Analysis and Design of Stealthy Cyber Attacks on Unmanned Aerial Systems

Abstract

Cyber security has emerged as one of the most important issues in unmanned aerial systems for which the functionality heavily relies on onboard automation and intervehicle communications. In this paper, potential cyber threats and vulnerabilities in the unmanned aerial system's state estimator to stealthy cyber attacks are identified, which can avoid being detected by the monitoring system. Specifically, this paper investigates the worst stealthy cyber attack that can maximize the state estimation error of the unmanned aerial system's state estimator while not being detected. First, the condition that the system is vulnerable to the stealthy cyber attacks is derived, and then an analytical method is provided to identify the worst stealthy cyber attack. The proposed cyber attack analysis methods are demonstrated with illustrative examples of an onboard unmanned aerial system navigation system and an unmanned aerial system tracking application. Nomenclature A, B = system matrices a c , a o = cyber attack vectors B c , B o = cyber attack matrices C = observation matrix E 1 , E 2 = noise input matrices e a = estimation error subject to cyber attacks F = equality constraint matrix h = threshold value J, Φ = objective functions k = time index L = steady-state Kalman gain L = Lagrange function N = discrete-time horizon Q = process noise covariance matrix Q oa , Q ca = controllability matrices R = measurement noise covariance matrix r = residual vector u = input vector v = measurement noise vector W c = controllability gramian w = process noise vector x a = state vector subject to cyber attackŝ x a = state estimate subject to cyber attacks y a = output vector subject to cyber attacks μ, ν = Lagrange multipliers Σ = estimation error covariance matrix Σ p = predicted error covariance matrix Σ r = residual covariance matrix X = optimization variable Ω = inequality constraint function

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

“…As shown in [22], [11], for LTI systems without any additional data integrity guarantees, the setR α = ∞ k=0R α k can be bounded or unbounded depending on the system dynamics and the set of compromised sensors K. From Theorem 2, this property is preserved for the set R as well. For this reason, we will be using the definition ofR α to analyze boundedness of R, and to simplify the notation due to linearity of the constraint we will assume that α = 1 -i.e., for this analysis we consider the stealthiness attack constraint as…”

“…Here, T is the length of the detector's time window, and c i for i = 1, ..., T are predefined non-negative coefficients, with c T being strictly positive. The above formulation captures both fixed window size detectors, where T is a constant, as well as detectors where the time window size T satisfies T = k. Also, the definition of the detection function g k covers a wide variety of commonly used intrusion detectors, such as χ 2 and sequential probability ratio test (SPRT) detectors previously considered in these scenarios [20], [18], [23], [19], [11], [12]. The alarm is triggered when the value of the detection function g k satisfies that g k > threshold, (7) and the probability of the alarm at time k can be captured as…”

“…From Definition 4, there exists t i ∈ µ such that j ∈ t i ,t i + L , wheret i = t i +f (Figure 3). Now, from (10) and (11) we have that…”

“…Still, irrelevant of the utilized attack detection mechanism, after compromising a suitable subset of sensors, an intelligent attacker can significantly degrade control performance while remaining undetected (i.e., stealthy). For instance, for resilient state estimation techniques as in [4], [25], measurements from at least half of the sensors should not be tampered with [4], [31], while [22], [11] capture attack requirements for Kalman filter-based estimators. The reason for such conservative results lies in the common initial assumption that once a sensor or its communication to the estimator is compromised, all values received from the sensors can be potentially corrupted -i.e., integrity of the data received from these sensors cannot be guaranteed.…”

“…Specifically, we study the performance of linear filters equipped with residualbased intrusion detectors in the presence of attacks on sensor measurements. We build on the system model from [22], [11], [23] by capturing that the use of authentication mechanisms in intermittent time-points ensures that sensor measurements received at these points are valid. To keep our discussion and results general, we consider a wide class of detection functions that encompasses commonly used detectors, including χ 2 and SPRT detectors.…”