# Securing the Smart City Airspace: Drone Cyber Attack Detection through Machine Learning
## 3 Data Acquisition and Attack Vector Generation
### DJI Phantom 4 Data  
The DJI Phantom 4 drone dataset was acquired from VTO Labs [23], comprising DAT files of flight logs, obtained from various flights undertaken by a single drone. The dataset includes 40 flight logs. However, only 18 logs could be adopted for our experiments due to the presence of inconsistencies and errors such as missing parameter values and lack of GPS data or the occurrence of truncated files, which were consequently discarded. These flight logs comprised information recorded by the main components of the UAV, including the flight controller, gyro stabilizer, on-board flight computer communication system, power supply, GPS modules and the likes [24]. The DAT files were processed and converted into CSV files using the CSVView and DatCon tools as also adopted in previous studies [25]. The sampling rate chosen in the DatCon tool to extract the CSV formatted file, was set at 10 Hz.  
CSV files thus obtained comprised 289 fields (column labels). Categories of data available in these flight logs are listed as follows:  
* State Signals;
* Time-Series Signals (including):
* Air Speed,
* ATTI_MINI (Attitude Mode),
- & Battery Info,
- & Batter Status,
- & Clock,
- & Compass Filter,
- & Controller,
- & GPS,
- & IMU_ATTI (inertial measurement unit),
- & Motor and Motor Control,
- & osd Data (on screen display),
- & RC_info (radio controller information).  
State signals are categorical fields indicating the state of the drone whilst in flight. In contrast, the time-series signals are numerical fields with some observed value of various fields related to its flight. In this work, we only study the time-series fields to avoid unpredictable behavior of machine learning algorithms, given the variability of time series data (i.e., entropy). Specifically, the flight logs from the following file path within the DJI Phantom memory system were considered: \"Drone_Forensics > DJI_phantom_4 > df005_DJI_Phantom_4 > 2018_June > flight_logs > flight_logs.zip\". To perform exploratory analysis and classification tasks, only data files that contained the full set of 288 features were considered. Some of the important features related to flight logs are listed in Table 2.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Field** & **Description** \\ \hline Clock:offsetTime & Time since the start of the flight \\ \hline \multirow{2}{*}{IMU\_ATTI(0):Longitude\({}^{\prime}\)} & Drone’s geographic east-west location \\  & on Earth’s surface \\ \hline \multirow{2}{*}{IMU\_ATTI(0):Latitude\({}^{\prime}\)} & Drone’s geographic north-south location \\  & on Earth’s surface \\ \hline \multirow{2}{*}{IMU\_ATTI(0):relativeHeightC\({}^{\prime}\)} & Altitude of the drone \\ \hline \multirow{2}{*}{IMU\_ATTI(0):rollC\({}^{\prime}\)} & Left-right movement angle of the drone \\  & horizontally \\ \hline \multirow{2}{*}{IMU\_ATTI(0):pitchC\({}^{\prime}\)} & Forward and backwards movement angle \\  & of the drone \\ \hline \multirow{2}{*}{IMU\_ATTI(0):yaw:C\({}^{\prime}\)} & Rotation around the drone’s central axis \\ \hline \multirow{2}{*}{IMU\_ATTI(0):distanceTravelled:C\({}^{\prime}\)} & Distance travelled by the drone from the start \\  & point \\ \hline \multirow{2}{*}{Controller:ctrl\_throttle:D\({}^{\prime}\)} & Throttle given to the drone usually \\  & for providing lift. \\ \hline IMU\_ATTI(0):numSats & Number of satellites that the drone is \\  & connected to \\ \hline Controller:motor\_average\_speed:D & Average speed of the drone’s four motors. \\ \hline \multirow{4}{*}{osd\_data:navHealth} & The navigation health of drone in terms \\  & of number of GPS satellites it is connected to. \\ \cline{1-1}  & Value of zero indicates unreliable GPS data and \\ \cline{1-1}  & value of five indicates good signal reception. \\ \hline \multirow{2}{*}{RC\_info:frame\_lost} & This field indicates the connectivity between \\ \cline{1-1}  & radio controller and the drone. \\ \hline \hline \end{tabular}
\end{table}
Table 2: Important flight data features for intrusion detection tasks.