OS Kernel fuzzers such as Syzkaller often struggle to generate syscall sequences that respect intrinsic Syscall Dependency Relations (SDRs), resulting in seeds that either violate kernel constraints or fail to reach deep execution paths. We propose leveraging an N-gram model to learn SDRs from both kernel execution history and ongoing fuzzing results. This enables the fuzzer to capture dependencies in similar kernel versions while adapting to target-specific behaviors, thereby improving the validity of generated seeds. Additionally, we introduce a bidirectional Random Walk strategy to enhance the diversity of generated seeds. We implement this approach in a prototype, Psyzkaller, on top of Syzkaller. Experiments show that, trained with the large-scale DongTing dataset and continuously updated with ongoing fuzzing results, Psyzkaller improves Syzkaller's code coverage by 4.6

The prevalence of cryptographic API misuse (CAM) is compromising the effectiveness of cryptography and in turn the security of modern systems and applications. Despite extensive efforts to develop CAM detection tools, these tools typically rely on a limited set of predefined rules from human-curated knowledge. This rigid, rule-based approach hinders adaptation to evolving CAM patterns in real practices. We propose leveraging large language models (LLMs), trained on publicly available cryptography-related data, to automatically detect and classify CAMs in real-world code to address this limitation. Our method enables the development and continuous expansion of a CAM taxonomy, supporting developers and detection tools in tracking and understanding emerging CAM patterns. Specifically, we develop an LLM-agnostic prompt engineering method to guide LLMs in detecting CAM instances from C/C++, Java, Python, and Go code, and then classifying them into a hierarchical taxonomy. Using a data set of 3,492 real-world software programs, we demonstrate the effectiveness of our approach with mainstream LLMs, including GPT, Llama, Gemini, and Claude. It also allows us to quantitatively measure and compare the performance of these LLMs in analyzing CAM in realistic code. Our evaluation produced a taxonomy with 279 base CAM categories, 36 of which are not addressed by existing taxonomies. To validate its practical value, we encode 11 newly identified CAM types into detection rules and integrate them into existing tools. Experiments show that such integration expands the tools' detection capabilities.

INTRODUCTION:The need for remote ventilator control has been highlighted by the COVID-19 Public Health Emergency. Remote ventilator control from outside a patient's room can improve response time to patient needs, protect health care workers, and reduce personal protective equipment (PPE) consumption. Extending remote control to distant locations can expand the capabilities of frontline health care workers by delivering specialized clinical expertise to the point of care, which is much needed in diverse health care settings, such as tele-critical care and military medicine. However, the safety and effectiveness of remote ventilator control can be affected by many risk factors, including communication failures and network disruptions. Consensus safety requirements and test methods are needed to assess the resilience and safety of remote ventilator control under communication failures and network disruptions. MATERIALS AND METHODS:We designed two test methods to assess the robustness, usability, and safety of a remote ventilator control prototype system jointly developed by Nihon Kohden OrangeMed, Inc. and DocBox, Inc. ("the NK-DocBox system") to control the operation of an NKV-550 critical care ventilator under communication failures and network disruptions. First, the robustness of the NKV-550 ventilator was tested using a remote-control application developed on OpenICE - an open-source medical device interoperability platform - to transmit customized high-frequency and erroneous remote-control commands that could be caused by communication failures in a real-world environment. The second method utilized a network emulator to create different types and severity of network quality of service (QoS) degradation, including bandwidth throttling, network delay and jitter, packet drop and reordering, and bit errors, in the NKV-DocBox system to quantitatively assess the impact on system usability and safety. RESULTS:The NKV-550 ventilator operated as expected when remote-control commands arrived as fast as once per second. It ignored erroneous commands attempting to adjust invalid ventilation parameters. When facing commands that set the ventilation mode and parameters to invalid values, it reset the ventilation mode or parameters to default values, the safety implication of which may merit further evaluation. When any network QoS attribute (except for packet reordering) started to degrade, the NK-DocBox System experienced interference to its remote-control function, such as delays in the transmission of ventilator data and remote-control commands within the system. When the network QoS was worse than 500 ms network delay, 100 ms network jitter, 1% data drop rate, 12 Mbps minimal bandwidth, or 1e-6 bit error rate, the system became unsafe to use. For example, ventilator waveforms visualized on the remote-control application demonstrated freezes, out-of-synchronization, and moving backwards; and the connection between the ventilator and the remote-control application became unstable. CONCLUSION:The presented test methods confirmed the robustness of the NKV-550 ventilator against high-frequency and erroneous remote control, quantified the impact of network disruptions on the usability, reliability, and safety of the NK-DocBox system and identified the minimum network QoS requirements for it to function safely. These generalizable test methods can be customized to evaluate other remote ventilator control technologies and remote control of other types of medical devices against communication failures and network disruptions.

Clinical alarm and decision support systems that lack clinical context may create non-actionable nuisance alarms that are not clinically relevant and can cause distractions during the most difficult moments of a surgery. We present a novel, interoperable, real-time system for adding contextual awareness to clinical systems by monitoring the heart-rate variability (HRV) of clinical team members. We designed an architecture for real-time capture, analysis, and presentation of HRV data from multiple clinicians and implemented this architecture as an application and device interfaces on the open-source OpenICE interoperability platform. In this work, we extend OpenICE with new capabilities to support the needs of the context-aware OR including a modularized data pipeline for simultaneously processing real-time electrocardiographic (ECG) waveforms from multiple clinicians to create estimates of their individual cognitive load. The system is built with standardized interfaces that allow for free interchange of software and hardware components including sensor devices, ECG filtering and beat detection algorithms, HRV metric calculations, and individual and team alerts based on changes in metrics. By integrating contextual cues and team member state into a unified process model, we believe future clinical applications will be able to emulate some of these behaviors to provide context-aware information to improve the safety and quality of surgical interventions.

Risk management is a key part of the development of medical devices to achieve acceptable product safety and pass regulatory scrutiny. As model-based development (MBD) techniques gain ground in the medical device industry, the medical device industry needs guidelines on the best practices of integrating risk management principles and activities in MBD-driven product development. In this paper, we demonstrate how the SAE standard Architecture, Analysis, and Definition Language (AADL) and its Error Modeling (EM) annex can be applied in the development of an open-source patient-controlled analgesic (PCA) pump to support the risk management tasks of ISO 14971 - the primary risk management standard in the medical device domain. While AADL EM has been applied in other domains, our work provides the first mapping of AADL EM to ISO 14971 concepts. It not only represents one of the largest applications to-date of AADL’s EM framework, but also provides the industry and academia an example with considerable complexity to investigate methodologies and methods of integrating MBD and risk management. This work is part of the Open PCA Pump project, which presents a variety of open source integrated development artifacts for a realistic medical device.

OBJECTIVE:This paper presents a hardware-in-the-loop (HIL) testing platform for evaluating the performance of fluid resuscitation control algorithms. The proposed platform is a cyber-physical system that integrates physical devices with computational models and computer-based algorithms.METHODS:The HIL test bed is evaluated against in silico and in vivo data to ensure the hemodynamic variables are appropriately predicted in the proposed platform. The test bed is then used to investigate the performance of two fluid resuscitation control algorithms: a decision table (rule-based) and a proportional-integral-derivative (PID) controller.RESULTS:The statistical evaluation of test bed indicates that similar results are observed in the HIL test bed, in silico implementation, and the in vivo data, verifying that the HIL test bed can adequately predict the hemodynamic responses. Comparison of the two fluid resuscitation controllers reveals that both controllers stabilized hemodynamic variables over time and had similar speed to efficiently achieve the target level of the hemodynamic endpoint. However, the accuracy of the PID controller was higher than the rule-based for the scenarios tested in the HIL platform.CONCLUSION:The results demonstrate the potential of the HIL test bed for realistic testing of physiologic controllers by incorporating physical devices with computational models of physiology and disturbances.SIGNIFICANCE:This type of testing enables relatively fast evaluation of physiologic closed-loop control systems to aid in iterative design processes and offers complementary means to existing techniques (e.g., in silico, in vivo, and clinical studies) for testing of such systems against a wide range of disturbances and scenarios.

The current work assessed U.S. medical device recalls during 2012-15, with the goal of under-standing the impact and nature of user interface (UI) software errors in medical devices. Based on information from the Food and Drug Administration's public and internal recall databases, 423 (~140/year) medical device recalls were identified as resulting from UI software errors, which accounted for nearly one-half of recalls caused by software errors during the same period. A total of 499 UI software errors were identified as the root causes of medical device recalls, and a detailed classification of those errors (into 20 categories) was established. This error classification can be used by device manufacturers, end users (e.g., healthcare providers), and regulatory authorities to raise awareness of the type and impact of UI software errors. The classification also provides stakeholders with an evidence-based challenge to assess and improve the quality of UI software in medical devices.

Medical devices are increasingly being built using interoperability and platform approaches that enable devices and service components from different manufacturers to be combined flexibly into "systems of systems", so as to achieve integrated care-giving solutions that aim to exceed the capabilities of standalone devices with reduced likelihood of medical errors. In these situations, the primary medical device domain tasks such as risk management are distributed across the organization boundaries of multiple stakeholders, each of whom contributes components as well as development and assurance artifacts to establish the final system and support system assurance arguments. However, ISO 14971 - the primary medical device risk management standard - focuses on single-manufacturer monolithic device and hence cannot effectively guide distributed risk management activities across stakeholders. In this paper, we provide a set of risk management objectives for distributed development of interoperable medical systems. These objectives can be seen as augmenting the requirements of ISO 14971 to provide additional criteria for achieving safe and secure interoperability via integration of components from multiple vendors. These objectives may also be used as top-level claims in assurance cases for interoperable medical products or form the basis of requirements in emerging standards for safe and secure interoperability.

Use error is one of the leading causes of medical device incidents. It is crucial for all stakeholders to have a unified means to better understand, classify, communicate, and prevent/avoid medical device use errors. In this paper, we present our ongoing work on developing a new use error taxonomy for medical devices that has the potential to enable fine-grained analysis of use errors and their root causes in system design. Our ultimate goal is to create a generic framework that can be used by medical device designers to better identify effective design solutions to mitigating use errors.

Building safe and secure interoperable medical devices with accompanying assurance artifacts is challenging. Many start-up companies have great ideas for innovation, but are not familiar with appropriate safety/security-critical engineering processes, architecture principles, risk management, and assurance techniques. Larger, more experienced, companies may face hurdles in re-engineering their devices for interoperability and greater security. In academia, researchers often have good techniques for addressing some of the issues above, but are not familiar with how a realistic medical device is developed and assured. Building a prototype medical device for a classroom project or research work to validate proposed techniques is often a huge effort. The Open PCA Pump illustrates a full suite of realistic development artifacts including use cases, requirements, architecture models, verified source code, testing and simulation infrastructure, risk management artifacts, and assurance cases that can be used to develop shared understanding of medical device innovations across the academic, industry, and regulatory communities.1

This paper presents the design and implementation of a software application, called MEWS, that implements the Royal College of Physician’s National Early Warning (scoring) System on the OpenICE interoperable platform. The MEWS app, as a real-time clinical decision support (RT-CDS) application, does not require the use of an Electronic Health Record System to support its operation. Instead, it is able to receive patient vital sign measurements from any patient physiological monitoring device connected to OpenICE, irrespective of the device manufacturer. Based on the received vital signs, MEWS calculates an overall score indicating the monitored patient’s current status and is intended to direct clinicians to patients showing signs of deteriorating conditions and hence needing immediate intervention. The implementation and deployment of the MEWS app on OpenICE presents a preliminary step to understand the challenge of establishing (data) interface protocols to enable medical device interoperability generally, and for RT-CDS applications in particular, and to establish requirements for bridging the gap of current industrial standardization activities in addressing this challenge.

The success of a fuzzing campaign is heavily depending on the quality of seed inputs used for test generation. It is however challenging to compose a corpus of seed inputs that enable high code and behavior coverage of the target program, especially when the target program requires complex input formats such as PDF files. We present a machine learning based framework to improve the quality of seed inputs for fuzzing programs that take PDF files as input. Given an initial set of seed PDF files, our framework utilizes a set of neural networks to 1) discover the correlation between these PDF files and the execution in the target program, and 2) leverage such correlation to generate new seed files that more likely explore new paths in the target program. Our experiments on a set of widely used PDF viewers demonstrate that the improved seed inputs produced by our framework could significantly increase the code coverage of the target program and the likelihood of detecting program crashes.