# A Self-Diagnosis Method for Detecting UAV Cyber Attacks Based on Analysis of Parameter Changes
## 2 Materials and Methods
In this case, it is necessary to use not an integral value, but a sum, since we are talking about discrete quantities:  
\[D(P_{n}(\lambda_{n})\Delta t||P_{n}(\lambda_{n})(\Delta t-1))=\sum_{n_{i}\in N }P_{n}(\lambda_{n})\Delta t*\ln\frac{P_{n}(\lambda_{n})\Delta t}{P_{n}(\lambda _{n})(\Delta t-1)}, \tag{6}\]  
where \(P_{n}(\lambda_{n})\Delta t\) is the Poisson distribution for a given exponent \(n\) for the current period \(\Delta t\); \(P_{n}(\chosen with the condition that the divergence should tend to zero and not exceed one. But to avoid unnecessary false alarms, the threshold was increased to two, which was confirmed experimentally. 7. Repeat the algorithm for subsequent values, starting from step 3. Therefore, the higher the entropy, the more likely it is that abnormal behavior is observed. Abnormal behavior can occur not only due to the attack but also due to environmental conditions. Thus, for example, changes in the engine speed and flight altitude may not be related to an attack. To unambiguously identify an attack, it is necessary to analyze several indicators at once and determine the degree of their deviation. Figure 1 shows the calculation of the entropy value for the UAV flight altitude during an attack. Since the attack on the UAV did not begin immediately, the first few values in Figure 1 are quite low, and so we can see an increase in value only in the last three calculations. This is because the UAV under attack may crash and has already begun to descend sharply, but as a result of operator intervention in the crash process, it was prevented. But as mentioned earlier, a lowering of the flight altitude can only indirectly confirm an attack. The most indicative parameter is the number of GPS satellites. The parameter for this calculation is shown in Figure 2.  
Figure 2 shows that high values begin in interval 3. This does not mean that the number of satellites has increased as it also could have decreased. The main thing is that the type of distribution between intervals 2 and 3 does not coincide, and this indicates that  
Figure 1: The result of calculating the Kullback-Leibler divergence of the deviation of the flight altitude indicator during an attack. Figure 2: The result of calculating the Kullback-Leibler divergence for the indicator “number of GPS satellites” at the time of the attack. significant changes have occurred when the number of satellites should be approximately the same. It should be noted that the comparison did not take place with the data obtained in a normal situation. Namely, the data obtained from the different time intervals in the same overall period of the UAV's flight was compared. For example, let us compare the results of searching for anomalies when analyzing the noise level with and without an attack, as shown in Figure 3.  
Figure 3 shows that during the attack, an increase in the entropy value is observed three times. In other words, we can say that it took place throughout the entire flight. During the normal flight, the entropy value remained at the minimum level. This does not mean that there were no deviations during normal flight. They were simply insignificant and did not affect the quality of the flight.