# Method for Detecting Abnormal Activity in a Group of Mobile Robots
## 2 Related Work  
To date, problems related to the safety of a group of mobile robots were actively studied. There were several studies related to the development of intrusion detection systems for mobile robots. The software has several requirements. The following metrics were used as the UAV attack behavior indicators in Reference [10]:  
* The first indicator is that a UAV readies its weapon when outside the battlespace. * The second indicator is that a trusted node's embedded sensor reading differs from the monitor's embedded sensor reading. * The third indicator is that a monitor UAV provides bad-mouthing attacks, i.e., providing bad recommendations regarding a well-behaving trusted UAV. * The fourth indicator is that a UAV deploys landing gear when outside its domestic air base. * The fifth indicator is that a node sends bytes to unauthorized parties. * The sixth indicator is that a UAV uses countermeasures without identifying a threat. * The seventh indicator is that a loitering UAV uses more than the minimum thrust required to maintain altitude. These indicators basically allow determining the mobile robot behavior from the position of the physical device. In this approach, there are advantages and disadvantages. The main drawback is that, if it is necessary to use this attack detection system for other types of mobile robots, then a set of indicators should be changed. The lack of connectivity parameter, which helps to detect a denial of service attack, was considered in Reference [11]. To identify attacks, the following metrics were used [12]: node reputation, behavior score, and distance estimation. Such metrics allow identifying attacks aimed at changing the behavior of nodes. An intrusion detection system based on the C 5.0 decision tree for a group of robotic vehicles was considered in Reference [13]. The advantage of the presented approach was that the authors considered cyber-attacks. To detect these attacks, the authors used cyber input functions. They used four parameters to analyze the physical properties of the robot, which the authors called the physical characteristics of the input signal. Thus, they often investigated the behavioral characteristics of robots or changes in the physical environment. In Reference [14] proposes the research of a technique for assessing the effectiveness of attacks on ad hoc networks. However, in this research, the authors mainly considered the attacks associated with the ad hoc on-demand distance vector (AODV) routing protocol. Although this protocol is often used to build ad hoc networks, there are other routing protocols, and their study was quite specialized. In Reference [15], the problem of detecting denial of service attacks using cyber parameter analysis was considered. The authors implemented a stand that includes a mobile guided robot. In this case, a denial of service (DoS) attack of the flood type was realized, affecting the movement of the robot. Two attack scenarios were developed. In the first case, the robot moved at the same speed, and, in the second case, it could accelerate and slow down. The impact of the DoS attack on the movements of the mobile robot was revealed as a result. Thus, the authors used the Snort attack detection system and increased two parameters: robot halting and delay in responding to navigation commands. An algorithm for the sustainable formation of robots based on a multi-agent approach was presented in Reference [16]. To achieve resilient control, when an attack was detected, the state of the model was used to determine the control action for the agent, and the corrupted information coming through the network was ignored. In an experimental study, they demonstrated that robots managed to maintain formation even in the presence of DoS attacks by developing an algorithm. In this case, the robots managed to maintain the deployment regardless of whether the attack was implemented on one or several nodes or not.