Open Challenge for Intrusion Detection on Air-Ground Communication: From Data Analysis to Simulation

Military and civil Unmanned Aerial Systems (UASs) have already started widely populating the airspace. UAS will share the same airspace routes with other aircraft and carry out distinct missions. The operation of such systems relies on secure communication between UASs and Ground Control Stations (G...

Full description

Saved in:
Bibliographic Details
Main Authors: de Carvalho Bertoli, Gustavo, Suri, Rohan, Rizos, Athanasios, Pereira, Daniel Patrick
Format: Conference Proceeding
Language:English
Subjects:
Air-Ground Communication
Data analysis
Feature extraction
Intrusion detection
Machine learning
Machine learning algorithms
Malicious Behavior
MAVLink
Military aircraft
Routing protocols
SITL
UAV
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Military and civil Unmanned Aerial Systems (UASs) have already started widely populating the airspace. UAS will share the same airspace routes with other aircraft and carry out distinct missions. The operation of such systems relies on secure communication between UASs and Ground Control Stations (GCS). Recent publications have shown that UAS communication protocols like MAVLink are vulnerable to attacks compromising their operations. In this paper, we evaluate an intrusion detection mechanism on an air-ground communication system using Machine Learning (ML) methods. To validate our approach, we evaluated the performance of our algorithm through a Software-In-The-Loop (SITL) testbed. We captured normal and abnormal traffic operations in the testbed, with Man-In-The-Middle (MITM) attacks representing the abnormal traffic operations. Next, we derived generic aggregation features (statistics) over MAVLink messages and evaluated supervised and unsupervised methods to detect the attack. The supervised decision tree method presented the best performance (F1-score 0.99) during this analysis. In contrast to the sound performance during data analysis, the detection algorithm did not perform as expected when integrated into the SITL testbed environment. This behavior raises some open challenges for network-based intrusion detection on UAS operation, and this paper aims at setting the stage for further discussions and research initiatives.
ISSN:2155-7209
DOI:10.1109/DASC58513.2023.10311274