PiNcH: An effective, efficient, and robust solution to drone detection via network traffic analysis

Abstract

We propose Picking a Needle in a Haystack (PiNcH ), a methodology to detect the presence of a drone, its current status, and its movements by leveraging just the communication traffic exchanged between the drone and its Remote Controller (RC). PiNcH is built applying standard classification algorithms to the eavesdropped traffic, analyzing features such as packets inter-arrival time and size. PiNcH is fully passive and it requires just cheap and general-purpose hardware. To evaluate the effectiveness of our solution, we collected real communication traces originated by a drone running the widespread ArduCopter open-source firmware, currently mounted on-board of a wide range (30+) of commercial amateur drones. Then, we tested our solution against different publicly available wireless traces. The results prove that PiNcH can efficiently and effectively: (i) identify the presence of the drone in several heterogeneous scenarios; (ii) identify the current state of a powered-on drone, i.e., flying or lying on the ground; (iii) discriminate the movements of the drone; and, finally, (iv) enjoy a reduced upper bound on the time required to identify a drone with the requested level of assurance. The effectiveness of PiNcH has been also evaluated in the presence of both heavy packet loss and evasion attacks. In this latter case, the adversary modifies on purpose the profile of the traffic of the drone-RC link to avoid the detection. In both the cited cases, PiNcH continues enjoying a remarkable performance. Further, the comparison against state of the art solution confirms the superior performance of PiNcH in several scenarios. Note that all the drone-controller generated data traces have been released as open-source, to allow replicability and foster follow-up. Finally, the quality and viability of our solution, do prove that network traffic analysis can be successfully adopted for drone identification and status discrimination, and pave the way for future research in the area.

Network intrusion detection system: A systematic study of machine learning and deep learning approaches

“…Therefore, an efficient and intelligent NIDS is required which can detect the intruders within UAV‐enabled networks. Furthermore, the use of AI within the NIDS for UAV‐enabled networks can be an interesting research direction, which requires more exploration and investigation 141,142 …”

Passive Forward-Scattering Radar Using Digital Video Broadcasting Satellite Signal for Drone Detection

“…Several illuminators explored for passive bistatic radar (only one example of a published paper is cited for each technology) such as the global navigation satellite system (GNSS) [11], Long-Term Evolution (LTE) signal [12], WIFI [13], WIFI (DVB-T) [14], Digital Audio Broadcast (DAB) [15], FM broadcast [16], drone RF signal [17], video surveillance [18]. These illuminators became a boosting tool for passive radar, thereby becoming an important technology for both military and civil applications.…”

Internet of Drones Security and Privacy Issues: Taxonomy and Open Challenges

“…The malicious party takes advantage of the unsecured communication channel to intercepts the communicated navigational messages between the targeted drone and its navigation controller. Later, the attacker manipulates and resend it to the drone without its knowledge [99].…”