Detecting Drones Status via Encrypted Traffic Analysis

We propose Picking a Needle in a Haystack (PiNcH ), a methodology to detect the presence of a drone, its current status, and its movements by leveraging just the communication traffic exchanged between the drone and its Remote Controller (RC). PiNcH is built applying standard classification algorithms to the eavesdropped traffic, analyzing features such as packets inter-arrival time and size. PiNcH is fully passive and it requires just cheap and general-purpose hardware. To evaluate the effectiveness of our solution, we collected real communication traces originated by a drone running the widespread ArduCopter open-source firmware, currently mounted on-board of a wide range (30+) of commercial amateur drones. Then, we tested our solution against different publicly available wireless traces. The results prove that PiNcH can efficiently and effectively: (i) identify the presence of the drone in several heterogeneous scenarios; (ii) identify the current state of a powered-on drone, i.e., flying or lying on the ground; (iii) discriminate the movements of the drone; and, finally, (iv) enjoy a reduced upper bound on the time required to identify a drone with the requested level of assurance. The effectiveness of PiNcH has been also evaluated in the presence of both heavy packet loss and evasion attacks. In this latter case, the adversary modifies on purpose the profile of the traffic of the drone-RC link to avoid the detection. In both the cited cases, PiNcH continues enjoying a remarkable performance. Further, the comparison against state of the art solution confirms the superior performance of PiNcH in several scenarios. Note that all the drone-controller generated data traces have been released as open-source, to allow replicability and foster follow-up. Finally, the quality and viability of our solution, do prove that network traffic analysis can be successfully adopted for drone identification and status discrimination, and pave the way for future research in the area.

show abstract

“…• Classifiers. We considered the Random Forest algorithm, being the best among those we tried (see [16] for more details).…”

Section: Methodsmentioning

confidence: 99%

PiNcH: An effective, efficient, and robust solution to drone detection via network traffic analysis

et al. 2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…The electromagnetic watermarking concept was introduced by [33] as a technique that exploits the IEMI impacts for embedding a watermark into civilian UAVs to perform forensic tracking. A small sample of aircraft accident investigators, digital forensics investigators and examined the use of a forensics framework to conduct forensics on a drone [34]. The data analyses that were carried out with the use of the chi-square test of independence did not reveal any considerable connection between the groups of respondents' drone investigations and the methods used to conduct UAS forensics.…”

Section: Phase 2: Reviewing the Current Literaturementioning

confidence: 97%

“…Forensic analysis: Has been a subject of disputes among researchers, where researchers have in many instances explored diverse dimensions in the quest of assessing the security measures, attacks and the countermeasures, and to understand how to prevent such activities [1,27,30,[34][35][36][37]40]. Notably, relevant research has focused on the techniques that can be used to analyze the compromised devices such as [1,2,17,[19][20][21]23,26,28,[36][37][38][39].…”

mentioning

confidence: 99%

Research Challenges and Opportunities in Drone Forensics Models

et al. 2021

View full text Add to dashboard Cite

The emergence of unmanned aerial vehicles (also referred to as drones) has transformed the digital landscape of surveillance and supply chain logistics, especially in terrains where such was previously deemed unattainable. Moreover, the adoption of drones has further led to the proliferation of diverse drone types and drone-related criminality, which has introduced a myriad of security and forensics-related concerns. As a step towards understanding the state-of-the-art research into these challenges and potential approaches to mitigation, this study provides a detailed review of existing digital forensic models using the Design Science Research method. The outcome of this study generated in-depth knowledge of the research challenges and opportunities through which an effective investigation can be carried out on drone-related incidents. Furthermore, a potential generic investigation model has been proposed. The findings presented in this study are essentially relevant to forensic researchers and practitioners towards a guided methodology for drone-related event investigation. Ultimately, it is important to mention that this study presents a background for the development of international standardization for drone forensics.

show abstract

“…Overall, the STFT-SVM model succeeded in achieving the best performance, as SVM shows improved classification performance in binary tasks with reduced training resources compared to CNN. The current flying status (i.e., whether it is flying or it is static on the ground) of a powered-on UAV that is remotely controlled by a malicious operator was detected in real-time in Reference [96] by eavesdropping the communication traffic exchanged between the UAV and its controller and by applying classification algorithms. In particular, the Weka platform [97] was adopted that contains various standard ML algorithms for data mining tasks.…”

Section: Position Related Aspectsmentioning

confidence: 99%

A Survey on Machine-Learning Techniques for UAV-Based Communications

Bithas

Michailidis

Νομικός

et al. 2019

Sensors

223

128

View full text Add to dashboard Cite

Unmanned aerial vehicles (UAVs) will be an integral part of the next generation wireless communication networks. Their adoption in various communication-based applications is expected to improve coverage and spectral efficiency, as compared to traditional ground-based solutions. However, this new degree of freedom that will be included in the network will also add new challenges. In this context, the machine-learning (ML) framework is expected to provide solutions for the various problems that have already been identified when UAVs are used for communication purposes. In this article, we provide a detailed survey of all relevant research works, in which ML techniques have been used on UAV-based communications for improving various design and functional aspects such as channel modeling, resource management, positioning, and security.

show abstract

Detecting Drones Status via Encrypted Traffic Analysis

Cited by 33 publications

References 13 publications

PiNcH: An effective, efficient, and robust solution to drone detection via network traffic analysis

PiNcH: An effective, efficient, and robust solution to drone detection via network traffic analysis

Research Challenges and Opportunities in Drone Forensics Models

A Survey on Machine-Learning Techniques for UAV-Based Communications

Contact Info

Product

Resources

About