Comparative Analysis of Threat Detection Techniques in Drone Networks

Technologies

Description

Communication Technologies

Drones use wireless technologies like RF, Wi-Fi, Bluetooth, cellular networks to communicate with each other and ground systems [8,9]. They can also use satellite systems for long-range communication.

Navigation and Positioning Technologies

Drones use GNSS like GPS and IMUs with sensors like accelerometers and gyroscopes to determine position, orientation, velocity for navigation [10,11,12]. Computer vision is also used for navigation.

Data Processing and Storage Technologies

Drones have onboard computers for data processing, decision-making and storage devices like SSDs to store collected data [13,14].

Sensor Technologies

Drones have cameras and other imaging sensors like thermal, multispectral for aerial data collection. Specialized sensors used for environment monitoring [15].

Control Systems and Autonomy

Drones have flight controllers for flight stabilization, navigation. AI and ML used to enhance autonomy [16,17].

Technologies

Description

Blockchain Technology

Provides security, efficiency through decentralization, tamper-proof ledgers, identity verification, smart contracts for drones [18-24].

Software-defined networking (SDN)

Enables centralized control, dynamic reconfiguration, optimized routing, virtualization, security through controller managing all network resources [25-29].

Machine learning

Provides intelligent data analysis, anomaly detection, computer vision, autonomous navigation, performance optimization, security for drones [30-35].

Ad-hoc Networking

Enables decentralized collaboration, mesh networking, dynamic routing, redundancy, rapid deployment for drones [36,37,38].

Swarm Technology

Facilitates coordinated, distributed operations through formation control, distributed decisionmaking, load balancing, communication protocols [39-42].

Fog Computing

Provides real-time analytics, efficiency, resilience through localized processing, computation offloading, encryption at network edge [43-46].

Methods

Detection Technique

Jamming detection in drone networks using Multi-layer Perceptrons and Decision Trees:

Multi-layer Perceptron and Decision Tree [70]. These techniques are incorporated into the framework along with the selected measures to enhance the detection of jamming attacks.

Predicting Application Layer DDoS Attacks Using Machine Learning Algorithms

This paper introduces a new approach for identifying Distributed Denial of Service (DDoS) attacks in network traffic flow data. The method involves analysing the traffic traces and creating an access matrix. By applying Principal Component Analysis (PCA), the method reduces the number of attributes used for detection [71].

Distributed Denial of Service Attacks based on Machine Learning Algorithms

In this article we are shown that can be used to detect Distributed Denial of Service (DDoS) attacks.

Methods

Detection Technique

Autonomous Detection of Malicious Events using Machine Learning Models in Drone Networks

The authors gathered a comprehensive dataset from a drone network, comprising a wide range of normal and attack scenarios.

Methods

Detection Technique

A Hierarchical Detection and Response System to Enhance Security Against Lethal CyberAttacks in UAV Networks

The primary focus of the system is to identify the most dangerous cyber-attacks that can target UAV networks, such as the dissemination of false information, GPS spoofing, jamming, black hole attacks, and gray hole attacks.

Intrusion Detection of Malicious Unmanned Air Vehicles Using Behavior Rule Specifications

The authors demonstrate that the true positive rate approaches one while bounding the false positive rate to below 0.05% for reckless attackers, below 7% for random attackers with attack probability as low as 0.2, and below 6% for opportunistic attackers when the error of monitoring due to environment noise is at 1%.

A Multiagent and Machine Learning Based Denial of Service Intrusion Detection System for Drone Networks

The goal is to detect Denial-of-Service (DoS) attacks more effectively. By using a combination of these machine learning methods and a multi-agent approach [72], they aim to strengthen the drones' defences and make them more resilient against cyber threats.

Methods

Detection Technique

Blockchain based peer to peer communication in autonomous drone operation

The approach we're considering involves using a blockchain ledger to register all the components involved in aerospace operations [73]. This ledger will hold essential information related to communication, making it secure and tamper-proof.

Methods

Detection Technique

Signal Spoofing and Jamming Attacks in UAV Networks using a Lightweight IDS

The UAV comes equipped with a cutting-edge autopilot system and incorporates smart security measures to ensure its safety. Even in challenging situations like signal loss or potential hacking attempts, the system can safely guide the UAV back home. One remarkable feature is the UAV's ability to distinguish between fake and authentic signals, providing an extra layer of protection.

Specification Based Intrusion Detection for Unmanned Aircraft Systems

The system focuses on protecting sensors and actuators embedded in the UAS and addresses the challenge of detecting sophisticated and hidden attackers while ensuring a high level of security [74]. The researchers use behavior-rule specifications and transform them into state machines to create lightweight, efficient rules for each component.

Methods

Detection Technique

An Amateur Drone Surveillance System Based on Cognitive Internet of Things

The system consists of various active and passive surveillance devices such as cameras, sensors, radars, and drones, or a crowd of people that serve as local fog computing platforms to sense the environment and locally warn the presence of amateur drones. The system has four key fundamental cognitive tasks, sequentially: 1) sensing; 2) data analytics; 3) semantic derivation and knowledge discovery; and 4) intelligent decision-making.

A DDoS Attack Detection and Mitigation With Software-Defined Internet of Things Framework

The algorithm uses cosine similarity to distinguish between DDoS attack flows [75] and normal flows, with a threshold value of cosine similarity used to determine if a port is under attack.

Methods

Detection Technique

Intrusion   Detection   System   and   Threat

Estimation with Wireless Networks

The paper proposes a Mahalanobis distance-based detection policy [76] to counter cyberattacks against data integrity and a distribution of signal strength-based detection policy to counter GPS spoofing attacks that target the GPS coordinates of drones.

The paper evaluates the performances of the cyber security system using the NS3 simulator [76] and provides simulation results in Section 4 of the paper.

Intrusion Detection and Ejection Framework Against Lethal Attacks in UAV-Aided Networks: A Bayesian Game-Theoretic Methodology

The framework is based on Bayesian games [76] and aims to detect and deter lethal attacks with high accuracy while incurring low overhead.

The simulation results show that the proposed SGF incurs a low overhead [76] to detect and deter lethal attacks with high accuracy.

A Detection and Prevention Technique for Man in the Middle Attack in Fog Computing

The system proposed here is an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) for Man in the Middle (MitM) attack at the fog layer [77].

The authors discuss the need for low resource demanding, yet strong security systems that will protect the fog layer from being attacked [77].

Dynamic Authentication for Threat Mitigation

The dynamic authentication and secure channels approach [78] enables trust establishment and verified identities, which helps mitigate against injection attacks, data breaches, and unauthorized access threats.

It is a blockchain and fog computing enabled security architecture that operates on fog nodes to facilitate equipment authentication and secure communication between equipment and cloud. The architecture uses dynamic ECQV certificates, ECIES, and Diffie-Hellman key exchange to establish trust, ensure anonymity, and enable secure channels.

Blockchain-based Threat Monitoring

The blockchain-based trust mechanisms discussed provide transparency, accountability, and access control that aid in detecting threats like data tampering, spoofing, rogue nodes through transaction validation rules and consensus protocols.

Discuss using blockchain technology in fog computing to enhance security, transparency, and trust through features like distributed smart contracts, immutable ledgers, and accountability of transactions. Blockchain aids services like access control, identity management, and forensics.

Layered Intrusion Detection Systems

The layered security model [79] incorporates dedicated intrusion detection systems for threat monitoring at the network, data, and device levels. These can employ AI/ML for anomaly detection against threats.

Putting forth a layered security model for fog computing consisting of network, data processing, and device privacy categories. They survey authentication, access control, intrusion detection, trust management, and privacy preservation techniques. Encryption, differential privacy, identity obfuscation are some privacy solutions.

Predictive Caching and ML for Threat Detection

The caching and machine learning techniques can enable predictive caching to secure against denial-of-service attacks by caching anticipated popular content. ML also aids in detecting outlier access patterns [80].

By reviewing caching techniques like Steiner tree caching, application-based caching, smart collaborative caching, and deep learning-based content caching that aim to improve efficiency, scalability, throughput, and disaster recovery in fog computing. Machine learning methods for cache optimization are also explored.

Auditing   and   Threat   Attribution   using

Blockchain

The analysis of security threats and blockchain solutions looks at using blockchain features like immutability, transparency, and decentralization for auditing and threat attribution after detection by other systems.

A comprehensive analysis of security threats, issues and blockchain-based solutions in the context of IoT and industrial IoT systems connected via fog computing. Attacks like DDoS, malware, ransomware and solutions like access control, authentication, encryption are covered.

Threat Detection in Fog Computing

Connecting trust establishment, authentication protocols, confidentiality mechanisms, attack detection systems, and privacy preservation techniques to threat detection in fog computing [81].

Specifically, trust validation allows identifying unauthorized and insider attacks, authentication verifies spoofing attempts, encryption breach anomalies indicate data theft attacks. Dedicated detection systems like decoys and malware monitors proactively hunt threats, while privacy tools prevent exposure of data that can enable attacks. The distributed and decentralized infrastructure poses challenges that require decentralized security methodologies tailored to fog computing infrastructure. The study recommends authentication and policy coordination between nodes along with usage control to deal with various threats and attacks.

Methods

Flaws / Limitations

Multi-layer Perceptrons and Decision Trees

MLP classifiers reach precision values between about 70% and 75%. This indicates that the models may have difficulty accurately distinguishing between normal instances and jamming instances.

Accuracy drops as the window size increases. This suggests that the performance of the detection techniques might deteriorate when analyzing a larger context or timeframe.

Overfitting on noisy drone data, lack of balanced training datasets, hardware constraints, and sensitivity to small input changes limit the reliability of machine learning approaches. For instance, the low 75% precision of Multi-Layer Perceptrons and Decision Trees specifically for jamming attack detection highlight the difficulty in distinguishing between legitimate and malicious drone behaviors. These flaws need to be addressed for machine learning to be dependable for drone threat detection.

Detection of DDoS Attacks Using Machine Learning Algorithms

Machine learning techniques proposed for detecting distributed denial-of-service (DDoS) intrusions on drones grapple with efficiency and robustness challenges. As highlighted, support vector machines (SVM) tend to have high training and testing times due to complex optimization computations classifying data in hyperspace. This hampers real-time attack prevention capabilities given onboard processing limitations. Additionally, SVMs may mislabel legitimate behaviors as anomalous fairly often, resulting in excessive false alarms.

While simpler Bayes classifiers alleviate efficiency issues, their detection accuracy can significantly lag sophisticated models. Naive Bayes made the highest number of classification errors identifying DDoS attacks. Its assumptions of inter-feature independence limit suitability for precisely modeling multi-factor attack vectors. Thus, balancing computational complexity, detection precision, and generalizability remains an open challenge in countering evolving drone threat landscapes using machine learning.

Methods

Flaws / Limitations

Intrusion Detection of Malicious Unmanned Air Vehicles Using Behavior Rule

Behavior rules are directly derived from threats: The limitations arise from the direct dependency of behavior rules on the defined threats.

New threats require adding behavior rules: When new threats are discovered and introduced to the threat model, new behavior rules corresponding to these threats must be added to the rule set.

While deriving behavior rules directly from known threats enables precise attack signatures, this tight coupling impedes detecting new and evolving attacks against drones. As adversarial techniques grow more sophisticated, unprecedented zero-day exploits can bypass rules crafted for existing threats. Updating rule sets is an error-prone process requiring extensive expertise and may still fail to capture future attack vectors. Additionally, frequent manual rule additions introduce significant overhead in maintaining robust detection capabilities. The reliance on pre-defined rules renders such intrusion detection systems ineffective against novel threats with unfamiliar patterns.

Multiagent and Machine Learning Based Denial of Service Intrusion Detection System for Drone Networks

The Naive Bayes algorithm cannot be used due to its low accuracy, which does not exceed 68.7%.

The scalability of the detection schemes becomes an issue when the number of UAVs increases, particularly in the presence of a high number of attackers. Ensuring consistent detection rates across larger networks and higher attack volumes is crucial for comprehensive security.

The low accuracy of the Naive Bayes algorithm in the used technique indicates the need for alternative machine learning algorithms with higher accuracy.

Methods

Flaws / Limitations

Blockchain based peer to peer communication in autonomous drone operation

Balancing block size and security can be challenging. In blockchain-based cyber threat and cyber-attack detection, finding the right balance between block size and security is crucial.

Blockchain-based cyber threat and cyber-attack detection techniques offer advantages such as decentralization, immutability, and transparency. However, they also face certain flaws and limitations (Kumar et al., 2021).

Furthermore, the growth of the blockchain over time leads to increased memory consumption.

Methods

Flaws / Limitations

Detecting Signal Spoofing and Jamming Attacks in UAV Networks using a Lightweight IDS

As the random attack probability decreases, the attacker becomes more hidden and insidious. This indicates a limitation in the detection capability of the Specification IDS.

Specification Based Intrusion Detection for Unmanned Aircraft Systems

This poses a challenge for the Specification IDS in detecting jamming attacks.

The Specification IDS shows limitations in detecting signal spoofing and jamming attacks when the random attack probability decreases.

Methods

Flaws / Limitations

DDoS Attack Detection and Mitigation with Software-Defined Internet of Things Framework

The number of packet-in messages sent by SD-IoT switch S3 to the SD-IoT controller increases with time. This limitation suggests that the detection techniques implemented in the Drone Surveillance System and SD-IoT may suffer from scalability issues.

The increase in the number of packet-in messages sent by the SD-IoT switch S3 to the SD-IoT controller over time indicates a scalability limitation.

Methods

Flaws / Limitations

Intrusion   Detection   System   and   Threat

Estimation with Wireless Networks

Trade-off between Time Slots and Accuracy: One limitation observed is the trade-off between the number of time slots used for threat estimation and the accuracy of detection [82].

Decreased Accuracy with Increasing Number of UAVs: Another limitation identified is that the accuracy rate of the system decreases as the number of UAVs increases [82].

Lack of Bayesian Game-Theoretic Approach: In the case of this system, a limitation is mentioned regarding the absence of a Bayesian game-theoretic approach [82].

Intrusion Detection and Ejection Framework in Bayesian Game-Theoretic Methodology

Inapplicability of Traditional Techniques: One limitation identified is that traditional techniques for preventing intrusion may not be applicable at the fog level [82].

Need for Low Resource-Demanding Security: Another limitation highlighted is the need for a low resource-demanding, yet strong security system to protect the fog layer from being attacked [82].

Names

Advantages

Disadvantages

Jamming detection at the edge of drone networks using Multi-layer Perceptron and Decision Trees

Non-linearity: This allows them to capture intricate patterns and make accurate predictions for a wide range of tasks.

Feature Learning: This eliminates the need for manual feature engineering and allows the network to adapt to the problem at hand.

Wide Range of Applications : MLPs are widely used in diverse areas, including image recognition, natural language processing, time series analysis, and more.

Interpretability: Decision Trees offer a transparent and easy-to-understand decisionmaking process.

Efficiency: Decision Trees have relatively fast training and prediction time, making them efficient for both small and large datasets.

Overfitting: Overfitting occurs when the model learns noise in the training data rather than general patterns, leading to poor performance on unseen data.

Data Requirements: Insufficient data can lead to poor performance.

Instability to Small Changes: Decision Trees are sensitive to small changes in the training data, leading to different tree structures.

Predicting Application Layer DDoS Attacks Using Machine Learning Algorithms

Simplicity and Speed: Naive Bayes is a simple and computationally efficient algorithm. It can be trained quickly and is suitable for large datasets.

Low Data Requirements: Naive Bayes can perform well even with a small amount of training data. It is particularly useful when the dataset is limited.

No Training Phase: KNN is a lazy learning algorithm, which means it does not explicitly build a model during the training phase. Instead, it stores the training data and uses it directly for predictions.

Adapts to Local Patterns: KNN can adapt to local patterns and variations in the data, which makes it robust to changes in the data distribution.

Sensitive to Irrelevant Features: While Naive Bayes can handle irrelevant features to some extent, highly irrelevant features can negatively impact its performance.

Zero Probability Issue: Naive Bayes assigns zero probabilities to features not seen in the training data, which can cause problems during prediction. To mitigate this issue, techniques like Laplace smoothing can be used, but it may introduce some bias.

Memory Intensive: KNN stores the entire training dataset, which can lead to high memory usage for large datasets.

Sensitive to Noise and Outliers: Outliers and noisy data can significantly impact the performance of KNN, as they may dominate the decision-making process for nearby points.

Imbalanced Data: KNN can be biased towards the majority class in imbalanced datasets, leading to poor performance in minority classes.

Detection of Distributed Denial of Service Attacks based on Machine Learning Algorithms

Works Well with Limited Data : SVM can perform well even with a small amount of training data, making it suitable for applications with limited labeled samples.

Effective in Small Sample Size: SVM can handle datasets with a small number of samples effectively.

Memory Intensive: SVM needs to store support vectors and their associated weights, which can consume significant memory for large datasets.

Sensitivity to Noise: SVM may be sensitive to noisy data, as noisy points can become support vectors and affect the decision boundary.

Autonomous Detection of Malicious Events using Machine Learning Models in Drone Networks

Automatic Feature Selection : Decision trees can automatically select important features, reducing the need for extensive feature engineering.

Fast Training : Decision tree algorithms have relatively fast training times compared to some other complex algorithms.

Low Data Requirements: Naive Bayes can work well even with limited training data.

Effective with Limited Data: SVM can perform well even with a small amount of training data.

Difficulty in Handling Continuous Data: Decision trees may not handle continuous data well, as they work best with discrete features.

Memory Intensive: KNN needs to store the entire training dataset, which can lead to high memory usage for large datasets.

Sensitive to Irrelevant Features: KNN may be affected by irrelevant or noisy features, leading to suboptimal performance.

Noisy Data: Outliers and noisy data points can negatively impact KNN's classification accuracy.

Imbalanced Data: Naive Bayes can be biased towards dominant classes in imbalanced datasets, affecting its performance on minority classes.

Data Preprocessing: Deep learning models are sensitive to data preprocessing, and poor data preparation can negatively impact performance.

A Hierarchical Detection and Response System to Enhance Security Against Lethal Cyber-Attacks in UAV Networks

Rules-based detection efficiently detects known attacks based on attack signatures.

Anomaly detection using SVM can detect new unknown attacks by modeling normal behavior.

Combination of rules-based and anomaly detection improves accuracy.

Hierarchical   system   with   ground   station

verification reduces false positives/negatives.

Prompt attack detection achieved through UDA monitoring.

Node assessment improves decisions and allows node categorization.

Rules require frequent manual updates to detect new attacks.

SVM anomaly detection has high computational cost.

Monitoring by multiple UDA agents increases communication overhead.

Adaptive Intrusion Detection of Malicious Unmanned Air Vehicles Using Behaviour Rule Specifications

Behaviour rules directly linked to threats, so new threats can be incorporated.

Adapts detection strength by adjusting compliance threshold based on attacker type and environment noise.

Can trade higher false positives for lower false negatives to handle sophisticated attackers.

True positive rate approaches 100% while bounding false positive rate below 0.05% for reckless attackers.

Outperforms benchmark IDS in accuracy.

Can identify emerging attacks through anomaly detection.

Balance coverage, accuracy and adaptability over standalone techniques

Generalize better across new attacks with adversarial data and evolving normalcy models.

Allows customization and tuning for particular environments and threats when implemented.

Requires comprehensive threat model to derive complete behaviour rules.

Must add new behaviour rules when new threats identified.

Determining attacker type and environment noise precisely is challenging.

Anomaly detection techniques have high false alarm rates requiring careful tuning.

Integrating specification rules and anomaly detection is an open, complex challenge.

Lack of complete situational awareness for unknown attack vectors.

Substantial testing and customization needed for each deployment scenario.

Requires diversity and volume of adversarial data which may be difficult to obtain.

Changes in flight parameters can accidentally trigger false alarms.

Resource constraints of drones may impede complex model deployments.

A Multiagent and Machine Learning Based Denial of Service Intrusion Detection System for Drone Networks

Multi-agent system provides modular design, eliminating single point of failure.

Distributed storage enables real-time processing.

Machine learning enables high attack detection accuracy. Specifically:

• •     Decision Tree gave 100% accuracy on

known DoS attacks.

• •    Random Forest, SVM, PNN also had

99.9% accuracy.

Naive Bayes had poor 68.7% accuracy on known DoS attacks.

Unknown attack detection mechanism still needs implementation.

System was not evaluated on UAV-specific network traffic datasets.

Blockchain  based  peer  to  peer

communication in autonomous drone

Decentralization, tamper-proof, confidentiality and data integrity are ensured by using hashing algorithms are core concepts of blockchain.

The smart contracts provide an extended layer to set condition on policy and set cryptographic rules based on the requirements of UAV infrastructure.

By utilizing Blockchain for UAV position data, spoofing attacks are prevented because any unauthorized attempt to modify or manipulate the position information would be detectable.

The approval time of block is faster based on the ether fee payment than other application of blockchain technology.

The proposed design outperformed the exiting design by minimizing drift errors, reducing integrity risk and vulnerability to cyber-attacks.

The proposed method is demonstrated without additional hardware which makes it more feasible for real-time application usage.

The platform usage ensures energy efficiency.

Blockchain networks can face scalability challenges when handling many transactions, which may impact the real-time communication requirements of drone swarms.

Implementation of blockchain in a UAV system may require additional computational resources and increase complexity which could increase system overhead.

Blockchain-based communication may introduce some latency due to the chained process which could impact time-sensitive drone operations.

Detecting Signal Spoofing and Jamming Attacks in UAV Networks using a Lightweight IDS

Multiclass SVM classifies different types of attacks in UAV and increases accuracy of the classification process.

Deep-Q network is used for reverse routing after an attacker is identified.

STL deep learning is used for identifying strong features and multicast SVM for classification by using location tracker normal and attacked UAV is observed and represented by graph.

As accuracy of attack detection range from 92% to 94%, deep learning-based IDS is more efficient than machine learning based IDS accuracy is 72% to 82%

Hierarchical nature increases complexity of computation.

The multiclass SVM approach may face challenges when dealing with imbalanced datasets as distribution samples of Dataset value is equally balanced.

The lightweight design may compromise the accuracy of the IDS compared to more complex and resource-intensive IDS solutions.

The vulnerability detection Of UAV auto-pilot requires embedded software in on-board system could increase system latency causing degraded system performance.

Specification Based Intrusion Detection for Unmanned Aircraft Systems

The state machine is used to collect compliance degree data for testing and debugging phase.

The specification-based approach allows for precise detection of unknown attacks based on deviations from expected behavior, making it effective in identifying intrusion attempts with high accuracy.

The IDS is designed to balance value of minimum compliance threshold for trade higher false positives rate.

Off for lower false negatives rate minimizes the risk of detecting sophisticated and hidden attackers.

IDS ensures a high detection probability of attackers while limiting the false alarm probability to below 5% for reckless attackers and below 20% for random attackers.

Anomaly based technique has high false positives.

The IDS design requires more sensitive sensors due to functionality requirements which potentially could increase complexity and overall cost for the infrastructure.

The external entity for monitoring the behaviours introduces communication overhead impacting real time response and increases vulnerability of the networking system.

Defining accurate behavior rules for each sensor or actuator component in a UAV can be complex and time-consuming and requires expert evaluation while configuration.

The IDS relies on compliance degree data which may be subject to noise and unreliable wireless communication, potentially impacting the accuracy of intrusion detection.

An Amateur Drone Surveillance System Based on Cognitive Internet of Things

CIoT technology integrated surveillance system of amateur drone gains high-level intelligence, enabling more real-time feedback for surveillance decision-making capabilities.

The context-free feature provides better accuracy of location tracking for continuous switching between surveillance system and environment.

Mobile crowd sensing (MCS) allows for large-scale data collection across diverse geographic locations and timeframes. It enables the collection of real-time, dynamic, and fine-grained data that may not be feasible through traditional sensing methods which require powerful sensors and dedicated sensing network.

Heterogenous data fusion uses copula theory instead of product model or multivariate Gaussian model to mitigate suboptimal fusion result and enhance the performance.

Amateur drones are harder to detect because of the size of the done.

The detection performance increases based on the number of samples which increases detection delay.

The detection classification and performance improved at a marginal rate with both additional sensors and detection delay that may not be cost effective.

A DDoS Attack Detection and Mitigation With Software-Defined Internet of Things Framework

Centralized   control   of   SD-IoT   improves

manageability, flexibility and security.

Controller pool provides load balancing and avoids single point of failure.

Cosine similarity metric effectively identifies DDoS attack patterns.

Blocks attacks by adding drop rules once detected, reducing impact.

Simulation demonstrates lower resource usage compared to baseline

Additional complexity of deploying SDN controllers for IoT systems

Overhead of controller communications and packet encapsulation/decapsulation

Setting optimal threshold for cosine similarity can require tuning.

Detection time depends on sampling window size, which may cause some delay.

Simulation uses simplified topology, real-world conditions may differ

How to Detect Cyber-attacks in Unmanned Aerial Vehicles Network?

Detection policies are tailored to identify common UAV network attacks.

Belief model accounts for uncertainty in IDS observations to improve accuracy.

Achieves high attack detection rates with low false positives in simulations.

Scales well even with increasing UAVs and attackers in network

Collaborative    approach    allows    detecting

compromised insider UAVs.

Provides detection framework extensible to other UAV network attacks

Requires time and data to train optimal belief model thresholds.

Dependent on attack behaviors matching expected patterns.

Simulation  may  differ  from  real-world

conditions with noise and errors.

Communication overhead  for  collaborative

monitoring between UAVs

Increased computation load for detection policies on resource-limited UAVs

Unable to prevent attacks before they occur, only detect them.

Intrusion Detection and Ejection Framework Against Lethal Attacks in UAV-Aided Networks: A Bayesian Game-Theoretic Methodology

Bayesian games provide an optimized tradeoff between security and overhead.

Belief model reduces false positives/negatives by estimating threat levels.

High detection accuracy (>90%) even with many attackers.

Lower    communication    overhead    than

specification-based systems.

Handles insider misbehavior attacks and scales well as nodes increase.

Flexible framework applicable to different UAV network architectures.

High computational complexity of game theoretic approach.

Requirement for nodes to actively participate in monitoring and ejection.

Detection dependent on attack behaviors matching expected patterns.

Delay between detecting attacks and ejecting malicious nodes.

Simulated environments may differ from real-world conditions.

Increased energy consumption for monitoring and communications.

A Detection and Prevention Technique for Man in the Middle Attack in Fog Computing

Specifically designed for resource-constrained fog computing environments.

Low overhead suspicion level calculation to detect MITM attacks.

Prevents session hijacking unlike authentication-only approaches.

Lightweight AES encryption has minimal impact on latency and energy.

Achieves high attack detection accuracy with low false positives.

Reduces reliance on computationally intensive cryptography.

Accuracy  dependent  on  setting  optimal

suspicion level thresholds.

Increased latency and energy consumption versus no security.

Effectiveness relies on active participation of nodes in monitoring.

Suspicion levels may be circumvented by sophisticated attackers.

Lack of preventive measures before attack detection.

Limited evaluation in simulated environments only.