# A Self-Diagnosis Method for Detecting UAV Cyber Attacks Based on Analysis of Parameter Changes
## 2 Materials and Methods  
As a result of theoretical and experimental analysis, we identified a set of the most informative parameters that may indicate a cyber attack. These parameters are: CPU workload, UAV flight altitude (\(h_{a}\)), satellite fix status (\(G_{n}\)), GPS uncertainty (\(G_{u}\)), and GPS noise (\(G_{mil}\)) when detecting a GPS spoofing attack. To analyze changes in these parameters, it is necessary to choose an appropriate type of probability distribution. The choice is based on the fact that these parameters are discrete. Let us consider the most common distribution laws and assess whether they are suitable for the given parameters presented above or not. If the number of occurrences of a random event per unit of time is available, when the fact of the occurrence of this event in each experiment does not depend on how many times and at what points in time it happened in the past, and does not affect the future, and tests are carried out under stationary conditions, then [PERSON]'s law is usually used to describe such a quantity. [PERSON]'s law is also called the law of rare events. Thus we used the Poisson distribution law because, when analyzing the parameters in this study, it is necessary to assess the occurrence of unexpected peak values, which are rare events during the total number of operations of the UAV [28]. The Poisson model \(P()\) is typically used to describe a rare events scheme [29]. Under some assumptions on the nature of random events (the changes observed are random, independent, and discrete events), their number occurring over a specified time interval or a space area often obeys the Poisson distribution:  
\[P(K_{n}) =\frac{\lambda^{K_{n}}}{K_{n1}}e^{-\lambda}, \tag{1}\] \[P(Gn) =\frac{\lambda^{Gn}}{Gn!}e^{-\lambda},\] (2) \[P(h_{a}) =\frac{\lambda^{h_{a}}}{h_{a1}!}e^{-\lambda},\] (3) \[P(G_{a}) =\frac{\lambda^{G_{n}}}{G_{n1}!}e^{-\lambda},\] (4) \[P(G_{nai}) =\frac{\lambda^{G_{nai}}}{G_{nai!}}e^{-\lambda}, \tag{5}\]  
where \(P\) is the probability function of the distribution of a random variable according to [PERSON]'s law; \(K_{n}\) is the percentage of the total amount of processor time in the interval between \(n\) and \(n-1\) that the processor spent on processing tasks when running in the kernel mode; \(h_{a}\) is the UAV's flight altitude; \(G_{n}\) is the state of fixation by satellites (i.e., the number of satellites from which the UAV receives position information); \(G_{u}\) is the GPS's uncertainty; \(G_{nai}\) is the GPS's noise (these parameters are discrete); \(\lambda\) is the mathematical expectation (the average number of events of interest per unit of time); and \(e\) is Euler's number. To obtain the distribution, ten random variables are used. Then the sliding window concept is used to update the distribution information. Six previous values and four new ones are taken and a new distribution is constructed. This concept allows fixing a sharp increase in values. Further, to determine the presence of an anomaly or a state change, it is necessary to determine to what extent the distributions differ from each other. Comparison of distributions rather than raw data gives a more accurate result. Raw data can vary dramatically. At the same time, the changes and observations obtained based on raw data will not indicate an anomaly or attack. Normalizing the raw data and bringing it to a suitable distribution will capture the change in the system. If the entropy values are used (i.e., differences between distributions), an anomaly can be detected. The Kullback-Leibler divergence can be used to calculate the entropy value, for example as in [PERSON] et al. 's work [30].