# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 3 System Model
### 5G Threats
#### 3.2.4 Attacks against Authentication  
This category includes ten different types of attacks, which are password reuse, password stealing, dictionary attack, brute force attack, de-synchronization attack, verifier leakage, forgery attack, partial-message collision, and stolen smart card attack. The authentication attack disrupts the authentication of the client to the server and vice versa. Password reuse and password stealing occur when an attacker shows itself as a legitimate user in order to log in to the server by guessing various passwords. In the stolen smart card attack, an attacker can disrupt the smartcard-based user password authentication schemes and then remotely achieve vital information without having access to the real passwords [57]. As a result, in order to provide an acceptable level of security in UAVs, several important factors, including reliable ID, reliable SW, secure configuration, trustworthy data, safe communication, privacy, and physical security, should be take into account, as shown in Figure 9. The 5G systems are expected to provide connectivity and other types of services to a large number of devices simultaneously. Such networks, including UAVs, may send or receive an infrequent or frequent small numbers of data, which are transmitted over the air interface and are vulnerable to eavesdropping. In addition to the protection of small data from eavesdropping at the application layer, it also protects the lower layers and protects against eavesdropping of headers such as IP headers. A large number of UAVs acting as UEs performing similar actions at the same time can easily lead to a signaling attack on the network. If such an attack persists and is not dealt with appropriately, it brings a risk for other users in the network. As such, mitigating measures should be designed to protect the network against such attacks. For this key issue, it is assumed that the malicious behavior on the UAV is the result of an attacker with access to the UAV application, which can instruct to make certain requests to the network. An attacker could have obtained this access through the over-the-top service and could for  
Figure 9: UAV security criteria. example instruct the UAVs to set up dedicated bearers or request access to certain network slices [59]. The mitigation of the attack by software and appliances is usually deployed at the central position of the architecture. Thus, latency can be seen because network traffic has to be changed and prepared from the initial main path and then sent back to the destination, which is not the optimum approach. Furthermore, other sections such as core routers, switches, and firewalls must be pre-configured to mitigate attacks and allow the traffic diversion after the mitigation has been done. The SDN-based approach is a networking paradigm that has gained traction due to its dynamic functionality in programming networks and increasing network visibility. It is gaining popularity due to its ability to separate control and data planes of the networking infrastructure and assists in minimizing security vulnerabilities in various networks, such as UAV networks. One of the SDN controller advantages is that it knows the network topology and infrastructure and thus can monitor the traffic network. The SDN controller offers integrated security functions, which are routing, firewalling policies, and service chaining enablement, which provides dynamic security in the network via the controller. An NFV can be used in coordination with an SDN to assist in attack avoidance and network analysis. The NFV concepts deploy complicated network functions in commodity hardware and direct the traffic flows to the right network elements through the application of service chaining dynamically. In other words, NFV enables the development of network-based softwareized tools that can enhance in the security of data transmission networks. When anomalies are discovered, NFV functions will be used to mitigate potential threats. The final model is presented as Software-Defined Security (SDSec).