Open Challenge for Intrusion Detection on Air-Ground Communication: From Data Analysis to Simulation

Military and civil Unmanned Aerial Systems (UASs) have already started widely populating the airspace. UAS will share the same airspace routes with other aircraft and carry out distinct missions. The operation of such systems relies on secure communication between UASs and Ground Control Stations (GCS). Recent publications have shown that UAS communication protocols like MAVLink are vulnerable to attacks compromising their operations. In this paper, we evaluate an intrusion detection mechanism on an air-ground communication system using Machine Learning (ML) methods. To validate our approach, we evaluated the performance of our algorithm through a Software-In-The-Loop (SITL) testbed. We captured normal and abnormal traffic operations in the testbed, with Man-In-The-Middle (MITM) attacks representing the abnormal traffic operations. Next, we derived generic aggregation features (statistics) over MAVLink messages and evaluated supervised and unsupervised methods to detect the attack. The supervised decision tree method presented the best performance (F1-score 0.99) during this analysis. In contrast to the sound performance during data analysis, the detection algorithm did not perform as expected when integrated into the SITL testbed environment. This behavior raises some open challenges for network-based intrusion detection on UAS operation, and this paper aims at setting the stage for further discussions and research initiatives.