Rik Chatterjee

Embedded & Cyber-Physical Systems Security

Rik Chatterjee

Ph.D. Student in Systems Engineering at Colorado State University.

I study the security and assurance of embedded and cyber-physical systems, with a particular focus on transportation and critical infrastructure. My work combines embedded network security, firmware and binary analysis, formal methods, model-based systems engineering, real-time systems, and experimental cybersecurity infrastructure.

I am a member of the Systems Cyber Lab at Colorado State University, advised by Dr. Jeremy Daily. My current work examines how vulnerabilities, software modifications, and security reasoning can be understood across network, firmware, and system-design layers.

Email me View publications Research overview

Research

My research focuses on understanding and assuring security in long-lived, resource-constrained embedded systems where protocol behavior, firmware, timing, and system architecture interact.

Embedded Network Security

I investigate vulnerabilities in protocols used by commercial vehicles and maritime systems, including SAE J1939, Unified Diagnostic Services (UDS), and NMEA 2000. My work studies how protocol state, resource limitations, and trust assumptions create exploitable behavior.

Firmware & Binary Assurance

I use firmware reverse engineering and binary analysis to study vulnerability discovery, persistent compromise, and software modification in legacy embedded systems, including work on assured micropatching of real-time software.

Formal & Model-Based Assurance

My current work explores how formal methods and model-based systems engineering can connect high-level system properties with low-level software artifacts, supporting reasoning about the security of software modifications.

Security Reasoning at the Edge

I support deployment of AI-based planning at the edge for security reasoning, focusing on how planner-generated actions can be constrained by the capabilities, interfaces, and operating conditions of physical embedded systems.

Experimental Cybersecurity Infrastructure

I contribute to physical and remotely accessible testbeds for reproducible transportation cybersecurity research, including commercial-vehicle networks, SPHERE-CAN, and hardware-based experimental platforms.

Critical Infrastructure Applications

My work applies embedded security and assurance methods across commercial vehicles, maritime systems, and energy infrastructure, with an emphasis on problems that span software, network, and system-design layers.

Research Experience

Graduate research in embedded systems security, assurance, transportation, maritime systems, energy systems, and experimental cyber infrastructure.

May 2026 — Aug 2026

Graduate Research Assistant

Systems Cyber Lab, Colorado State University
  • Investigated NMEA 2000 Fast Packet security through analysis of reassembly, malformed and interrupted transfers, competing sources, and message injection on commercial maritime systems.
  • Extended maritime firmware-security research through analysis of NMEA 2000 firmware-update mechanisms and transport-layer behavior.
  • Applied formal methods and MBSE to embedded energy systems through BYTE-RI, focusing on software behavior, interfaces, and secure software modification.
  • Supported deployment of AI-based planning at the edge for security reasoning on constrained embedded devices.
  • Contributed to SPHERE-CAN, integrating physical ECUs and CAN networks with remotely accessible SPHERE research infrastructure.
May 2025 — Aug 2025

Graduate Research Assistant

Systems Cyber Lab, Colorado State University
  • Investigated persistent firmware-level compromise of a commercial maritime autopilot through firmware extraction, binary analysis, modification, and experimental evaluation.
  • Studied the relationship between NMEA 2000 network access and persistent compromise of embedded maritime devices.
  • Began integrating formal analysis with firmware and binary analysis for embedded energy systems through BYTE-RI.
  • Contributed to research on deploying AI-based planning capabilities at the edge for security reasoning.
Jan 2022 — Dec 2024

Graduate Research Assistant

Systems Cyber Lab, Colorado State University
  • Investigated vulnerabilities in SAE J1939 and UDS, including transport, diagnostic, and network-management weaknesses in commercial vehicle ECUs.
  • Developed a proof-of-concept truck-to-truck attack demonstrating how a compromised Electronic Logging Device could support propagation between commercial vehicles.
  • Conducted firmware reverse engineering and binary analysis of legacy real-time embedded systems.
  • Developed and evaluated assured micropatching techniques for legacy software, including race-condition and concurrency vulnerabilities.
  • Contributed to Technical Area 3 of DARPA AMP through challenge-problem development and experimental evaluation of micropatching approaches.
  • Developed a production-ECU commercial-vehicle network testbed (“truck-in-a-box”) using Cummins ECUs and CAN networking.
  • Investigated model-based approaches to cybersecurity analysis of cyber-physical systems.

Publications

Peer-reviewed journal articles, conference papers, and research articles.

Peer-Reviewed Journal Articles

Denial of Service Vulnerabilities in Commercial Vehicles: Exploiting Diagnostic Protocol Flaws
Carson Green, Rik Chatterjee, Jeremy Daily. ACM Transactions on Cyber-Physical Systems, vol. 10, no. 1, Article 3, 25 pages, 2026.
DOI
TruckSentry: Context Aware Intrusion Detection and Prevention System for J1939 Networks
Subhojeet Mukherjee, Rik Chatterjee, Jeremy Daily. IEEE Open Journal of Intelligent Transportation Systems, vol. 6, pp. 294–309, 2025.
DOI

Peer-Reviewed Conference Papers

Adversarial Commercial Vehicle Datasets with Protocol Aware Annotation for Cybersecurity Research
Chandrima Ghatak, Rik Chatterjee, Jeremy Daily. Security and Privacy in Cyber-Physical Systems and Smart Vehicles (SmartSP 2025), LNICST, vol. 699, Springer, 2027.
DOI
Bypassing CARB Regulations and Manipulating Vehicle Compliance Data via DLL Hijacking
Tyler Biggs, Rik Chatterjee, Jeremy Daily. Security and Privacy in Cyber-Physical Systems and Smart Vehicles (SmartSP 2025), LNICST, vol. 699, Springer, 2027.
DOI
Short Paper: Software Bill of Materials Management for Embedded Vehicle Systems
Teddy Nyambe, Rik Chatterjee, Jeremy Daily. Security and Privacy in Cyber-Physical Systems and Smart Vehicles (SmartSP 2024), LNICST, vol. 622, Springer, 2025.
DOI
A Systems Approach for Designing Open Vehicle Data Archiving Systems
Chandrima Ghatak, Rik Chatterjee, Martin Trae Span, Jeremy Daily. 2024 IEEE International Symposium on Systems Engineering (ISSE), Perugia, Italy, pp. 1–8, 2024.
DOI
A Demonstration of MBSEsec Applied to Securing Cyber-Physical System Communications
Gabe Salinger, Trae Span, Rik Chatterjee, Jake Jepson, Jeremy Daily. 2024 IEEE Aerospace Conference, Big Sky, MT, pp. 1–13, 2024.
DOI
Commercial Vehicle Electronic Logging Device Security: Unmasking the Risk of Truck-to-Truck Cyber Worms
Jake Jepson, Rik Chatterjee, Jeremy Daily. Symposium on Vehicle Security and Privacy (VehicleSec), co-located with NDSS, pp. 1–12, 2024.
Exploiting Diagnostic Protocol Vulnerabilities on Embedded Networks in Commercial Vehicles
Rik Chatterjee, Carson Green, Jeremy Daily. Symposium on Vehicle Security and Privacy (VehicleSec), co-located with NDSS, 2024.
Assured Micropatching of Race Conditions in Legacy Real-Time Embedded Systems
Rik Chatterjee, Ben Karel, Ricardo Baratto, Michael Gordon, Jeremy Daily. First Workshop on Real-Time Autonomous Systems Security (RTAutoSec), in conjunction with ECRTS, Lille, France, July 2024.
Exploiting Transport Protocol Vulnerabilities in SAE J1939 Networks
Rik Chatterjee, Subhojeet Mukherjee, Jeremy Daily. Symposium on Vehicle Security and Privacy (VehicleSec), co-located with NDSS, 2023.

Articles

SPHERE-CAN: Enabling Reproducible Automotive Network Security Experimentation
Chandrima Ghatak, Christopher Tran, Rik Chatterjee, David Balenson, Jelena Mirkovic, Jeremy Daily. Symposium on Vehicle Security and Privacy (VehicleSec), co-located with the USENIX Security Symposium, 2026.
TruckSentry: Real-Time Context-Aware Intrusion Prevention for Commercial Vehicle Networks
Rik Chatterjee, Subhojeet Mukherjee, Jeremy Daily. Symposium on Vehicle Security and Privacy (VehicleSec), co-located with the USENIX Security Symposium, Seattle, WA, 2025.
Forging Clean Truck Check Test Reports with a DLL Hijacking Attack
Tyler Biggs, Rik Chatterjee, Jeremy Daily. Proceedings of the 3rd Symposium on Vehicle Security and Privacy (VehicleSec), USENIX Association, Seattle, WA, 2025.
Persistent Firmware-Level Compromise in a Maritime Autopilot System
Carson Green, Rik Chatterjee, Jeremy Daily. Proceedings of the 3rd Symposium on Vehicle Security and Privacy (VehicleSec), USENIX Association, Seattle, WA, 2025.

Teaching

Teaching experience in foundational systems engineering, software systems engineering, MBSE, and secure vehicle networking.

Aug 2026 — Present

Teaching Assistant — SYSE 501: Foundations of Systems Engineering

Colorado State University
  • Grade homework and facilitate course discussions.
  • Support course setup, instructional materials, and course activities.
  • Mentor students on systems engineering projects and problem formulation.
Jan 2026 — May 2026

Teaching Assistant — SYSE 501: Foundations of Systems Engineering

Colorado State University
  • Graded assignments, facilitated discussion, and mentored project teams.
  • Delivered classroom instruction on software systems engineering.
Aug 2025 — Dec 2025

Teaching Assistant — SYSE 501: Foundations of Systems Engineering

Colorado State University
  • Graded assignments, facilitated discussion, and supported student projects.
  • Delivered classroom instruction on model-based systems engineering (MBSE).
Jan 2025 — May 2025

Teaching Assistant — SYSE 549: Secure Vehicle and Industrial Networking

Colorado State University
  • Developed quizzes and assessment materials and graded student work.
  • Supported instruction on vehicle and industrial network security.
  • Delivered classroom instruction on the SAE J1939 Transport Protocol and protocol security.

Workshops & Tutorials

Hands-on instruction for academic and industry audiences in embedded networking, binary analysis, and software assurance.

  • Instructor — “Introduction to Compilation, Binary Reverse Engineering, and Micropatching Techniques”
    Product Cybersecurity Training Workshop, Woodward, Inc.
    Hands-on instruction
  • Instructor — “Introduction to Compilation, Binary Reverse Engineering, and Micropatching Techniques”
    Critical Infrastructure and Cybersecurity Workshop, Colorado State University.
    Hands-on instruction
  • Instructor — “Hands-On Exploration of J1939 and NMEA 2000 Networks and Their Security Flaws”
    Symposium on Vehicle Security and Privacy (VehicleSec), co-located with the USENIX Security Symposium, Seattle, WA, 2025.
    Tutorial

Talks, Presentations & Demonstrations

Selected conference presentations, demonstrations, invited talks, workshop presentations, and posters.

  • Adversarial Commercial Vehicle Datasets with Protocol Aware Annotation for Cybersecurity Research, SmartSP, Salt Lake City, UT, 2026. Conference Presentation
  • Bypassing CARB Regulations and Manipulating Vehicle Compliance Data via DLL Hijacking, SmartSP, Salt Lake City, UT, 2026. Conference Presentation
  • SAE J1939 Transport Protocol and Vulnerabilities, Woodward Product Cybersecurity Workshop, 2026. Invited Talk
  • Maritime Embedded Network Security and NMEA 2000 Vulnerabilities, 4th Workshop on Road to Future Automotive Datasets, 2025. Workshop Presentation
  • Forging Clean Truck Check Test Reports with a DLL Hijacking Attack, VehicleSec, co-located with the USENIX Security Symposium, Seattle, WA, 2025. Demonstration
  • Persistent Firmware-Level Compromise in a Maritime Autopilot System, VehicleSec, co-located with the USENIX Security Symposium, Seattle, WA, 2025. Demonstration
  • TruckSentry: Real-Time Context-Aware Intrusion Prevention for Commercial Vehicle Networks, VehicleSec, co-located with the USENIX Security Symposium, Seattle, WA, 2025. Demonstration
  • Firmware-Level Compromise in Maritime Autopilot Systems, Creator Stage, Maritime Hacking Village, DEF CON 33, Las Vegas, NV, 2025. Conference Talk
  • SAE J1939 Transport Protocol and Vulnerabilities, Woodward Product Cybersecurity Workshop, 2025. Invited Talk
  • Electronic Logging Device Security and SAE J1939, Daimler Truck, Oregon, 2024. Invited Talk
  • Truck-to-Truck Worms, Main Stage, DEF CON 32, Las Vegas, NV, 2024. Conference Talk
  • The Ultimate Truck Hacking Platform, NMFTA Cybersecurity Conference, 2024. Conference Presentation
  • Exploiting Diagnostic Protocol Vulnerabilities on Embedded Networks in Commercial Vehicle, VehicleSec, co-located with NDSS, San Diego, CA, 2023. Conference Presentation
  • UDS Vulnerabilities and Analysis of Automotive Gateways, 3rd Workshop on Road to Future Automotive Datasets, 2023. Workshop Presentation
  • Unified Diagnostic Services (UDS) Vulnerabilities, NMFTA Cybersecurity Conference, 2023. Poster
  • Exploiting Transport Protocol Vulnerabilities in SAE J1939 Network, VehicleSec, co-located with NDSS, San Diego, CA, 2023. Conference Presentation
  • J1939 Data-Link Layer Vulnerabilities in Truck Networks, 2nd Workshop on Road to Future Automotive Datasets, 2022. Workshop Presentation
  • The Request Overload Attack, INCOSE Western States Regional Conference, 2022. Poster

Honors & Awards

Research, academic, and travel recognitions.

  • ETAS Best Paper Award (Runner-up), Symposium on Vehicle Security and Privacy (VehicleSec), 2024.
  • DENSO Best Demo Award, Symposium on Vehicle Security and Privacy (VehicleSec), 2024.
  • Certificate of Academic Excellence, National Residence Hall Honorary (NRHH), 2024.
  • Certificate of Academic Excellence, National Residence Hall Honorary (NRHH), 2023.
  • Student Travel Grant, Symposium on Vehicle Security and Privacy (VehicleSec), 2023.

Education

Academic training in systems engineering and information technology.

Ph.D. in Systems Engineering

Colorado State University, Fort Collins, CO

Advisor: Jeremy Daily, Ph.D.

Expected Aug 2027

M.S. in Systems Engineering

Colorado State University, Fort Collins, CO

Thesis: Security Shortcomings of Embedded Network Protocols in Commercial Vehicles

Advisor: Jeremy Daily, Ph.D.

Dec 2024

B.S. in Information Technology

West Bengal University of Technology, Kolkata, India

Jun 2016

Contact

I am based in the Department of Systems Engineering at Colorado State University at the Energy Institute in Fort Collins, Colorado.

rik.chatterjee@colostate.edu rikchatterjee.gitlab.io