AnoMili: Spoofing Prevention and Explainable Anomaly Detection for the 1553 Military Avionic Bus

Levy, Efrat; Maman, Nadav; Shabtai, Asaf; Elovici, Yuval

doi:10.48550/arxiv.2202.06870

Cited by 3 publications

(1 citation statement)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This potential for exploitation of the MIL-STD-1553B protocol introduces a requirement for Intrusion Detection System (IDS) in order to maintain the reliability of the MIL-STD-1553B protocol and safety of the aircraft. Both signature and anomaly-based IDS have recently been researched and provide viable options for monitoring vulnerabilities in the MIL-STD-1553B data bus introduced by these new threat vectors (Bedard, 2019;Genereux et al, 2020;Stan et al, 2020;Onodueze and Josyula, 2020;De Santo et al, 2021;Levy et al, 2022;Banks et all, 2022;Wrana et al, 2022;and Harlow, Lachine and Roberge, 2024). This research focuses on the feature engineering component of a Long-Short Term Memory (LSTM) MIL-STD-1553B deep learning anomaly detector (Harlow, Lachine and Roberge, 2024) in order to improve its overall effectiveness.…”

Section: Introductionmentioning

confidence: 99%

Feature Engineering for a MIL-STD-1553B LSTM Autoencoder Anomaly Detector

Soucy,

Lachine

2024

eccws

View full text Add to dashboard Cite

The MIL-STD-1553B data bus protocol is used in both civilian and military aircraft to enable communications between subsystems. These interconnected subsystems are responsible for core services such as communications, flow of instrument data and aircraft control. With aircraft modernization, threat vectors are introduced through increased inter-connectivity internal and external to the aircraft. The resulting potential for exploitation introduces a requirement for an intrusion detection capability in order to maintain the integrity, availability and reliability of data transmitted using the MIL-STD-1553B protocol, safety of the aircraft and overall, to achieve mission assurance. Research in recent years has investigated signature, statistical and machine learning based solutions to detect attacks on MIL-STD-1553B buses. Of the different techniques, those based on machine learning have shown extremely good results. The aim of this research is to improve the performance of an existing Long Short-Term Memory Auto-Encoder by refining the feature engineering phase of its pipeline. The improvement in the detector’s overall effectiveness was accomplished through feature engineering focused on feature generation and selection. Five different attack datasets were used as the starting point, consisting of four different denial of service attacks and one data integrity attack. From initial feature extraction of 155 features, two feature generation techniques were employed to create over 38,000 features as a starting point. Using five different MIL-STD-1553B datasets and three feature selection techniques, fifteen different Long Short-Term Memory Auto-Encoder models were created, trained and evaluated using common performance metrics and compared to those of the original anomaly detector. This research demonstrated marked performance improvement achieved by the feature engineering refinements made in comparison to those of the original model. Equally important, this research also showed a significant reduction in the number of features required to achieve this performance gain. In the context of miliary air operations, the ability to improve detection capabilities with less data is important to the technical solutions that contribute to the achievement of cyber mission assurance.

show abstract