# A Self-Diagnosis Method for Detecting UAV Cyber Attacks Based on Analysis of Parameter Changes
## 3 Results and Discussion
It shows that in the normal mode of UAV flight, the central processor of the flight controller is loaded at its peak by 45%, and during the attack, the load is not stable and reaches 80% at its peak, which means that the drone requires more computation during the attack to maintain its flight stability. Figure 3:2 Loading the UAV processor: (**a**) In the normal mode; and (**b**) during a GPS attack. Figure 3:3 The state of the system performance evaluator: (**a**) In the normal mode; and (**b**) during a GPS attack. From Figure 4(b) we can see that the flight altitude is rather uneven during the attack, especially in the last time intervals when there is a sharp rise. This change in altitude is correlated with the calculation of entropy which is shown in Figure 3:4 The figure shows an increase in the entropy for the flight altitude indicator, which indicates the presence of an anomaly. The parameter number of GPS satellites constantly changes during an attack, and this is clearly seen from Figure 4(b). If there is no attack, this graph looks like a straight line. At the same time, it can be seen from Figure 2 that in the second time interval the level of divergence has already grown significantly. This indicates the presence of serious changes in the system and may indicate an anomaly. At the same time, we draw attention to the fact that the numbers with a change in the altitude and the number of satellites have different orders, but for our method, this turns out to be not important. Due to the use of the probability distribution, we can recognize that the value of the divergence has increased by more than two and this is enough to detect the anomaly. Unlike previous work [23; 24; 25; 26], we do not need to know which behavior is considered normal, or to compose many training datasets. It is enough for the UAV system to obtain one value and it does not need to be compared with a normal value, as in other approaches [8; 9; 10; 11; 12]. Our solution compares observable variables only using their own value in the previous and current periods of time. From Figure 6(a), which shows the result of measuring the GPS noise level, it can be seen that even during normal operation the graph is not a straight line and some noise is evident with changes in its level. At the same time, as shown in Figure 4(b), the Kullback-Leibler divergence is at a low level, that is, the system does not consider this behavior an anomaly. This is due to several factors. Firstly, the change in the noise level with normal behavior is not significant. Secondly, due to the algorithm for processing incoming data, which is presented in Section 2, during data processing, the series are constructed in such a way that the probability distribution does not change its form too much with small changes. This cannot be said about the situation with the GPS noise during an attack. In this situation it changes significantly, as can be seen from Figure 6(b). As a result, the divergence value during the attack is quite high immediately after the first interval, as can be seen in Figure 4(a). Even though the attack is directed at the GPS system, it ultimately affects several parameters at once. These are both the flight altitude and GPS noise and the number of GPS satellites and the level of CPU utilization and energy consumption. For other attacks, such as the eavesdropping attack presented by [PERSON] et al. [31], other sets of parameters can be analyzed and applied. An attack can be detected precisely by a combination of factors. In future papers, a decision-making system will be presented to determine both the attack and, by analyzing several parameters and the degree of their changes, the type of attack. It is difficult to do this using just one parameter, since weather conditions and noise attacks, etc. can also be the cause of changes. In this paper, we focused on GPS spoofing attacks only and studied in detail what parameters are affected and to what extent.