Unmanned aerial vehicle intrusion detection and countermeasures
A system deploys electronic countermeasures against unmanned aerial vehicles (UAVs) that are determined to be a threat. A radio transceiver coupled to at least one antenna detects if radio signals are being communicated between a remote control unit and a UAV. A mitigation engine communicatively coupled to the radio transceiver synthesizes an exploit signal to be transmitted to the UAV, wherein the exploit signal is configured to inject commands into the UAV's navigation system. If the system determines that the UAV is operating in an autopilot mode, it transmits an induce-mode signal that causes the UAVs to switch to a communication mode so the UAV is responsive to the exploit signal.
1. An apparatus, comprising:
a radio transceiver coupled to at least one antenna and configured to detect if radio signals are being communicated between a remote control unit and a remote-controlled vehicle, and to transmit signals to the remote-controlled vehicle; and
a mitigation engine communicatively coupled to the radio transceiver and configured to synthesize an exploit signal to be transmitted to the remote-controlled vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle's navigation system;
wherein the exploit signal is configured to exploit a radio protocol format employed by the remote-controlled vehicle to manipulate a radio in the remote-controlled vehicle without affecting at least one other radio using the same radio protocol format.
2. The apparatus recited in claim 1 , wherein
the mitigation engine comprises at least one computing device including a processor, non-transitory memory and a plurality of applications configured to run on the processor; and
the radio transceiver comprises at least one radio receiver coupled to the computing device and configured to:
select specific radio signals, wherein the radio receiver is configured to detect signals in a predetermined radio frequency spectrum;
detect the remote-controlled vehicle by receiving radio transmissions involving the vehicle, wherein the radio transmissions include data sent from the remote-controlled vehicle;
select a unique identifier for the remote-controlled vehicle using at least a portion of the data; and
perform a threat assessment of the remote-controlled vehicle using at least a portion of the data.
3. The apparatus recited in claim 1 , wherein the exploit signal is transmitted to the remote control unit.
4. The apparatus recited in claim 1 , wherein the mitigation engine manipulates a messaging protocol employed by at least one of the remote control unit and the remote-controlled vehicle, to read messages and modify message contents.
5. The apparatus recited in claim 1 , wherein the mitigation engine is configured to perform at least one of a man-in-the-middle attack, a de-authentication/disassociation attack, a denial-of-service attack, a network-layer attack, a transport-layer attack, and a collision attack.
6. The apparatus recited in claim 1 , wherein the mitigation engine is configured to determine at least one of manufacturer, model number, operating system, and operating state of at least one of the remote control unit and the remote-controlled vehicle; and synthesize the exploit signal therefrom.
7. The apparatus recited in claim 1 , further comprising a threat-assessment module configured to determine if the remote-controlled vehicle is a threat based on at least one of proximity, altitude, speed, heading, size, shape, remote-controlled vehicle type, and remote-controlled vehicle model; the threat-assessment module further configured to activate the mitigation engine upon determining that the remote-controlled vehicle is a threat.
8. The apparatus recited in claim 1 , wherein the radio transceiver is configured to identify a radio protocol from at least one of signal features and protocol behavior features of the radio signal.
9. The apparatus recited in claim 1 , wherein the radio transceiver is configured to communicate via authentication messages with the remote-controlled vehicle.
10. The apparatus recited in claim 1 , wherein the mitigation engine is configured to cause the remote-controlled vehicle to change at least one of its operating mode and state.
11. An apparatus, comprising:
a radio transceiver coupled to at least one antenna and configured to detect if radio signals are being communicated between a remote control unit and a remote-controlled vehicle, and to transmit signals to the remote-controlled vehicle;
a memory; and
one or more processors operatively coupled to the memory and the radio transceiver, the one or more processors configured to:
synthesize an exploit signal to be transmitted to the remote-controlled vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle's navigation system, wherein the exploit signal comprises spoofed packets, which take control of the remote-controlled vehicle.
12. The apparatus recited in claim 11 , wherein the one or more processors are configured to:
select specific radio signals, wherein the radio receiver is configured to detect signals in a predetermined radio frequency spectrum;
detect the remote-controlled vehicle by receiving radio transmissions involving the vehicle, wherein the radio transmissions include data sent from the remote-controlled vehicle;
select a unique identifier for the remote-controlled vehicle using at least a portion of the data; and
perform a threat assessment of the remote-controlled vehicle using at least a portion of the data.
13. The apparatus recited in claim 11 , wherein the spoofed packets are transmitted to the remote control unit.
14. The apparatus recited in claim 11 , wherein the mitigation engine manipulates a messaging protocol employed by at least one of the remote control unit and the remote-controlled vehicle, to read messages and modify message contents.
15. The apparatus recited in claim 1 , wherein the mitigation engine is configured to perform at least one of a man-in-the-middle attack, a de-authentication/disassociation attack, a denial-of-service attack, a network-layer attack, a transport-layer attack, and a collision attack.
16. The apparatus recited in claim 11 , wherein the mitigation engine is configured to determine at least one of manufacturer, model number, operating system, and operating state of at least one of the remote control unit and the remote-controlled vehicle; and synthesize the exploit signal therefrom.
17. The apparatus recited in claim 11 , further comprising a threat-assessment module configured to determine if the remote-controlled vehicle is a threat based on at least one of proximity, altitude, speed, heading, size, shape, remote-controlled vehicle type, and remote-controlled vehicle model; the threat-assessment module further configured to activate the mitigation engine upon determining that the remote-controlled vehicle is a threat.
18. The apparatus recited in claim 11 , wherein the radio transceiver is configured to identify a radio protocol from at least one of signal features and protocol behavior features of the radio signal.
19. The apparatus recited in claim 11 , wherein the radio transceiver is configured to communicate via authentication messages with the remote-controlled vehicle.
20. The apparatus recited in claim 11 , wherein the mitigation engine is configured to cause the remote-controlled vehicle to change at least one of its operating mode and state.