistrement | d65db7cf-6ec7-4164-814c-69978eda7666 |
|---|
| Enregistrement créé | 2024-12-02 |
|---|
| Enregistrement modifié | 2024-12-03 |
|---|
