## 3 System Model
### Threat Model  
In order to detect cyberattacks, the proposed intrusion detection system is explained in Section 4.4.2 and the attacker goals and capabilities are detailed here. The attacker's primary goal is to hamper the data collection process so that the farmer has an erroneous or inaccurate picture of the state of the farm. An example of this is that the UAVs report readings that cause the system to indicate that soil moisture is sufficient, while in reality it is dry. To accomplish this, the attacker locates UAVs, gains access to the control system, and tampers with the data communication. Compromised UAVs end up flying over the farmland needlessly consuming energy, providing incorrect data to the fog broker, and stealing valuable charging time from other legitimate UAVs at the charging station. The attacker achieves these goals by executing one or more of the following attacks:  
* **Distributed denial of service attack** : In a DDoS attack, the attacker attempts to hamper the UAV's data collection process by sending a large number of messages to needlessly engage the UAV in processing useless packets. As a result, either the UAV is unable to communicate with neighboring UAVs or it suffers delays in UAV-to-UAV and UAV-to-sensor communication. Such attacks consume UAV energy significantly.
* **Heart bleed** : In this attack, the attacker attempts to gain unauthorized access to the UAVs by scanning the UAV-to-UAV communication to identify vulnerabilities. For scanning, the attacker can use specialized devices installed nearby; moreover, the UAVs can also be used for initiating the scans. After compromising a UAV, the attacker injects malware and fake data into other connected UAVs; thus, trying to disrupt the data collection process.
* **Brute force** : In this attack, the attacker attempts to gain unauthorized access to the fog portal through UAVs. It is assumed that the admin portal is accessible by UAVs through a wireless link after providing the appropriate credentials. This interface is normally used by the administrator from the fog node to connect to multiple UAVs and update software, configure data collection routes, and perform other administrative tasks. After compromising a UAV the attacker injects malware and fake data into other connected UAVs; thus, trying to disrupt the data collection process.
* **Infiltration attack** : The goal of the infiltration attack is to compromise the UAV network and gain control over the UAVs themselves. Once access is achieved, the UAVs allow for passive reconnaissance, allowing the attacker to gather information about the network and its devices. This information can be used to plan further attacks by identifying and exploiting vulnerabilities that can be used for privilege escalation.  
The CICIDS2017 dataset [66] closely reflects actual real-world data on the following attacks: brute force FTP, brute force SSH, dos, ddos, heart bleed, web attacks, infiltration attacks, and botnets. Here, the observations pertinent to ddos, heart bleed, brute force, and infiltration attacks are used. Additionally, this dataset contains network traffic evaluation performed through CIC FlowMeter, which involved processes labeled according to the timestamp, source, and destination IP addresses, source, and destination port numbers, protocol, and attacks. The dataset is split into training and testing. The training models are deployed on UAVs in a simulation framework to efficiently identify the attacks. Further, the dataset is integrated into the simulation framework in the form of an attack module so that as the simulation progresses the data collected by the UAVs is affected and the proposed intrusion detection system attempts to detect this behavior and weed out the compromised UAVs.