https://orcid.org/0000-0002-6393-7410
Figures
Abstract
Recently, the number of drones has increased, and drones’ illegal and malicious use has become prevalent. The dangerous and wasteful effects are substantial, and the probability of attacks is very high. Therefore, an anomaly detection and protection system are needed. This paper aims to design and implement an intelligent anomaly detection system for the security of unmanned aerial vehicles (UAVs)/drones. The proposed system is heavily based on utilizing ICMetric technology to exploit low-level device features for detection. This technology extracts the accelerometer and gyroscope sensors’ bias to create a unique number known as the ICMetric number. Hence, ICMetric numbers represent additional features integrated into the dataset used to detect drones. This study performs the classification using a deep neural network (DNN). The experimental results prove that the proposed system achieves high levels of detection and performance metrics.
Citation: Alheeti KMA, Khaled Alarfaj F, Alreshoodi M, Almusallam N, Al Dosary D (2023) A hybrid security system for drones based on ICMetric technology. PLoS ONE 18(3): e0282567. https://doi.org/10.1371/journal.pone.0282567
Editor: Kapil Kumar Nagwanshi, Guru Ghasidas Vishwavidyalaya: Guru Ghasidas University, INDIA
Received: October 7, 2021; Accepted: February 20, 2023; Published: March 21, 2023
Copyright: © 2023 Ali Alheeti et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: In this study, the dataset represents the Wi-Fi traffic data records used. Two types of data exist within this set: the bidirectional flow mode that compromised 54 features and the unidirectional flow mode that compromised 18 features.
Funding: This work was supported by the Deanship of Scientific Research, Vice Presidency for Graduate Studies and Scientific Research, King Faisal University, Saudi Arabia [Grant No. 2976].
Competing interests: The authors have declared that no competing interests exist.
Introduction
Unmanned aerial vehicles (UAVs), commonly called drones, have become more readily available, more common, and more sophisticated. UAVs support new capabilities, such as autonomous behaviour and increased data collection. Currently, due to their ease of use and accessibility, they are exploited for commercial purposes in various fields, such as surveying, delivering medicines and goods, public surveillance, agriculture, cartography, and first aid. The primary types of UAVs are presented in Fig 1.
The rapid and comprehensive development of UAVs has attracted the attention of researchers and prompted them to propose further research in the domains of defence/protection against attacks. Cybersecurity attacks can involve hacking, hijacking, or loss of the communication signals of the drone. It is also challenging to ensure the safety of UAVs moving in unwanted areas, which produces weak robustness against various cybersecurity attacks [1]. Due to the UAV network connection, it is easy for adversaries to target or control. Hence, an intelligent anomaly detection system for drones is required to ensure their safety and provide identification. In this paper, the identification and security of drones were achieved and ensured. The proposed approach is based on a new technology called an integrated circuit metric (ICMetric), which heavily depends on each device’s internal behavior. ICMetric is a new technique based on the concept of feature extraction for digital devices. However, it depends on devices’ special features to generate a single ICMetric number because every device is singular in its internal environment [2, 3] Microelectromechanical system (MEMS) sensors are utilized to generate ICMetric numbers. In other words, the bias readings extracted from these sensors will create this unique security number. The main contributions of this paper are summarized below:
- ICMetric technology is employed for the first time for drone security.
- The use of ICMetric technology aims to generate single/unique numbers by considering additional features for the detection process.
- A deep neural network is used as a classifier during the training phase for the detection system.
The rest of this paper is organized as follows: Section 2 presents related works. Section 3 presents the details of integrated circuit metric technology. Section 4 presents the methodology of the proposed system. Section 5 evaluates the efficiency of this approach through experimental results. Section 6 presents the discussions, and finally, Section 7 presents the conclusions and possibilities for future research.
Related works
This section summarises the latest research in related fields. Gritzalis et al. presented a literature review of various sensor techniques, such as accelerometers, gyroscopes, and magnetometers. These techniques are proposed for preventing, detecting, identifying, and mitigating damage from rogue drones, as well as a detailed survey of drone incidents near airports [4]. In the malicious purposes field, drones are exploited for different uses, which were reviewed in [5], along with other detection methods. The aforementioned study also analyzed the vulnerabilities of drones exploited through communication links and smart devices and hardware. Additionally, a detailed review of drone usage for various purposes in areas such as civilian, terrorist, and military domains was presented. [6] classified intrusion detection system (IDS) mechanisms used with attacks and vulnerabilities in networked drone environments. They classify the IDS mechanisms based on information gathering sources, detection methods, deployment strategies, IDS acknowledgement, detection states, and intrusion types. Another survey aimed to analyze the security threats against unmanned aircraft systems is presented in [7].
Meanwhile, [8] proposed a protection system based on a convolutional neural network (CNN) for drone detection. The system was divided into two stages, where the first aimed to detect moving objects, while the subsequent second stage intended to classify the object detected as a bird, drone, or background. The results proved that the proposed method could achieve accuracy comparable to other methods. In [9], deep learning techniques were utilized to propose an object detection system for drone detection. Various CNN techniques were used in the detection system to evaluate and test the dataset. The results showed that the proposed method based on one of the CNN techniques presented better performance than others with respect to the training dataset. Other research, based on CNN, for presenting an algorithm to solve the problem of drone detection was proposed in [10], which yielded high recall and precision values.
In [11], the authors presented a new system for detecting and tracking UAVs through a single camera mounted on various UAVs. This approach can detect and track small UAVs efficiently with limited computing resources. Moreover, they propose a lighter, inexpensive, safer, and miniaturized radar system [11]. Different types of anomalies were accurately detected by the intrusion detection system proposed for drone communication networks in [12]. An adaptive intrusion detection system for drone identification based on deep learning techniques was presented in [1]. They maintain the high true-positive rate of the IDS by using a support vector machine (SVM). The results showed that the proposed IDS could be deployed against cybersecurity attacks on UAVs with high accuracy, specificity, and sensitivity levels.
The increased frequency of attacks against drones requires an intelligent intrusion detection system for identification and protection. In [13], a novel model for intrusion detection in drones based on one-class classifiers was proposed. The model was effective across multiple UAV platforms with platform-specific F1 scores of 99.56% and 99.73% for benign and malicious sensor readings. In [14], a framework for identifying malicious attacks on the sensors of small, unmanned aircraft systems was presented. They illustrate the proposed model by detecting a spoofing attack on the global positioning system (GPS). Different conclusions were drawn using this model with a simulation dataset. [15] presented a framework for attack detection that could be used to protect the environment of medical delivery drones with active capability, delivery reliability, and other medical applications.
Having analyzed systems proposed in previous studies, this study can be distinguished from others in that it presents an identification/detection system based on the ICMetric technology that depends on individual devices’ internal behavior to provide a unique number for identification. The proposed approach has been developed to train the proposed security system by using the deep neural network technique.
Methodology
This section presents the method used to perform the proposed ICMetric detection system.
Dataset description
The consumer UAV market has developed substantially over recent years. Regardless of its enormous potential for economic development through supporting different applications, the advancement of shopper UAVs presents expected dangers to public security and individual protection. It is critically necessary to distinguish and recognize attacking UAVs to limit these dangers proficiently. Given that purchaser UAVs are usually utilized in a regular civilian environment, existing identification techniques (such as radar, vision, and sound) may become ineffectual in numerous situations. UAVs’ encrypted Wi-Fi traffic information records can be an exceptionally encouraging source to identify UAV intruders. In this work, Unmanned Aerial Vehicle (UAV) Intrusion Detection Datasets used. The dataset has been achieved from the source [16] and is available.
Notwithstanding precision, the expected runtime of the indicator technique is exceptionally significant considering that UAV gatecrashers fly many metres each second and acquire the forecast as quickly as expected. In this way, the precision and runtime of the forecast should be improved. Subsequently, pruning and working on the model would be exceptionally significant: for example, pruning the redundant highlight ages and blending the common calculations.
In this study, the dataset represents the Wi-Fi traffic data records used. Two types of data exist within this set: the bidirectional flow mode and its 54 features and the unidirectional flow mode with 18 features [16]. For this dataset, three types of drones have been utilized:
- Parrot Bebop 1
- DBPower UDI
- DJI Spark
These are as shown in Fig 2:
In this paper, the unidirectional flow mode was used to test/evaluate the security system’s performance. Meanwhile, this dataset is composed of nine features that are explained in Table 1. The dataset is a combination of various UAVs and traffic behaviour modes. Fig 3 shows a snapshot of dataset sample.
Integrated circuit metric technology (ICMetric)
Encryption systems depend on calculations that rely upon the utilization of the secret key. In attempting to improve success, however, expanding the size of the key generally does not ensure the security of the framework or prevent theft. The ID of the device, dependent on the exceptional features of every device, serves to prevent theft. Other equipment procedures vary with respect to the ICMetric innovation in the choice of device attributes. Conventional fingerprinting strategies rely on qualities that are effortlessly designed to detect, misdirect or reduce the damage inflicted by aggressors. ICMetrics use a portion of the properties that expand the intricacy of ICMetric and are difficult for an attacker to predict. Different features with uncommon application use are employed, such as perusing narratives, camera goals, normal client documents, and framework profiles [17].
ICMetrics focuses on another strategy that can utilize the features from the equipment and programming climate of a framework. Each device is unique in its internal climate; thus, the features that make each device different can be utilized to generate a single, one-of-a-kind number for every device. This depends on the following ideas [3].
- The number is not stored in the framework and can be reproduced when required.
- If the system is assaulted, there will be no burglary since the ICMetric is not stored.
- The number and any procedure results that depend on the ICMetric number will be changed if any change to the product, equipment or climate is enacted.
- There is no need for storage in any format that can serve the function of device approval.
ICMetric is a technology that has advanced alongside the security requirements for digital devices. It exploit characteristics of the model to current security. This represents a new technology that can extract software and hardware attributes. Each device is unique in its internal environment. Therefore, the features that make each device different from another can create an impressive number of known ICMetric numbers. These numbers are not saved and can be regenerated when required. As these numbers are not saved/stored, there will be no theft if the system is exposed to attacks [3]. The two phases of ICMetric are [18]:
Calibration Phase: This involves measurement of the desired feature values; generation of feature distributions for each feature illustrating the frequency of each occurrence of each discrete value for each sample device; and normalization of the feature distributions and generating normalization maps for each feature.
Operation Phase: This involves generating the ICMetric number by exploiting the device’s internal behaviour; this number is uniquely used as an additional feature for detection.
As discussed above, the generation of an ICMetric system requires two phases, which are presented in Fig 4.
ICMetric number generation
ICMetric generation starts once a device’s features have been extracted. Singular features of devices were collected, and then statistical processes were provided. The creation of ICMetric required two phases: a calibration phase and an operational phase. These phases were applied as and when required, after which the ICMetric and any relevant information were disposed of. The ICMetric and related component information is rarely imparted during any period of creation or use. This system uses ICMetric technology to generate a unique ICMetric number used for identification/detection, which will be integrated into the dataset used in this research as additional features for identification. The generation of this number is based on a mathematical model and requires some statistical analysis for this purpose. The generation process requires a probability mass (x) function to determine the precise value from the bias reading because these readings are discrete random variables.
(1)
If represents the mean, x represents a specific number of readings extracted from the accelerometer and gyroscope, while n represents a total number of readings [19].
(2)
For ICMetric generation, the standard deviation (σ2) is calculated
(3)
Furthermore, variance (s2) is calculated:
(4)
The skewness distribution (S) is calculated by Eq (5):
(5)
The confidence interval was used as calculated by Eq (6) [2].
(6)
In this paper, a security system is proposed for anomaly detection in a drone’s environment. The scheme is heavily based on readings generated by MEMS (gyroscope and accelerometer) sensors. However, the bias readings extracted from these sensors were utilized to create ICMetric numbers. An ICMetric number is a unique number that fulfilled a vital role as additional features were added to the dataset used in this work.
The proposed ICMetric detection system
The ICMetric technique depends heavily on measurable features, which were extracted from the properties of a particular digital device. The focus was on utilizing MEMS sensors in the form of gyroscopes and accelerometers.
For this research, a drone is required, where MEMS sensors are embedded and used to provide bias readings. These bias readings are employed to create an ICMetric number that is used as identification for the drone. The steps of the ICMetric detection system are shown in Fig 5.
After dataset selection, the ICMetric number was generated by a simple mathematical model as mentioned. To generate an ICMetric number, two types of MEMS sensors are utilized: the accelerometer and gyroscope. Furthermore, bias readings were extracted from these sensors to generate ICMetric numbers used as additional features integrated into the drone’s detection dataset. Two phases, the training and testing phases, were utilized to evaluate the proposed system’s efficiency. Hence, DNN is being used as an intelligent classifier for system evaluation.
Deep neural network
Deep neural network (DNN) was used to train the dataset for the proposed anomaly detection system. DNN is a subfield of machine learning used in this study as a detection classifier. More specifically, a DNN is a classification learning algorithm that uses a machine learning concept to maximize the accuracy of prediction. Moreover, DNNs are practical, robust, and accurate and are becoming increasingly important when operating in the training and testing phases.
Here, a DNN is employed to train the dataset for the proposed detection system. The DNN has three main layers: an input layer that consists of 18 neurons, three hidden layers, and an output layer. This proposal relies on increasing the detection system accuracy and decreasing the false alarm rate. Each hidden layer consists of four neurons in each hidden layer, while the output layer features two that are normal and abnormal. The testing phase was utilized to determine the system’s efficiency with respect to error rate, detection accuracy rate, and four alarm types (confusion matrix).
The measurements for choosing the best design of the DNN used in the proposed model relied on trial-and-error and the best ratio principle for neural network training. In this study, the reason for designing a DNN with 18 neurons in the input layer relates to the number of features used and will be explained further in a later section. Moreover, according to the trial-and-error principle, the optimal number of neurons for designing the hidden layer is four layers with five neurons. The best DNN structure used is presented in Fig 6.
The initial parameters that have a direct impact on the classification performance of the training phase used in the DNN are presented in Table 2.
In more details, the algorithm of deep neural network is shown below:
Algorithm 1 Deep Nural Network Algorithm
Input: Wi-Fi traffic data records after integrated with ICMetric.
Output: Anomaly detection results.
Initialize: w0,…………wn
Iterate:
For i = 0, 1, 2…‥ do
Choose learning rate ηt > 0.
Choose another parameter, goal, Gaussian radial function,…‥ (Table 1).
Starting training anomaly detection with dataset (ICMetric).
Applying threshold (99.00%) otherwise return on training phase again.
Testing phase for detection system with others.
Applying some performance criteria metrics to measure effective of the security system.
Result: Normal or Attack.
Experimental results
After dataset selection, the system is ready for training/testing phases to evaluate the performance of the proposed detection system-the total accuracy of the training reached 99.99%.
In this study, DNN is employed as an intelligent classifier to achieve more accurate results. The DNN used in this work consists of three layers: an input layer, hidden layers, and an output layer. The trial and error principle is utilised to select the number of hidden layers based on the accuracy rate. Table 3 shows the number of hidden layers that can affect the proposed detection system’s performance metrics.
According to Table 3, it is readily noticeable that the optimal number of hidden layers is four, with five neurons in each layer. Fig 7 shows the training phase with an optimal number of hidden layers with neurons.
Figs 8–10 show the performance and training status of the DNN in this detection approach.
Some metrics were utilized to calculate accuracy, effectivity, confusion matrix, and recall. These were then calculated to evaluate the efficiency of the proposed system as presented below [20]:
(7)
To measure and evaluate the proposed system performance, four types of alarms are needed: true positive (TP), true negative (TN), false positive (FP), and false negative (FN). These metrics are calculated depending on the equations in 8–11:
(8)
(9)
(10)
(11)
To evaluate efficiency, the proposed system tested for some metrics with a testing rate of 99%. Table 4 shows the classification system performance and the number of feature records used in the detection system that utilized ICMetric technology.
According to Table 4, higher rates of accuracy were achieved. Moreover, a higher rate of accuracy proved the result of using a balanced dataset achieved by a trusted source in [19]. In addition, ICMetric numbers are generated by a simple mathematical model and integrated with the dataset, resulting in a high accuracy rate. Using the equations in 8–11, the confusion matrix or alarm rate was calculated. The results are shown in Table 5.
The ratio of the correctly positively labelled results to the total number of all positive labels is known as the detection precision.
With various numbers of drones, the classification rate was calculated as presented in Table 6.
To evaluate the DNN classifier’s performance, the receiver operating characteristic (ROC) curve was measured. ROC shows the performance of the metrics for classification problems in defining the threshold of a system. The true positive rate and the false positive rate are two parameters improved by plotting the ROC curve, as presented in Figs 11 and 12.
Fig 11 shows the FP rates plotted value as the decision threshold is varied to present the ROC curve.
Fig 12 shows the TP rate’s plotted value as the decision threshold is varied to present the ROC curve.
Discussion
As presented in Tables 4–6, the detection system that is heavily based on ICMetric technology and DNN as classifiers is more effective, fast and efficient, with low error rates in detecting abnormal drones. The proposed method has presented acceptable performance results for detecting malicious drones. In Table 6, we can notice that the proposed approach has greater malicious detection ability when the number of drones is increased. The proposed ICMetric system is compared with another ordinary system to prove that the proposed system can achieve better accuracy when drones increase, as shown in Table 7. However, we can easily notice that the proposed system’s accuracy rate fluctuates because it is affected by many external factors, such as behavior, signal jamming, traffic mode, and mission type.
Fig 13 compares the proposed ICMetric system with another ordinary system (without ICMetric) to prove that the proposed system was more accurate when the number of drones increased. However, we can easily notice that the accuracy rate fluctuated because it was affected by many external factors, such as behaviour, signal jamming, traffic mode, and mission type. Finally, to demonstrate the performance of this proposed system, its performance was compared with existing IDS system UAVs. These systems exploit different specifications, models and learning algorithms.
In Table 7, the accuracy is utilized as a performance metric to enable comparison of the performance of the proposed system with those of different existing IDS methods. Consequently, it can be observed that our solution achieved a better accuracy rate of 99.99% compared to other IDS models for UAVs.
Conclusions and future directions
In this paper, an intelligent anomaly detection system was proposed for drone security against attacks depending on ICMetric technology. The proposed approach was implemented in the following phases: simulation, data collection, feature extraction, preprocessing, training, and final testing. The deep neural network technique process plays a significant role in improving the proposed system’s accuracy rate. The results of the simulation showed that the proposed detection system is accurate with respect to correctly classifying normal and abnormal behaviours and can detect malicious states and isolate them. The accuracy rates for the training and testing phases were 99.99% and 99%, respectively. In future works, the proposed system can be designed with other artificial intelligence techniques, such as support vector machines and linear discrimination analysis. In addition, the ICMetric can be extracted from ultrasound sensors equipped with a UAV.
References
- 1.
Arthur MP. Detecting Signal Spoofing and Jamming Attacks in UAV Networks using a Lightweight IDS. In: 2019 International Conference on Computer, Information and Telecommunication Systems (CITS); 2019. p. 1–5.
- 2.
Tahir H, Howells G, Hu H, Gu D, Mcdonald-Maier K. On the Incorporation of Secure Filter in ICMetrics Group Communications. In: 2014 Fifth International Conference on Emerging Security Technologies; 2014. p. 77–81.
- 3.
Tahir S, Afzal M, Tahir M. An ICMetric based key generation scheme for controlled group communication. In: IISA 2014, The 5th International Conference on Information, Intelligence, Systems and Applications; 2014. p. 373–378.
- 4. Lykou G, Moustakas D, Gritzalis D. Defending Airports from UAS: A Survey on Cyber-Attacks and Counter-Drone Sensing Technologies. Sensors. 2020;20(12).
- 5. Yaacoub JP, Noura H, Salman O, Chehab A. Security analysis of drones systems: Attacks, limitations, and recommendations. Internet of Things. 2020;11:100218.
- 6.
Choudhary G, Sharma V, You I, Yim K, Chen IR, Cho JH. Intrusion Detection Systems for Networked Unmanned Aerial Vehicles: A Survey. In: 2018 14th International Wireless Communications Mobile Computing Conference (IWCMC); 2018. p. 560–565.
- 7.
Li L, Qu K, Lin KY. A Survey on Attack Resilient of UAV Motion Planning*. In: 2020 IEEE 16th International Conference on Control Automation (ICCA); 2020. p. 558–563.
- 8. Seidaliyeva U, Akhmetov D, Ilipbayeva L, Matson ET. Real-Time and Accurate Drone Detection in a Video with a Static Background. Sensors. 2020;20(14):3856.
- 9.
Saqib M, Daud Khan S, Sharma N, Blumenstein M. A study on detecting drones using deep convolutional neural networks. In: 2017 14th IEEE International Conference on Advanced Video and Signal Based Surveillance (AVSS); 2017. p. 1–5.
- 10. Aker C, Kalkan S. Using Deep Networks for Drone Detection; 2017.
- 11. Park S, Kim Y, Lee K, Smith AH, Dietz JE, Matson ET. Accessible Real-Time Surveillance Radar System for Object Detection. Sensors. 2020;20(8):2215.
- 12. Condomines JP, Zhang R, Larrieu N. Network intrusion detection system for UAV ad-hoc communication: From methodology design to real test validation. Ad Hoc Networks. 2019;90:101759.
- 13.
Whelan J, Sangarapillai T, Minawi O, Almehmadi A, El-Khatib K. Novelty-Based Intrusion Detection of Sensor Attacks on Unmanned Aerial Vehicles. New York, NY, USA: Association for Computing Machinery; 2020.Available from: https://doi.org/10.1145/3416013.3426446.
- 14.
Muniraj D, Farhood M. A framework for detection of sensor attacks on small unmanned aircraft systems. In: 2017 International Conference on Unmanned Aircraft Systems (ICUAS); 2017. p. 1189–1198.
- 15.
Kulp P, Mei N. A Framework for Sensing Radio Frequency Spectrum Attacks on Medical Delivery Drones. In: 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC); 2020. p. 408–413.
- 16.
Zhao L., Alipour-F., Slawski M. and Zeng K. Prediction-time Efficient Classification Using Feature Computational Dependencies. In: 2018 Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery London, United Kingdom,; 2018. p. 2787–2796.
- 17.
Ye B, Howells G, Haciosman M. Investigation of Properties of ICmetric in Cloud. In: 2013 Fourth International Conference on Emerging Security Technologies; 2013. p. 107–108.
- 18.
Zhao L, Alipour-Fanid A, Slawski M, Zeng K. Prediction-Time Efficient Classification Using Feature Computational Dependencies. New York, NY, USA: Association for Computing Machinery; 2018.Available from: https://doi.org/10.1145/3219819.3220117.
- 19.
Tahir H, Tahir R, McDonald-Maier K. Securing MEMS Based Sensor Nodes in the Internet of Things. In: 2015 Sixth International Conference on Emerging Security Technologies (EST); 2015. p. 44–49.
- 20.
Ali KM, Samawi VW, Al Rababaa MS. The affect of fuzzification on neural networks intrusion detection system. In: 2009 4th IEEE Conference on Industrial Electronics and Applications; 2009. p. 1236–1241.
- 21. Tan X, Su S, Zuo Z, Guo X, Sun X. Intrusion Detection of UAVs Based on the Deep Belief Network Optimized by PSO. Sensors. 2019;19(24):5529.
- 22.
Sedjelmaci H, Senouci SM, Messous MA. How to Detect Cyber-Attacks in Unmanned Aerial Vehicles Network? In: 2016 IEEE Global Communications Conference (GLOBECOM); 2016. p. 1–6.
- 23. Sedjelmaci H, Senouci SM, Ansari N. A Hierarchical Detection and Response System to Enhance Security Against Lethal Cyber-Attacks in UAV Networks. IEEE Transactions on Systems, Man, and Cybernetics: Systems. 2018;48(9):1594–1606.
- 24.
Manesh MR, Kenney J, Hu WC, Devabhaktuni VK, Kaabouch N. Detection of GPS Spoofing Attacks on Unmanned Aerial Systems. In: 2019 16th IEEE Annual Consumer Communications Networking Conference (CCNC); 2019. p. 1–6.