# Risk Assessment of UAV Cyber Range Based on Bayesian-Nash Equilibrium
###### Abstract
From the foregoing analysis, it is evident that cyber intrusions can incapacitate a UAV's control system, rendering it unresponsive to legitimate commands and thereby facilitating its unauthorized commandeering. This phenomenon, where UAVs fall prey to cyber hijacks, has escalated into a critical concern, jeopardizing national security on multiple fronts. At present, there are more studies on the physical security of UAV, but less on the information security of UAVs, because a UAV is a special CPS system, and the security research of CPS system mainly includes the directions of defense in depth, intrusion detection, and risk assessment. Among them, risk assessment can help managers judge the security level of UAV, and deploy targeted defense measures, which is of profound significance. Many researchers at home and abroad have studied the threat assessment methods of a CPS system based on various theories. Based on fuzzy Analytic Hierarchy Process (AHP), the authors of [15] conducted hierarchical modeling of CPS system devices and attack behaviors, evaluated the threat value of each device in the system, and then deployed more effective defense measures. Based on the attack map and the quantitative vulnerability index of the system, the study analyzes the vulnerability of all possible attack paths, and obtains the best attack path for threat analysis. The paper uses an attack tree to model the industrial control system, uses fuzzy number to calculate node interval probability, and obtains the probability of each attack path in the system. The study uses an attack tree to assess the information security vulnerability of CPS system. The above research methods mainly carry out risk assessment from the aspects of CPS system structure or attackers, etc. In this paper, the risk assessment methods of common information systems are transferred to the UAV cyber range, and the impact of the defense strategy and offensive and defensive confrontation of the UAV cyber range on the UAV security is considered. The authors of [16] proposed an information risk assessment method of CPS system based on offensive and defensive game, and established a complete information static game model for threat assessment and analysis. However, there is information uncertainty between attack and defense; so, the practicability of the complete information game model is very limited. In view of the shortcomings of the above research, for equipment with high vulnerability in the UAV range, it is important to consider how to cost-effectively deploy defensive measures for the equipment. Considering how to deploy defense measures to UAV cyber range in combination with capital investment in order to obtain the highest return on investment, and how to find a balance between UAV information security risk and security investment, we are faced with the decision problem of making reasonable defense strategy choices by using limited resources. The game theory in economics can be used for reference to study the selection of security strategies of UAV cyber range. The contribution of this paper is a common information system risk evaluation method that will be migrated to the UAV cyber range, and it considers the defensive strategy of UAV range and attack-defense confrontation and the influence on UAV risk, providing a new perspective and method for the UAV cyber range risk evaluation. By constructing an attack and defense tree model for the UAV cyber range, the attack and defense strategy sets of attackers and defenders are analyzed, and the attack and defense revenue function is calculated. Therefore, this paper proposes a method of UAV range risk assessment based on an incomplete-information static attack and a defense game model. The main innovation of this method lies in two aspects. On the one hand, it combines the static game model of incomplete information and considers the information asymmetry that may be encountered in practical work.