Detection of cyber attacks targeting avionics systems
The present subject matter provides various technical solutions to technical problems facing ADS-B cyber-attacks. One technical solution for detecting and mitigating ADS-B cyber-attacks includes receiving extracting information from received ADS-B signals, detecting a cyber-attack based on a selected subset of ADS-B information, determining a detection probability, and outputting a ADS-B cyber-attack type and probability. This solution may further include determining and implementing a cyber-attack mitigation to reduce the probability or effect of the detected cyber-attack. These solutions operate based on current ADS-B receiver technology, and can be combined with existing ADS-B receivers to detect message injection attacks, modification attacks, and jamming attacks. The technical solutions described herein use machine learning (ML) algorithms and statistical models to detect anomalies in incoming ADS-B messages. This enables these solutions to be trained in different environments, which further improves the cyber-attack detection accuracy and reduces likelihood of false alarms or miss detections.
1. An automatic dependent surveillance-broadcast (ADS-B) cyber-attack detection system comprising:
an ADS-B signal receiver to receive an ADS-B data set;
one or more processors; and
one or more storage devices comprising instructions, which when executed by the one or more processors, configure the one or more processors to:
receive the ADS-B data set from the ADS-B signal receiver;
generate a plurality of ADS-B signal characteristics based on the ADS-B data set;
generate an ADS-B signal subset based on the plurality of ADS-B signal characteristics and on an ADS-B cyber-attack type, wherein the ADS-B cyber-attack type includes an ADS-B message modification attack and the ADS-B signal subset includes an ADS-B message modification attack signal subset, the ADS-B message modification attack signal subset including received signal strength, bad packet ratio, rate of climb, rate of turn, speed rate, and displacement rate;
generate an ADS-B attack type identification based on an ADS-B machine learning analysis of the ADS-B signal subset;
determine an attack probability based on the ADS-B attack type identification and the ADS-B signal subset; and
generate an ADS-B attack output based on the determined attack probability and the ADS-B attack type identification.
2. The system of claim 1 , wherein the ADS-B jamming attack signal subset includes at least one of a mean eigenvalue, signal-to-noise ratio, received signal strength, bad packet ratio, or energy test statistic.
3. The system of claim 2 , wherein the ADS-B machine learning analysis includes a jamming attack random forest machine learning analysis, the jamming attack random forest machine learning analysis previously trained on a set of ADS-B jamming attack training data.
4. The system of claim 1 , wherein:
the ADS-B cyber-attack type includes an ADS-B message injection attack; and
the ADS-B signal subset includes an ADS-B injection attack signal subset, the ADS-B injection attack signal subset including ownship latitude, ownship longitude, transmitter latitude, transmitter longitude, velocity difference, doppler shift, and received signal strength.
5. The system of claim 4 , wherein the ADS-B machine learning analysis includes a signal injection attack neural network machine learning analysis, the signal injection attack neural network machine learning analysis previously trained on a set of ADS-B message injection attack training data.
6. The system of claim 1 , wherein the ADS-B machine learning analysis includes a message modification attack neural network machine learning analysis, the message modification attack neural network machine learning analysis previously trained on a set of ADS-B message modification attack training data.
7. The system of claim 1 , wherein the determination of the attack probability includes Bayesian inference processing of the ADS-B attack type identification and the ADS-B signal subset.
8. The system of claim 7 , wherein the attack probability includes at least one of a probability of detection, a probability of false alarm, and an accuracy.
9. An automatic dependent surveillance-broadcast (ADS-B) cyber-attack detection method comprising:
receiving an ADS-B data set from an ADS-B signal receiver;
generating a plurality of ADS-B signal characteristics based on the ADS-B data set;
generating an ADS-B signal subset based on the plurality of ADS-B signal characteristics and on an ADS-B cyber-attack type, wherein the ADS-B cyber-attack type includes an ADS-B message modification attack and the ADS-B signal subset includes an ADS-B message modification signal subset, the ADS-B message modification attack signal subset including received signal strength, bad packet ratio, rate of climb, rate of turn, speed rate, and displacement rate;
generating an ADS-B attack type identification based on an ADS-B machine learning analysis of the ADS-B signal subset;
determining an attack probability based on the ADS-B attack type identification and the ADS-B signal subset; and
generating an ADS-B attack output based on the determined attack probability and the ADS-B attack type identification.
10. The method of claim 9 , wherein the ADS-B jamming attack signal subset includes at least one of a mean eigenvalue, signal-to-noise ratio, received signal strength, bad packet ratio, or energy test statistic.
11. The method of claim 10 , wherein the ADS-B machine learning analysis includes a jamming attack random forest machine learning analysis, the jamming attack random forest machine learning analysis previously trained on a set of ADS-B jamming attack training data.
12. The method of claim 9 , wherein:
the ADS-B cyber-attack type includes an ADS-B message injection attack; and
the ADS-B signal subset includes an ADS-B injection attack signal subset, the ADS-B injection attack signal subset including ownship latitude, ownship longitude, transmitter latitude, transmitter longitude, velocity difference, doppler shift, and received signal strength.
13. The method of claim 12 , wherein the ADS-B machine learning analysis includes a signal injection attack neural network machine learning analysis, the signal injection attack neural network machine learning analysis previously trained on a set of ADS-B message injection attack training data.
14. The method of claim 9 , wherein the ADS-B machine learning analysis includes a message modification attack neural network machine learning analysis, the message modification attack neural network machine learning analysis previously trained on a set of ADS-B message modification attack training data.
15. The method of claim 9 , wherein the determination of the attack probability includes Bayesian inference processing of the ADS-B attack type identification and the ADS-B signal subset.
16. The method of claim 15 , wherein the attack probability includes at least one of a probability of detection, a probability of false alarm, and an accuracy.
17. At least one non-transitory machine-readable storage medium, comprising a plurality of instructions that, responsive to being executed with processor circuitry of a computer-controlled device, cause the computer-controlled device to:
receive an ADS-B data set from an ADS-B signal receiver;
generate a plurality of ADS-B signal characteristics based on the ADS-B data set;
generate an ADS-B signal subset based on the plurality of ADS-B signal characteristics and on an ADS-B cyber-attack type, wherein the ADS-B cyber-attack type includes an ADS-B message modification attack and the ADS-B signal subset includes an ADS-B message modification attack signal subset, the ADS-B message modification attack signal subset including received signal strength, bad packet ratio, rate of climb, rate of turn, speed rate, and displacement rate;
generate an ADS-B attack type identification based on an ADS-B machine learning analysis of the ADS-B signal subset;
determine an attack probability based on the ADS-B attack type identification and the ADS-B signal subset; and
generate an ADS-B attack output based on the determined attack probability and the ADS-B attack type identification.
18. The non-transitory machine-readable storage medium of claim 17 , wherein the determination of the attack probability includes Bayesian inference processing of the ADS-B attack type identification and the ADS-B signal subset.