Search

Today, issues related to ensuring the safety of UAVs are very relevant. Researchers need to develop new protection methods to detect attacks in a timely manner and implement mitigation measures. The authors propose a new concept of attack detection "from inside" the UAV. The idea is to analyze the cyber-physical parameters of the UAV, which may indicate an attack, and its possible consequences. It was determined that to detect an attack and determine the consequences to which it can lead, it is necessary to control not only the initial parameters, but also the internal cyber-physical parameters of the UAV. This will allow predicting the possible consequences of an attack and taking emergency measures. A scheme of the impact of an attack on UAVs and the relationship with security incidents, built using an ontological approach, has been worked out. Two main essences of the UAV are considered - the physical and digital aspects of the UAV. Examples of chains of attacks leading to various consequences are also shown. In the review part, the analysis of methods and algorithms for detecting spoofing attacks using data generators is carried out, based on which conclusions are drawn about their advantages and disadvantages. Further, based on the experiments performed, the authors propose a method for assessing the quality of data and a method for generating anomalous data sets similar to real attack data, which can be used to develop and test methods for detecting and blocking attacks. The architecture of the experimental stand, which was used in the framework of full-scale simulation, is described. At this stand, designed to parse GPS spoofing attacks (GPS spoofing), several scenarios of a normal flight, and then several attack scenarios, were tested. Based on the results of the experiments, a method has been proposed that allows simulating the data corresponding to the attack with the required accuracy. A method for assessing the quality of fake data has also been proposed.

We consider the trusted operation of cyber-physical processes based on an assessment of the system’s state and operating mode and present a method for detecting anomalies in the behavior of a cyber-physical system (CPS) based on the analysis of the data transmitted by its sensory subsystem. Probability theory and mathematical statistics are used to process and normalize the data in order to determine whether or not the system is in the correct operating mode and control process state. To describe the mode-specific control processes of a CPS, the paradigm of using cyber-physical parameters is taken as a basis, as it is the feature that most clearly reflects the system’s interaction with physical processes. In this study, two metrics were taken as a sign of an anomaly: the probability of falling into the sensor values’ confidence interval and parameter change monitoring. These two metrics, as well as the current mode evaluation, produce a final probability function for our trust in the CPS’s currently executing control process, which is, in turn, determined by the operating mode of the system. Based on the results of this trust assessment, it is possible to draw a conclusion about the processing state in which the system is operating. If the score is higher than 0.6, it means the system is in a trusted state. If the score is equal to 0.6, it means the system is in an uncertain state. If the trust score tends towards zero, then the system can be interpreted as unstable or under stress due to a system failure or deliberate attack. Through a case study using cyber-attack data for an unmanned aerial vehicle (UAV), it was found that the method works well. When we were evaluating the normal flight mode, there were no false positive anomaly estimates. When we were evaluating the UAV’s state during an attack, a deviation and an untrusted state were detected. This method can be used to implement software solutions aimed at detecting system faults and cyber-attacks, and thus make decisions about the presence of malfunctions in the operation of a CPS, thereby minimizing the amount of knowledge and initial data about the system.

An implementation of methods for protecting unmanned aerial vehicles (UAVs) from spoofing attacks of the global positioning system (GPS) to ensure safe navigation is discussed in this paper. The Global Navigation Satellite System (GNSS) is widely used to locate UAVs and is by far the most popular navigation solution. This is due to the simplicity and relatively low cost of this technology, as well as the accuracy of the transmitted coordinates. However, there are many security threats to GPS navigation. Primarily this is due to the nature of the GPS signal, the signal is transmitted in the clear, so an attacker can block or tamper with it. This study analyzes the existing GPS protection methods. As part of the study, an experimental stand and scenarios of attacks on the UAV GPS system were developed. Data from the UAV flight logbook was collected and an analysis of cyber-physical parameters was carried out to see an effect of the attack on the on-board sensors readings. Based on this, a new method for detecting UAV anomalies was proposed, based on an analysis of changes in UAV internal parameters. This self-diagnosis method allows the UAV to independently assess the presence of changes in its subsystems and identify signs of a cyberattack. To detect an attack, the UAV collects data on changes in cyber-physical parameters over a certain period of time, then updates this data. As a result it is necessary for the UAV to determine the degree of difference between the two time series of the collected data. The greater the degree of difference between the updated data and the previous ones, the more likely the UAV is under attack.

The data analysis subsystem of an Unmanned Aerial Vehicle (UAV) includes two main modules: a data acquisition module for data processing and a normalization module. One of the main features of an adaptive UAV protection system is the analysis of its cyber-physical parameters. An attack on a general-purpose computer system mainly affects the integrity, confidentiality and availability of important information. By contrast, an attack on a Cyber-Physical System (CPS), such as a UAV, affects the functionality of the system and may disrupt its operation, ultimately preventing it from fulfilling its tasks correctly. Cyber-physical parameters are the internal parameters of a system node, including the states of its computing resources, data storage, actuators and sensor system. Here, we develop a data normalization technique that additionally allows us to identify the signs of a cyber-attack. In addition, we define sets of parameters that can highlight an attack and define a new database format to support intrusion detection for UAVs. To achieve these goals, we performed an experimental study of the impact of attacks on UAV parameters and developed a software module for collecting data from UAVs, as well as a technique for normalizing and presenting data for detecting attacks on UAVs. Data analysis and the evaluation of the quality of a parameter (whether the parameter changes normally, or abrupt anomalous changes are observed) are facilitated by converting different types of data to the same format. The resulting formalized CPS model allows us to identify the nature of an attack and its potential impact on UAV subsystems. In the future, such a model could be the basis of a CPS digital twin in terms of security. The presented normalization technique supports processing raw data, as well as classifying data sets for their use in machine learning (ML) analyses in the future. The data normalization technique can also help to immediately determine the presence and signs of an attack, which allows classifying raw data automatically by dividing it into different categories. Such a technique could form the basis of an intrusion detection system for CPSs. Thus, the obtained results can be used to classify attacks, including attack detection systems based on machine learning methods, and the data normalization technique can be used as an independent method for detecting attacks.

Purpose: development of a methodology for automating the process of analyzing security threats in cyberphysical systems, which is based on the study and analysis of the system architecture and possible risks of threat implementation, as well as the capabilities of the intruder. Method: the developed methodology is based on structuring information about the architectural features of cyberphysical systems. Structuring information and presenting it in the form of directories that are interconnected allows to determine the list of threats, vulnerabilities and attacks that are relevant to it based on structural and functional characteristics. When designing the database, an ontological approach was applied, which allows you to highlight concepts and their properties. Results: methodological recommendations for analyzing the security of cyber-physical systems have been developed, based on the study and assessment of vulnerabilities and security threats. The analysis of the structural and functional characteristics of the cyber-physical system is carried out and the main features from the point of view of information security are highlighted. Integration of new methods for assessing risks, identifying current threats, and developing effective recommendations for cyber-physical systems made it possible to create a knowledge base about threats, attacks, vulnerabilities of CPS. New threats to CPS have been identified, which are associated with their specific properties: mobility, use of wireless networks, location outside the controlled area. The result of the study is a product presented in the form of a knowledge base that allows you to determine the degree of threat of a threat for a given structural and functional characteristics of a cyber-physical system. Implemented automatic updating of information about vulnerabilities from open databases.

Here, we developed a method for detecting cyber security attacks aimed at spoofing the Global Positioning System (GPS) signal of an Unmanned Aerial Vehicle (UAV). Most methods for detecting UAV anomalies indicative of an attack use machine learning or other such methods that compare normal behavior with abnormal behavior. Such approaches require large amounts of data and significant “training” time to prepare and implement the system. Instead, we consider a new approach based on other mathematical methods for detecting UAV anomalies without the need to first collect a large amount of data and describe normal behavior patterns. Doing so can simplify the process of creating an anomaly detection system, which can further facilitate easier implementation of intrusion detection systems in UAVs. This article presents issues related to ensuring the information security of UAVs. Development of the GPS spoofing detection method for UAVs is then described, based on a preliminary study that made it possible to form a mathematical apparatus for solving the problem. We then explain the necessary analysis of parameters and methods of data normalization, and the analysis of the Kullback—Leibler divergence measure needed to detect anomalies in UAV systems.

Creation and operation of sensor systems is a complex challenge not only for industrial and military purposes but also for consumer services (“smart city”, “smart home”) and other applications such as agriculture (“smart farm”, “smart greenhouse”). The use of such systems gives a positive economic effect and provides additional benefits from various points of view. At the same time, due to a large number of threats and challenges to cyber security, it is necessary to detect attacks on sensor systems in a timely manner. Here we present an anomaly detection method in which sensor nodes observe their neighbors and detect obvious deviations in their behavior. In this way, the community of neighboring nodes works collectively to protect one another. The nodes record only those parameters and attributes that are inherent in any node. Regardless of the node’s functionality, such parameters include the amount of traffic passing through the node, its Central Processing Unit (CPU) load, as well as the presence and number of packets dropped by the node. Our method’s main goal is to implement protection against the active influence of an internal attacker on the whole sensor network. We present the anomaly detection method, a dataset collection strategy, and experimental results that show how different types of attacks can be distinguished in the data produced by the nodes.

The object of the research is various wireless communication networks to determine their characteristics, inherent vulnerabilities, the consequences of using these vulnerabilities, the possibility of introducing wireless communication modules into the UAV and using them to perform deception tasks and deception of the UAV. As a result of the research, a Wi-Fi-based UAV deception module was implemented and its full automation, the main objectives, and stages of the UAV deception module implementation, achieving results in the implementation of some of them and a scenario for the application of the module were developed. The module can be useful not only for the protection of UAV itself, but also for the protection of smart cities and smart devices. The module makes it possible to create false information fields and compromise an attacker who wants to connect to legitimate smart things. If many fake hotspots with higher signal levels are created around a real smart city device, it can also be used to hide legitimate hotspots.

Cyber-physical systems are used in many areas of human life. But people do not pay enough attention to ensuring the security of these systems. As a result of the resulting security gaps, an attacker can launch an attack, not only shutting down the system, but also having some negative impact on the environment. The article examines denial of service attacks in ad-hoc networks, conducts experiments and considers the consequences of their successful execution. As a result of the research, it was determined that an attack can be detected by changes in transmitted traffic and processor load. The cyber-physical system operates on stable algorithms, and even if legal changes occur, they can be easily distinguished from those caused by the attack. The article shows that the use of statistical methods for analyzing traffic and other parameters can be justified for detecting an attack. This study shows that each attack affects traffic in its own way and creates unique patterns of behavior change. The experiments were carried out according to methodology with changings in the intensity of the attacks, with a change in normal behavior. The results of this study can further be used to implement a system for detecting attacks on cyber-physical systems. The collected datasets can be used to train the neural network.

Today, the creation of intelligent sensors became possible due to the development of the hardware base, the use of small boards, where the processor, memory, and network interfaces can be placed. Examples of such cards can be Raspberry Pi, Arduino, and others. These devices can be used to connect various sensors to them depending on the tasks. Today, there are many protocols for the exchange of messages between such sender devices, which ultimately leads to the creation of distributed networks with distributed functionality. Such systems can be decision-making and are like swarm intelligence, where each device performs its functions, but together they are a single system. This study will examine the information security issues of such systems. An analysis of threats and vulnerabilities for intelligent sensor systems was carried out. Demonstrated an attack on the secure ZigBee protocol, which is often used to create a network between smart sensors. The use of lightweight cryptography to minimize risks is proposed.

Today, the creation of UAV groups is becoming a very popular and relevant task. Nevertheless, the use of UAVs is not securely, since they are vulnerable not only to attacks by an intruder, but also to environmental influences. Thus, the occurrence of anomalies must be detected in time. This work is aimed at detecting anomalies in UAV groups and determining the type of attack. To accomplish this task, the authors have developed an experimental stand emulating traffic transmission in a UAV group. The study is based on the investigation of changes in traffic transmission patterns during normal operation and under attacks. Data sets for training a neural network were collected using an developed testbed.

In this paper, we propose a method for assessing the stability of the CPS to attacks based on the analysis of changes in network node parameters. The main purpose of this work is to develop a methodology for evaluating the ability of the catch to demonstrate trusted behavior in the normal operation of the network and during attacks. One of the research tasks is to simulate the operation of the CPS, traffic flows, provided that the network nodes are moving. The analysis of existing CPS is carried out and the structure for further modeling is revealed. Routing protocols and data transfer protocols are analyzed. The existing modeling tools are studied, and their comparative analysis is carried out to identify a suitable CPS for the specified parameters. Nine network scenarios were modeled. Including normal mode, denial of service attack, and Sybil attack. The method of calculating node trust was studied, which further contributed to the detection of a malicious node in the system.

This article is devoted to the development of a security system for a group of mobile robots. A feature of this system is the combination of various methods of security, such as detecting attacks and establishing trusted devices in one system. Thanks to the developed data analysis method, it is possible to use the same set of parameters for different security purposes. This article describes the modular system architecture. In particular, much attention is paid to the module for detecting anomalous activity. This module conducts an initial assessment of the data and identifies the fact of abnormal behavior. The module converts statistical data into a certain type of probability distribution, which is suitable for the parameter and identifies deviations from standard indicators. If an anomaly is detected, then it gives information for further study to other modules. The network simulation results and the initial parameter estimation confirm the effectiveness of the proposed methods.

This study is devoted to the problem of detecting anomalous behavior of nodes of a robotic system based on network traffic analysis. This article addresses the issue of analyzing changes in the level of network traffic passing through a network node in order to detect denial of service attacks and a black hole attack. To solve this problem, the authors propose to use probabilistic and statistical methods, as well as methods of information theory. The robot wireless network model was developed to collect statistics.

The relevance of the work lies in the fact that after solving the tasks, the results obtained, namely, the guidelines will be used in assessing the security analysis of the network of mobile robots. Indeed, the main problem in the analysis of such systems is the difference of this type of network from the usual computer networks, which in turn requires the creation of new methods and approaches to the analysis of the security of a network of mobile robots.The main goal of the work is to develop a methodology for analyzing the security of a network of mobile robots, based on research and assessment of threats and security vulnerabilities of a group of mobile robots.To achieve this goal it is necessary to solve the following tasks: to systematize data on robotic systems, to analyze the structural and functional characteristics of mobile robots, develop a typical information system for a group of mobile robots, develop a model of the offender for a group of mobile robots.

The purpose of this work is to analyze the security problems of robotic systems and analyze the approaches to assessing the security of a wireless robotic system. The solution to this problem involves the use of developed frameworks. Prefixed frameworks assume that the robotic system is divided into levels and after that it is necessary to directly protect each level. Each level has its own features and drawbacks that must be taken into account when developing a security system for a robotic system.

The range of attacks implemented on wireless networks is quite wide. To avoid or reduce the likelihood of an attack, it is necessary to use various defense mechanisms. Existing protection mechanisms are not always suitable for robotic systems and may not fully provide the necessary level of security. Thus, it is necessary to develop new ways of protection, which would be specific to groups of mobile robots. In this study, we propose an analysis of the following cyber parameters: the power consumption and the residual energy, as well as an in-depth traffic analysis to evaluate the effectiveness of the attack and identify abnormal network. We realized an analysis of the behavior of robotic systems under normal conditions and determined that, by their nature, robotic systems have a static and uniform behavior. We developed an experimental stand, and also conducted a theoretical analysis to confirm our assumptions. We found that some indicators of the components of the robotic system change statically, that is, there was a little deviation from the mean. Thus, we identified a set of metrics that allow us to determine how static the operation of the robotic system and its components is. Metrics allow us to evaluate parameters such as power consumption, and incoming/outgoing/redirected/dropped network packets. The results obtained are important for creating an integrated system for detecting anomalies in robotic systems. At the same time, the robotic node can analyze these parameters independently and make calculations that do not greatly affect performance. The main idea of this paper is to define a set of metrics characterizing the static behavior of a robotic system for the further development of an anomaly detection system.

This article discusses the problem of increasing the resistance to attack by an attacker of a mobile robot groups. The study is limited to the Sibyl attacks and distributed denial of service. An attacker affects the network by sending a large number of packets, or by redirecting the impact on himself. An attacker influences the availability of a group of mobile robots by exerting this impact. This is reflected in the fact that the unit’s battery becomes exhausted quickly. Nodes constantly remain in the active mode, receive packets of an attacker and respond to them. This affects the power consumption of the mobile robot. And also, the attacker also affects the network bandwidth. An attacker blocks useful network traffic by sending a large number of packets to the network and flooding it with requests. Due to congestion of wireless communication channels, collisions and queues of packets may occur, and useful packets with important information can be dropped by mobile robots. The developed method for detecting and blocking malicious nodes is based on an analysis of the parameters of the residual energy and the number of sent/received/redirected/dropped network packets. It is possible to identify a node that demonstrates abnormal behavior by analyzing the degree of deviation of these indicators of each mobile robot relative to the indices of the robot group. Probabilistic methods and methods of mathematical statistics are used for the proposed analysis.

This article discusses methods for detecting UAVs in the radio frequency range. The analysis of the existing UAV detection systems is carried out. An overview of ways to counter UAVs is presented, in particular, by carrying out attacks on navigation and communication systems. A prototype of the UAV detection system, which is based on the UAV, is presented. The UAV detection function has been implemented based on the analysis of the radio frequency spectrum.

We consider how to protect Unmanned Aerial Vehicles (UAVs) from Global Positioning System (GPS) spoofing attacks to provide safe navigation. The Global Navigation Satellite System (GNSS) is widely used for locating drones and is by far the most popular navigation solution. This is because of the simplicity and relatively low cost of this technology, as well as the accuracy of the transmitted coordinates. Nevertheless, there are many security threats to GPS navigation. These are primarily related to the nature of the GPS signal, as an intruder can jam and spoof the GPS signal. We discuss methods of protection against this type of attack and have developed an experimental stand and conducted scenarios of attacks on a drone&rsquo, s GPS system. Data from the UAV&rsquo, s flight log were collected and analyzed in order to see the attack&rsquo, s impact on sensor readings. From this we identify a new method for detecting UAV anomalies by analyzing changes in internal parameters of the UAV. This self-diagnosis method allows a UAV to independently assess the presence of changes in its own subsystems indicative of cyber attacks.

this research is devoted to the analysis of the effect of denial of service attacks on a set of specific parameters of mobile robot network nodes. This analysis made it possible to understand what parameters are appropriate to evaluate for detecting attacks. Another goal of the study was to develop a methodology for instrumental verification of the security of a group of mobile robots. For the testing of mobile robots, a device was developed based on a single-board computer, the Raspberry Pi. This device is a universal portable test device for wireless networks, both from external and internal networks. As a result of the experimental study, the set of parameters was influenced by the attacks: CPU, RAM (MB), CPU temp (°C), Power consumption (mAh), Number of packages. Analyzing these metrics of the attacker and the victim can be found. Furthermore, the effectiveness of the attack can be assessed. As a result of the research, a set of tools were identified that are best suited for the implementation of attacks.

In this paper we consider the problem of the need for deep traffic analysis to detect attacks on a network of mobile robots, as well as to assess their effectiveness. The object of the study is a group of mobile robots. It provide a means to analyze the security of mobile robot networks. It analyzes the anomalous activity of robots in a mobile network, based on analysis of traffic at the network and transport layers. To carry out such an analysis, a mathematical approach based on mathematical statistics and probability theory is used. It allows detecting attacks distributed denial of service and Sibyl attack. In addition, this technique allows us to determine what metrics are affected by this or that attack. In addition, it is possible to assess under what conditions the attack has the greatest impact on the network. In this paper, an experimental study was carried out and statistical data collected, the analysis of which allowed us to confirm theoretical assumptions.

Robotics1 is an actively developed technology, and groups of mobile robots have enormous potential for performing various tasks. To efficiently distribute and execution of tasks, it is necessary to use an appropriate cooperative control system (CCS). CCS can be used in an uncontrolled environment, where external impact is possible. From what follows the problem of determining the security of the CCS from external influences. The goal of the work is to develop a security assessment methodology for CCS. This goal of work involve the following objectives: the analysis of the wireless channel and possible attacks on it, the experimental study of these attacks, the development of a methodology based on results

The article deals with the application of FSTEC n 31 dated March 14, 2014 to the system consisting of mobile unmanned mobile robots and the operator's workplace. The article compares with other standards in the field of information security. After that, the system of mobile robots is classified and the choice of measures for the protection of information takes place. The implementation of these measures and the analysis of this implementation are shown below. At the end, a conclusion was drawn on the application of FSTEC n 31 to such systems.

This article studied the attacks that can be implemented in a network of mobile robots. The peculiarity of these attacks is that they, as a rule, use the vulnerabilities of wireless data transmission and the weakness of network protocols. The study was carried out using a simulation model of a group of mobile robots. It was modeled following attacks: denial of service, Black-Hole, Gray-Hole. In this case, it was analyzed the impact of the attacks on the energy consumption and the impact on network traffic. It was assessed the complexity of the implementation of various types of attacks. This analysis should make it clear with what intensity the attack should be conducted in order to damage the network. Also in this study, a method is proposed for calculating the trust of network nodes and the entire network as a whole based on the number of discarded packets.

The aim of this paper is to analyze the ways of providing security for mobile robots groups control (MRGC) and to develop a security protocol for MRGC under limited computational and power resources away from the controlled area. The solution for this problem assumes features of group control systems and robot systems from the security point of view. The main problem connected with the development of a security system for mobile robots is the distinction of this type of the network from other networks. This demands the development of special methods and approaches that should take many specific factors such as limitations of computational resources and power into account. The proposed solution for MRGC is based on the use of trust concept for finding the validity of nodes and finding targets. In contrast to the existing approaches, this protocol uses several parameters to evaluate the trust that allows to expand the range of repelled attacks.

The aim of this research is to develop a method that would allow to effectively detect active intruder's attacks using network traffic and physical features analysis for wireless sensor network (WSN) nodes. We analyze the physical characteristics of potential target nodes, and then design a method for malicious node identification in cases of physical features violations. The proposed method is based on the use of probabilistic functions, confidence interval calculation and finding the probability of deviation of observed parameters from the confidence interval. The novelty of the method is because we estimate the probability of observation fitting into the confidence interval and not compare with the sample distribution. In addition, the proposed method allows detecting a malicious node according to its physical features, while most intrusion detection systems (IDS) deal with the network traffic. The advantage of the proposed approach is also supported by the fact that there is a chance of attacks against physical activity (e.g., node movement disorders, power depleting, communication noises, etc.).

This article discusses the development of methodology of countering attacks based on the use of Bayes' theorem and normal distribution, where the workload, node residual energy, as well as an analysis of successful and unsuccessful network events used to compute the trust level. Estimation of the workload and the residual energy allows detecting attacks such as "Denial of Service", "Sybil" attacks directed on depletion of host resources. Direct trust calculation allows detecting "Black hole", "Grey hole" and "Wormhole" attacks. For the implementation of this methodology the software that can be installed on the base station and the network nodes was developed.

In this paper a model of secure wireless sensor network (WSN) was developed. This model is able to defend against most of known network attacks and don't significantly reduce the energy power of sensor nodes (SN). We propose clustering as a way of network organization, which allows reducing energy consumption. Network protection is based on the trust level calculation and the establishment of trusted relationships between trusted nodes. The primary purpose of the hierarchical trust management system (HTMS) is to protect the WSN from malicious actions of an attacker. The developed system should combine the properties of energy efficiency and reliability. To achieve this goal the following tasks are performed: detection of illegal actions of an intruder; blocking of malicious nodes; avoiding of malicious attacks; determining the authenticity of nodes; the establishment of trusted connections between authentic nodes; detection of defective nodes and the blocking of their work. The HTMS operation based on the use of Bayes' theorem and calculation of direct and centralized trust values.

In this paper we consider a clustering wireless sensor network which needs to be protected. The main aim of this article is development of a secure clustering wireless sensor network model with built-in detection and counteraction mechanisms against malicious impacts (attacks). We develop trust management system (TMS), based on analyzing following parameters: residual energy level, send/received/forwarding data, control, routing packets, packets integrity, availability based on beacons, changing the address of the packet. System is efficient in preventing attacks and consumes less energy than analogs.

This paper is to create a model of secure wireless sensor network (WSN), which is able to defend against most of known network attacks and don't significantly reduce the energy power of sensor nodes (SN). We propose clustering as a way of network organization, which allows reducing energy consumption. Network Protection is based on the calculation of the trust level and the establishment of trusted relationships between trusted nodes. Operation of trust management system is based on a centralized method.

In this paper we consider a clustering wireless sensor network which needs to be protected. The main aim of this article is development of a secure clustering wireless sensor network model with built-in detection and counteraction mechanisms against malicious impacts (attacks). Trust level calculation algorithm and cluster head (CH) election algorithm are introduced and secure clustering WSN model is described.