By Marcello Pogliani
Research Collaborator at the NECSTLab, working on Systems Security

This post is a “preview” of a research work that will be presented at Black Hat USA 2020 on August 5^th, 2020.

The history of this work goes back to 2017, when we published a paper showing what happens when and if sophisticated adversaries compromise an industrial robot. While working on that research, we learnt that robots can be programmed through proprietary domain-specific languages (such as RAPID by ABB or KRL by KUKA). Digging deeper, we witnessed that complex programs built in such languages can go way above and beyond simply moving the robot: we found among the ABB RobotApps  a web server entirely written in RAPID. Moreover, we found that the web server was vulnerable to a path traversal—allowing a network attacker to download arbitrary files from the robot controller, including sensitive configuration files.

Back to now, this observation motivated us to dig deeper on this topic, asking ourselves what is the security impact of the languages’ “sensitive” features, and what vulnerabilities are present in programs written in such languages.

Surveying 8 among the most widely known languages, we observed that they expose security-sensitive features such as the ability of reading from and writing to the robot controller’s file system, the ability of performing some form of dynamic code loading, and networking capabilities. We observed that these features enable taint-style vulnerabilities (and, thus, that programs written for such languages should be analyzed for vulnerabilities!) and that they potentially allow malware to be developed in such languages (think about functionalities such as file dropper and network scanners). The paper presents more details about the functions that act as sources and sinks to enable different “classes” of vulnerabilities: arbitrary network movement, path traversal, arbitrary function execution.

Naturally, we also wanted to know if there are actually real vulnerable programs, besides the aforementioned web server, and how many. To this extent, we built a prototype static source-code analyzer for programs written in domain-specific languages for robots (to date, it supports KRL and RAPID). This prototype performs taint analysis to find unsanitized paths between (configurable) sources and sinks in the program—allowing to find instances of vulnerabilities.

As a dataset, we downloaded various programs from public sources (e.g., Github). As robot programs are highly sensitive and proprietary, we found mostly educational or demonstrator programs. However, we found about 100 among RAPID and KRL files that use at least a function to gather data from the network. Out of these files, we found that the most widespread issue is arbitrary network-controlled movement (13 projects, totalling 34 files); then, we found 1 project with a path traversal and 2 projects leading to arbitrary function execution.

Curious about the details of our research? Head over to the project page, read the preprint of the article that will be published at ASIA CCS 2020 or look at our talk at Black Hat USA 2020 (which will be aired on August 5^th, 2020).

Note: this research is a collaborative effort between myself, Federico Maggi (Senior Researcher at Trend Micro), Davide Quarta (Postdoctoral Researcher at EURECOM), Marco Balduzzi (Senior Researcher at Trend Micro) and Stefano Zanero (Associate Professor at the NECSTLab). We also thank Martino Vittone (Master’s Student at the NECSTLab) and Mario Polino (Postdoctoral Researcher at the NECSTLab) for their contributions to a preliminary study that led to this research.

L'articolo OTRazor: Static Code Analysis for Vulnerability Discovery in Industrial Automation Scripts proviene da NECSTLab.

By Jessica Leoni,
PhD candidate in Data Analysis and Decision Science at mOve lab, Politecnico di Milano

Mindfulness techniques prove to be effective solutions in the management of stress and anxiety attacks, increasing the subject’s awareness of their psychophysical state.
Initially, these techniques were taught during outpatient sessions, where a series of sensors were applied to monitor the patient’s stress level. The recent refinement of the acquisition technology and Machine-Learning algorithms made it possible to perform this monitoring outside the hospital environment, through wearable sensors that communicate with devices such as smartphones.

However, these solutions require frequent subject-device interaction, making them incompatible with work or public speaking contexts, one of the most common sources of stress.
Therefore, at NECSTLab we are working on EMPhASIS, a system adaptable to the physiology of each subject, able to recognize and report real-time its perceived stress level. EMPhASIS is fully autonomous, and for acquisition and reporting uses sensors embedded in a wristband, whose autonomy is compatible with the working day duration.

To obtain a real-time and energy-efficient system, the entire framework has been implemented on a Xilinx PYNQ-Z1 board, leveraging both the ARM processor and the FPGA. As shown in the figure below, EMPhASIS provides an ECG signal acquisition phase, from which R peaks are isolated to extract features both in time and frequency domains. These are presented to a threshold-based algorithm that projects the observations in the PCA space and classifies them between normal and stress-related. The stress level estimation is reported to the subject by a vibrating sensor embedded in the wristband. At the first use, the user is monitored for 5 minutes both in quiet and stressful condition, to allow the system to calibrate itself to its physiology.

The project is ambitious, but its benefits are countless. Just think of contexts such as offices and schools, where the stress level could be reported not only to individual users but also to their supervisors so that they can meet their needs. In this vision, the choice of the FPGA is key, allowing for processing several subjects in parallel while keeping the overall processing time unchanged.

L'articolo EMPhASIS: An EMbedded Public Attention Stress Identification System proviene da NECSTLab.

By Samuele Barbieri,
Student in Computer Science and Engineering, Politecnico di Milano

Not all computations, however, are efficiently performed by classic processors. Although the ones made available by cloud providers are far more powerful than those implemented in personal computers, they are often insufficient and technological solutions have to be developed in order to overcome this limitation. For this reason, heterogeneous computing systems involving specific accelerators have been found out to represent a valid alternative to satisfy the request of more stringent requirements in terms of latency. In this context, FPGAs (Field Programmable Gate Arrays) represent a possible alternative as they allow an improvement of the performance-consumption ratio. From the infrastructure owner’s point of view, an allocated but only partially exploited resource represents a waste, an unnecessary cost proportional to the unutilized portion. However, since the amount and frequency of requests is unpredictable, this problem often results almost impossible to overcome.

A possible solution, when it comes to FPGAs, is represented by the sharing of resources among users.

At NECSTLab we thus developed BlastFunction: a serverless solution enabling the acceleration of functions through  FPGA implementation, also managing machines and FPGAs sharing. The latter relies on a paradigm based on time-sharing: according to this model each user has access to the resources for a limited period of time. This technique allows the optimization of the FPGAs exploitation, granting at the same time the required performance to each user. 

BlastFunction also allows to select which functions need to be accelerated, then the users are required to send the data necessary to the computation. Finally, after collecting this information from the users, the system computes the best services configuration and divides data to be processed among the available resources. 

At the moment we are working on the possibility to instantiate dynamically the number of machines and FPGAs, too, following the number of input requests. To do so, we are relying on Amazon Web Services, in order to adapt BlastFunction to more resources thanks to the virtually infinite number and typologies of FPGAs available.

L'articolo BlastFunction: a serverless FPGA-based tool proviene da NECSTLab.

By Giorgia Fiscaletti, Master Student in Computer Science and Engineering, Politecnico di Milano

The past few years have seen a crucial development of the cloud computing paradigm, alongside its various execution models. This came with the growing need to extend the offer to new platforms and implement new optimizations for the services offered to the users. Optimizations that go from simple concepts – such as speed and resource usage – to the more complex and popular problem of cloud’s elasticity. The term elasticity indicates the capability of the cloud system to adapt itself autonomously to the variations of users’ requests. Solving this problem means being able to maintain an optimal service without wasting resources, avoiding situations of over-provisioning (i.e. having more resources available than the amount actually needed) or under-provisioning (i.e. not having enough resources to satisfy the request).

In particular, one of the latest innovations in this field is the serverless model – also known as Function as a Service (FaaS) – which allows the cloud provider to manage the applications at function level. This model was born in response to the growing use of cloud services, whose offer is already made up of highly complex applications. It is from these issues that the need to divide the old monolithic application up to its single functions has arisen. The purpose of this solution is to optimize the distribution of the resources according to the actual requests to the single functions.

The serverless model suits well the use of hardware accelerators in the cloud (such as FPGAs, Field Programmable Gate Arrays): it is indeed possible to implement a single accelerator for each function individually, regardless of the context to which they belong. In other words, each function can be deployed and accelerated independently from the others, making it possible to dedicate more or less resources to the single functions depending on the users’ demand. This feature allows to avoid a great portion of the waste of resources that might occur otherwise, trying to maintain an optimal service for the end users.

Our research at NECSTLab is currently focusing on the development and the optimization of a serverless architecture that offers FPGAs acceleration potential as Function as a Service. In order to further optimize both the service offered by the infrastructure and the resource management, we are studying and exploring various approaches that leverage Artificial Intelligence. In particular, we are developing an autonomous agent that exploits a Partially Observable Markov Decision Process (POMDP): a generalization of a Markov Decision Process, in which the agent takes decisions and acts on an environment that cannot be fully observed. In our work, this model is used to choose the best kernel configuration to

download on the FPGAs, in order to make the most of the resources available and serve as many users as possible.

Cloud computing is an ever-growing field that has experienced a widespread success in the past few years. The challenge of developing autonomous AI systems to respond to the users’ demand is extremely interesting and thrilling. It is in line with the growth of the services offered by cloud providers, their variety and the subsequent increase of user requests. A challenge whose results will certainly have a positive impact on the optimization of platforms and services.

L'articolo Cloud Computing: towards autonomous systems thanks to Artificial Intelligence proviene da NECSTLab.

In this historical moment marked by a pandemic, it is easy to point out how some digital services are supporting us in carrying out work activities or in keeping in touch with our friends even if we are forced to limit real-life interactions.

Technology seems to have given us the opportunity to have what we want, where we want and when we want. This technological evolution is giving us new chances, enabling things like working or following a college course from home and talking with friends from the other side of the ocean. Unfortunately, however, we’re starting to see some drawbacks to this evolution.

Behind each service there are many servers located in large data centers that collaborate in a dependent and synchronized way to make an application available. Two problems arise when deploying a service. The first one is that on one hand certain performance must be guaranteed, a provider has to make the platform fast enough because a query on a search engine cannot take more than a given number of milliseconds or a video streaming app must be able to stream the content in real-time. At the same time, on the other hand, each service provider is interested in minimizing costs and so reducing energy consumption. Ten years ago Google conducted a research on its search engine that indicated that an increase in the queries response time would lead to a decrease in the number of searches made by users, a decrease that would not recover even after a return of the normal execution speed. To have faster response times the provider has to employ more machines with more powerful hardware and this results in increased total power consumption. Nowadays scientists estimate that in 2030 8% of world power consumption will be directly charged to data centers, this is why optimizing the electricity needs of these structures and at the same time satisfying performance requests is an important challenge.

At NECSTLab we are trying to solve this problem by working on the development of systems able to balance these two factors. Therefore the focus of our work is to minimize the power consumption of clusters and at the same time guarantee a certain level of performance. Our work is based on the Hyppo project, so the basic idea is to use an Observe-Decide-Act loop to control available CPU resources depending on the end-to-end response time of an application deployed in a microservices architecture. In the first phase our system collects the metrics needed by step two. In the decide phase we use a fuzzy controller to discretize the manipulated measures and to compute the actual limits to enforce in the last phase. In particular, we built two actuators: the first one is able to limit the CPU percentage that a pod can use, the second one tells each pod which CPU cores to execute on. 

Combining these elements for each microservice we are able to find the trade-off between power consumption and performance, then we can aggregate these results and decrease the overall energy consumption of the cluster. I think that this IT field is growing quickly, it is constantly evolving and it is becoming increasingly clear how necessary optimizing these services is. From the research point of view it’s an interesting challenge, we are living in a world where making human presence less harmful to the environment is becoming a necessity and so the impact that progress in this area can have is huge.

L'articolo Optimizing power consumption for latency-aware microservice architectures proviene da NECSTLab.

By Ian Di Dio Lavore, Marco Di Gennaro and Luigi Fusco
Undergraduated students in Computer Science and Engineering, Politecnico di Milano

Cardiovascular diseases are the first cause of death worldwide as stated by the World Health Organization. The “Golden-Hour” in emergencies refers to the short amount of time in which the patient has the highest chance of survival. The goal of the Anomalous project is to reduce the time needed for diagnosis to fall within the Golden-Hour.

It has become a standard procedure to acquire an electrocardiogram (ECG) as soon as possible in case of heart conditions. Medical devices in use today have several defects: they are often too heavy, take a lot of time to be deployed and they perform analyses based on old and unreliable methods.

In recent years Computer Science has become interconnected with medicine: from e-health wearables to remote microscopic surgeries done with robots (thanks to the 5G network) or even to automated detection of anomalies, technology is no longer of support, but drives the evolution of care. Anomalous falls within this exciting field, as an open-source, full-stack solution for the acquisition and automatic analysis of ECG signals. This software recognizes common problems present in the ECG  and shows the results of its analysis to the medical staff  through a simple and intuitive user interface.

We adopted an innovative technique for acquiring the ECG signal, known as EASI, in order to reduce the time needed to prepare the patient. By doing so, we were able to lower the number of electrodes to be applied to the patient’s body by half, reconstructing the missing views of the heart with proven techniques of signal processing.

As shown in the flow chart, the data is filtered for noise and baseline shift after the acquisition. The filtered signal is then processed and analyzed using different signal processing and machine learning techniques.

Signal processing is used to identify specific points in the wave, called QRS complexes, that are associated with each beat. Using those results, we compute the beats per minute (BPM) to detect forms of irregularity in the rhythm like tachycardia and bradycardia. 

For what concerns the classification of the anomalies in the signal we relied on machine learning and, in particular, we explored different typologies of neural networks. A first version of our algorithm relied on recurrent neural network architectures (RNN), chosen for their flexibility in analyzing time-series data, but we later developed a convolution-based neural network (CNN), which offered better results in terms of accuracy. One of the greatest challenges we faced was to find a rich and reliable dataset to train our neural networks. This is common to many machine learning problems as data, especially in the medical field, is often held private and not released to the public. The dataset of our choice came from PhysioNet and required a significant amount of preprocessing before use.

The last phase of our project was to develop a user interface tailored for the target audience of Anomalous: medical staff and paramedics. We focused on eliminating the need for a manual research of the problem, by presenting both a classic visualization of the ECG and a direct view on the detected anomalies, identified by a letter and displayed with a dedicated graph.

L'articolo Anomalous: A faster approach to ECG analysis in emergency situations proviene da NECSTLab.

By Greta Valsecchi and Alice Arcardini
JEMP members and student, Politecnico di Milano

The horizon of student associations is very broad, varied and welcoming: we deal with representation, social, political, cultural, sports and entertainment projects. In different ways and forms, the aim is to bring students closer to the academic institution, to provide tools to enrich the course of study.
Projects, people and ideas are just some of the benefits available to students who want to get involved to do something more.
Sometimes these realities even manage to create a very tangible bridge between the academic classroom and the world of work: at the Politecnico di Milano one of these bridges is supported by JEMP.

JEMP is the name of the Junior Enterprise of the Politecnico di Milano.
It is an organization of students from different faculties who
carry out projects for external companies in thiw way engaging and sharing different skills and backgrounds. The functioning principle is similar a small consulting firm’s one, where the service portfolio is modulated on the people who are part of the association.
JEMP welcomes mainly engineering and design students and is dedicated to projects ranging from business plans to the definition of a coordinated image, having startups, SMEs and multinationals as clients.
The point is always to get involved and learning by doing.
Within a reality of this type, one learns to approach new issues and problems with flexibility and method, to manage projects, time and resources. Furthermore, in the context of external projects and the management of the internal organization, one is in contact and in continuous collaboration with other members. People are the true asset of a Junior Enterprise and their enthusiasm is the most powerful engine.

JEMP is located within the Italian network of Junior Enterprises, which brings together associations linked to universities located throughout the territory. This provides further opportunities for growth, comparison and collaboration between Junior and companies.
The creation of synergies is also very interesting within the Politecnico: JEMP has collaborated with NECSTLab, the innovative laboratory that works within the Department of Electronics, Information and Bioengineering, organizing a two-days workshop on the topic of Time Management. Alice Arcardini and Lorenzo Chiesa, two members of JEMP, in this occasion have deepened the theories and best practices on the organization and planning of their daily routine, also based on their life divided between lessons, studies and projects by Junior Entrepreneurs.
The topics covered were those of the work-life balance and how to manage one’s time in an optimal manner. The main issues which can be found during a process of this kind have been analyzed: procrastination, stress management, quantification of time, priority and importance, coordination with the team.

Another collaboration with the NECSTLab involved the participation of two JEMPers at the NECST Tech time on Wednesday 6 November, a program dedicated to the study themes of the NECSTLab which is broadcasted on POLI.RADIO. During this episode there was still the opportunity to explain the reality of JEMP and its different aspects.
In future, there will be other collaborations with NECSTLab such as the collaboration of some JEMPers in the StartUp101 course, in the context of “Passion in Action” program.

L'articolo Student associations: JEMP and NECTSLab proviene da NECSTLab.

by Marco Domenico Santambrogio & Carlotta Marchesini

Il progetto del NecstCamp, di cui abbiamo parlato in un precedente post, lavora per fasi, facendo leva su alcune “metafore”. La prima fase è quella dell’io, una fase in cui i partecipanti si riscoprono unici e tutti diversi. Una fase in cui si prende consapevolezza del fatto che non è vero che la diversità sia un valore, ma semplicemente la normale condizione in cui ciascuno di noi si trova: nessuna persona è uguale, per quanto simile, al suo vicino...

L'articolo NecstCamp: la strategia di lavoro proviene da NECSTLab.

by Marco Domenico Santambrogio & Carlotta Marchesini

Quello che sapevamo a settembre 2017 era di avere la volontà di iniziare un progetto che avesse come obiettivo principale quello di sviluppare negli studenti una maggior consapevolezza in se stessi e nei propri mezzi. Questo progetto ha preso il nome di NecstCamp, ed è iniziato con 23 studenti del laboratorio che si incontravano una volta alla settimana alle 6:45 negli spogliatoi del Campo Sportivo Giuriati per il piacere di trovarsi insieme e insieme fare un po’ di “sana fatica” con degli allenamenti “funzionali”...

L'articolo NecstCamp: un progetto PoliMi per la crescita collettiva proviene da NECSTLab.

By Rolando Brondolin and Alberto Parravicini
PhD Students at NECSTLab, Politecnico di Milano @NECSTLab, Politecnico di Milano

Along with classical frontal lessons, Politecnico di Milano decided to add new classes to the “Passion In Action” program, to support the development of transversal, soft and social skills to encourage and facilitate students in enriching their personal, cultural and professional experience. These classes are optional and based on innovative teaching techniques.

Within this context our laboratory proposed in collaboration with Oracle Labs the “High Performance Computing – graph and data analytics” course. This class teaches from the fundamentals of graph-based computing to advanced topics in graph computations and graph data structures. These topics are of paramount importance nowadays as the internet and social media completely changed how we work, live and interact with each other. At the base of this internet revolution, we now have billions of entities (e.g. web pages, users, servers) connecting each other with trillions of edges (e.g. hypertext links, friendships, network links). Graphs are the best way to represent and describe this continuously growing scenarios in the most efficient way.

This year’s edition started on the 26th of October with 100 students and the theoretical lessons will continue until the 15th of November. After the theoretical lessons, the students that are interested in practical activities and that are interested in better understanding the topics of the class can enroll in a contest that will last until the 15th of December. During the contest, the students can put to practice the concepts of the classes in two different tracks: “Efficient Query Planning” and “Entity Resolution using Machine Learning Approaches”. The former requires the students to develop heuristic techniques to find a good trade-off between query planning and query execution over graph instances of different types and shapes. The latter, instead, requires the students to find techniques based on ML and AI to detect whether two entities have the same identity, and is widely used in fraud detection.

Students can team up with a friend to participate in the contest. The winners will have the chance to join the NECST Group Conference 2020 and will have the chance to be selected for internship opportunities within Oracle Labs.

This year we reached the second edition of the High Performance Computing – graph and data analytics. The first edition involved 70 students joining the theoretical lessons, while 20 groups of 2 students decided to continue with the contest. In the end, we had 8 submissions in total with 2 teams winning the 2 tracks of the contest. After this step, the students continued to work to improve their solutions and they had the chance to collaborate with the NECSTLab and with Oracle Labs on selected research topics.

L'articolo High Performance Computing – Graph and data analytics proviene da NECSTLab.