Summary

Novelty-based approach to intrusion detection, using one-class classifiers.

One-class classifiers require only non-anomalous data to exist in training set => allows for the use of flight-logs as training data.

Dataset: UAV Attack Dataset

• Data generated for testing is in SITL and HITL (no real life flights).
• Data generated for training appears to be with real flights.

GPS spoofing is used in paper as common example of external sensor-based attack.

Novelty detection, rather than anomaly detection, provides ability to learn from a training dataset where anomalies are not present.

Contributions

Propose use of one-class novelty detection techniques for intrusion detection.

Discuss how one-class classifiers can be used to solve unavailability of labelled UAV intrusion detection datasets.

Demonstrate performance of various classifiers using data from simulated flights.

Methodology

Pre-Processing

Features unique to components or sensors are clustered and separate models are trained for each cluster. Unrelated or autopilot-specific features are dropped (for universality).

Flight logs split into multiple CSVs based on sensor/topic logged.

Interpolate values for topics that are being polled at slower rate.

Principal Component Analysis is performed transform set of features into principal components to better explain variance in original set.

Training and Tuning

Two datasets to train and test:

• Benign dataset without malicious data to train and fit model.
• Dataset with benign and malicious data to test model.

One-Class Support Vector Machine (semi-supervised) trained on benign data

Autoencoder neural networks trained on benign dataset using mean squared error (MSE) loss function.

Local Outlier Factor is a density-based method (effective on lower dimension data)

Performance Evaluation

Experiment Design

Mostly SITL with some HITL is used for data collection.

All flights are autonomous survey missions between 10-30 minutes depending on UAV's maximum velocity.

Attack Simulation

PX4 - Autopilot and Gazebo

Fail-safes are disabled.

GPS spoofing is used as it is "common sensor-based attack".

Subject to sensor spoofing for 30 seconds.

Using a plugin for the sim environment, GPS data at higher rate is published which the UAV uses. This is spoofed signal.

Dataset Creation

Saved flight logs in ULOG format, downloaded after each flight and timestamps removed from logs.

Attack start and end times are labelled to assist in performance analysis.

Evaluation

This is only verified against simulated data