Search

This paper explores secure communication systems with a chaotic carrier. The use of chaotic oscillations instead of regular van der Pol oscillators as a signal carrier is a promising and active research area, providing not only communication systems with new protection principles and organization but also high steganographic efficiency when transmitting short messages. The problem is to select methods and techniques for mixing a useful signal into a chaotic one and its recovery on the receiver side, featuring a set of properties acceptable for implementation and real-world application. We demonstrate application of synergetic control theory (SCT), which provides advanced observer-basing methods for nonlinear dynamic systems as well as explore example of data transmission system consisting of a Genesio–Tesi chaotic oscillator, data signal transmission with a method of nonlinear modulation, and recovering with a single-channel synergetic observer at the receiver side. The paper presents a nonlinear state observer modeling procedure followed by building a MATLAB/Simulink simulation model of the data transmission system for the PC-platform along with software implementation for the Raspberry Pi platform, with simulation and experimental run results showing data transmission rates seem to be acceptable for the considered practical applications. Practical applications and limitations issues are discussed. Future research will be universal modeling procedures for different classes of chaotic generators and whole system experimental hardware implementation. The obtained results can be primarily used in short messages and/or encryption keys secure transmission systems, cyber-physical system component command communications, as well as chaotic carrier system R&D competitive studies and other applications.

Autonomous mobile robots (AMRs) combine a remarkable combination of mobility, adaptability, and an innate capacity for obstacle avoidance. They are exceptionally well-suited for a wide range of applications but usually operate in uncontrolled, non-deterministic environments, so the analysis and classification of security events are very important for their safe operation. In this regard, we considered the influence of different types of attacks on AMR navigation systems to subdivide them into classes and unified the effect of attacks on the system through their level of consequences and impact. Then, we built a model of an attack on a system, taking into account five methods of attack implementation and identified the unified response thresholds valid for any type of parameter, which allows for creating universal correlation rules and simplifies this process, as the trigger threshold is related to the degree of impact that the attack has on the finite subsystem. Also, we developed a methodology for classifying incidents and identifying key components of the system based on ontological models, which makes it possible to predict risks and select the optimal system configuration. The obtained results are important in the context of separating different types of destructive effects based on attack classes. Our study showed that it is sometimes difficult to divide spoofing attacks into classes by assessing only one parameter since the attacker can use a complex attack scenario, mixing the stages of the scenarios. We then showed how adding an attack intensity factor can make classification more flexible. The connections between subsystems and parameters, as well as the attack impact patterns, were determined. Finally, a set of unique rules was developed to classify destructive effects with uniform response thresholds for each parameter. In this case, we can increase the number of parameters as well as the type of parameter value.

На сегодняшний день вопросы, связанные с обеспечением безопасности БПЛА, весьма актуальны. Исследователям необходимо разрабатывать новые методы защиты для своевременного обнаружения атаки и реализации мер по смягчению ее последствий. В работе авторы предлагают новую концепцию обнаружения атак «изнутри» БПЛА. Идея состоит в анализе киберфизических параметров БПЛА, которые могут указывать на атаку и ее возможные последствия. Было определено, что для обнаружения атаки и определения последствий, к которым она может привести, необходимо контролировать не только исходные параметры, но и внутренние кибер-физические параметры БПЛА. Это позволит спрогнозировать возможные последствия нападения и принять экстренные меры. Проработана схема влияния атаки на БПЛА и взаимосвязь с инцидентами безопасности, построенная с использованием онтологического подхода. Рассмотрены две основные сущности БПЛА - физические и цифровые аспекты БПЛА. Также показаны примеры цепочек атак, приводящие к различным последствиям. В обзорной части выполнен анализ методов и алгоритмов обнаружения спуфинговых атак с использованием генераторов данных, на основании которого сделаны выводы об их достоинствах и недостатках. Далее, на основании проведенных экспериментов, авторы предлагают метод оценки качества данных и метод генерации аномальных наборов данных, похожих на реальные данные об атаках, которые могут применяться для разработки и тестирования методов обнаружения и блокирования атак. Описана архитектура экспериментального стенда, который был использован в рамках натурного моделирования. На данном стенде, предназначенном для разбора атак с подменой GPS (GPS-спуфинг), проходила отработка нескольких сценариев нормального полета, а затем нескольких сценариев атаки. По результатам проведенных экспериментов был предложен метод, позволяющий имитировать данные, соответствующие атаке, с требуемой точностью. Также был предложен метод оценки качества сгенерированных данных.

В данной работе рассмотрены вопросы реализации методов защиты беспилотных летательных аппаратов (БПЛА) от атак спуфинга глобальной системы позиционирования (GPS), для обеспечения безопасной навигации. Глобальная навигационная спутниковая система (GNSS) широко используется для определения местоположения БПЛА и на сегодняшний день является самым популярным навигационным решением. Это связано с простотой и относительно невысокой стоимостью данной технологии, а также точностью передаваемых координат. Тем не менее, существует множество угроз безопасности GPS-навигации. Это в первую очередь связано с природой сигнала GPS, т.к. сигнал передается в открытом виде, поэтому злоумышленник может заблокировать или подделать его. В данном исследовании проведен анализ существующих методов защиты GPS. В рамках исследования был разработан экспериментальный стенд и сценарии атак на систему GPS БПЛА. Далее были собраны данные из журнала полетов БПЛА и проведен анализ кибер-физических параметров, чтобы увидеть влияние атаки на показания бортовых датчиков. Исходя из этого, был предложен новый метод обнаружения аномалий БПЛА, основанный на анализе изменений внутренних параметров БПЛА. Этот метод самодиагностики позволяет БПЛА самостоятельно оценивать наличие изменений в его подсистемах, и выявлять признаки кибератаки. Для выявления атаки БПЛА собирает данные об изменении кибер-физических параметров на протяжении определенного периода времени, затем обновляет эти данные. В результате БПЛА необходимо определить степень различий между двумя временными рядами собранных данных. Чем больше будет степень различий между обновленными данными и предыдущими, тем больше вероятность того, что на БПЛА проводится атака.

We consider the trusted operation of cyber-physical processes based on an assessment of the system’s state and operating mode and present a method for detecting anomalies in the behavior of a cyber-physical system (CPS) based on the analysis of the data transmitted by its sensory subsystem. Probability theory and mathematical statistics are used to process and normalize the data in order to determine whether or not the system is in the correct operating mode and control process state. To describe the mode-specific control processes of a CPS, the paradigm of using cyber-physical parameters is taken as a basis, as it is the feature that most clearly reflects the system’s interaction with physical processes. In this study, two metrics were taken as a sign of an anomaly: the probability of falling into the sensor values’ confidence interval and parameter change monitoring. These two metrics, as well as the current mode evaluation, produce a final probability function for our trust in the CPS’s currently executing control process, which is, in turn, determined by the operating mode of the system. Based on the results of this trust assessment, it is possible to draw a conclusion about the processing state in which the system is operating. If the score is higher than 0.6, it means the system is in a trusted state. If the score is equal to 0.6, it means the system is in an uncertain state. If the trust score tends towards zero, then the system can be interpreted as unstable or under stress due to a system failure or deliberate attack. Through a case study using cyber-attack data for an unmanned aerial vehicle (UAV), it was found that the method works well. When we were evaluating the normal flight mode, there were no false positive anomaly estimates. When we were evaluating the UAV’s state during an attack, a deviation and an untrusted state were detected. This method can be used to implement software solutions aimed at detecting system faults and cyber-attacks, and thus make decisions about the presence of malfunctions in the operation of a CPS, thereby minimizing the amount of knowledge and initial data about the system.

The data analysis subsystem of an Unmanned Aerial Vehicle (UAV) includes two main modules: a data acquisition module for data processing and a normalization module. One of the main features of an adaptive UAV protection system is the analysis of its cyber-physical parameters. An attack on a general-purpose computer system mainly affects the integrity, confidentiality and availability of important information. By contrast, an attack on a Cyber-Physical System (CPS), such as a UAV, affects the functionality of the system and may disrupt its operation, ultimately preventing it from fulfilling its tasks correctly. Cyber-physical parameters are the internal parameters of a system node, including the states of its computing resources, data storage, actuators and sensor system. Here, we develop a data normalization technique that additionally allows us to identify the signs of a cyber-attack. In addition, we define sets of parameters that can highlight an attack and define a new database format to support intrusion detection for UAVs. To achieve these goals, we performed an experimental study of the impact of attacks on UAV parameters and developed a software module for collecting data from UAVs, as well as a technique for normalizing and presenting data for detecting attacks on UAVs. Data analysis and the evaluation of the quality of a parameter (whether the parameter changes normally, or abrupt anomalous changes are observed) are facilitated by converting different types of data to the same format. The resulting formalized CPS model allows us to identify the nature of an attack and its potential impact on UAV subsystems. In the future, such a model could be the basis of a CPS digital twin in terms of security. The presented normalization technique supports processing raw data, as well as classifying data sets for their use in machine learning (ML) analyses in the future. The data normalization technique can also help to immediately determine the presence and signs of an attack, which allows classifying raw data automatically by dividing it into different categories. Such a technique could form the basis of an intrusion detection system for CPSs. Thus, the obtained results can be used to classify attacks, including attack detection systems based on machine learning methods, and the data normalization technique can be used as an independent method for detecting attacks.

Here, we developed a method for detecting cyber security attacks aimed at spoofing the Global Positioning System (GPS) signal of an Unmanned Aerial Vehicle (UAV). Most methods for detecting UAV anomalies indicative of an attack use machine learning or other such methods that compare normal behavior with abnormal behavior. Such approaches require large amounts of data and significant “training” time to prepare and implement the system. Instead, we consider a new approach based on other mathematical methods for detecting UAV anomalies without the need to first collect a large amount of data and describe normal behavior patterns. Doing so can simplify the process of creating an anomaly detection system, which can further facilitate easier implementation of intrusion detection systems in UAVs. This article presents issues related to ensuring the information security of UAVs. Development of the GPS spoofing detection method for UAVs is then described, based on a preliminary study that made it possible to form a mathematical apparatus for solving the problem. We then explain the necessary analysis of parameters and methods of data normalization, and the analysis of the Kullback—Leibler divergence measure needed to detect anomalies in UAV systems.

Creation and operation of sensor systems is a complex challenge not only for industrial and military purposes but also for consumer services (“smart city”, “smart home”) and other applications such as agriculture (“smart farm”, “smart greenhouse”). The use of such systems gives a positive economic effect and provides additional benefits from various points of view. At the same time, due to a large number of threats and challenges to cyber security, it is necessary to detect attacks on sensor systems in a timely manner. Here we present an anomaly detection method in which sensor nodes observe their neighbors and detect obvious deviations in their behavior. In this way, the community of neighboring nodes works collectively to protect one another. The nodes record only those parameters and attributes that are inherent in any node. Regardless of the node’s functionality, such parameters include the amount of traffic passing through the node, its Central Processing Unit (CPU) load, as well as the presence and number of packets dropped by the node. Our method’s main goal is to implement protection against the active influence of an internal attacker on the whole sensor network. We present the anomaly detection method, a dataset collection strategy, and experimental results that show how different types of attacks can be distinguished in the data produced by the nodes.

We consider how to protect Unmanned Aerial Vehicles (UAVs) from Global Positioning System (GPS) spoofing attacks to provide safe navigation. The Global Navigation Satellite System (GNSS) is widely used for locating drones and is by far the most popular navigation solution. This is because of the simplicity and relatively low cost of this technology, as well as the accuracy of the transmitted coordinates. Nevertheless, there are many security threats to GPS navigation. These are primarily related to the nature of the GPS signal, as an intruder can jam and spoof the GPS signal. We discuss methods of protection against this type of attack and have developed an experimental stand and conducted scenarios of attacks on a drone’s GPS system. Data from the UAV’s flight log were collected and analyzed in order to see the attack’s impact on sensor readings. From this we identify a new method for detecting UAV anomalies by analyzing changes in internal parameters of the UAV. This self-diagnosis method allows a UAV to independently assess the presence of changes in its own subsystems indicative of cyber attacks.

The range of attacks implemented on wireless networks is quite wide. To avoid or reduce the likelihood of an attack, it is necessary to use various defense mechanisms. Existing protection mechanisms are not always suitable for robotic systems and may not fully provide the necessary level of security. Thus, it is necessary to develop new ways of protection, which would be specific to groups of mobile robots. In this study, we propose an analysis of the following cyber parameters: the power consumption and the residual energy, as well as an in-depth traffic analysis to evaluate the effectiveness of the attack and identify abnormal network. We realized an analysis of the behavior of robotic systems under normal conditions and determined that, by their nature, robotic systems have a static and uniform behavior. We developed an experimental stand, and also conducted a theoretical analysis to confirm our assumptions. We found that some indicators of the components of the robotic system change statically; that is, there was a little deviation from the mean. Thus, we identified a set of metrics that allow us to determine how static the operation of the robotic system and its components is. Metrics allow us to evaluate parameters such as power consumption, and incoming/outgoing/redirected/dropped network packets. The results obtained are important for creating an integrated system for detecting anomalies in robotic systems. At the same time, the robotic node can analyze these parameters independently and make calculations that do not greatly affect performance. The main idea of this paper is to define a set of metrics characterizing the static behavior of a robotic system for the further development of an anomaly detection system.