# ECU-IoFT: A Dataset for Analysing Cyber-Attacks on Internet of Flying Things
## 4 Anomaly Detection Using ECU-IoT Dataset  
Anomaly detection is an important data analysis task in the realm of cyber security [30,31]. In the last few decades, the artificial intelligence research community have developed a plethora of algorithms to analyse the data better and identify patterns of interest [32]. These algorithms are widely used to detect cyberattacks and to examine their efficacy, newer datasets are required. Therefore, in this section, ECU-IoT dataset is used to analyse the performance of five most popular anomaly detection algorithms. Since, supervised and semi-supervised algorithms require a set of data for training and unable to  
\begin{table}
\begin{tabular}{l c} \hline \hline
**Protocol** & **Observation** \\ \hline
802.11 & 54,280 (99.6\%) \\ EAPOL & 3 (close to 0\%) \\ ICMP & 2 (close to 0\%) \\ UDP & 207 (0.40\%) \\ \hline \hline \end{tabular}
\end{table}
Table 4: ECU-IoT Dataset–Protocol distribution.  
Figure 5: ECU-IoT data distribution.  
identify zero-day attacks, we have excluded them for the analysis. For evaluation purpose, we have used the _Hit Rate_ metric, also known as _True Positive Rate_. Figure 6 showcases the anomaly detection techniques used for analysis. The details of these algorithms are available in [8; 33; 34].  
In Table 5, the performance of these algorithms is showcased in identifying individual attacks from the ECU-IoFT dataset (the green color is a reflection of best performance and the red color is for worst performance). It is clear that each of the algorithms is successful in identifying the API exploits, whereas the majority of algorithms (k-NN, LOF, and HBOS) struggled to detect the deauthentication attacks. The cracking attacks are fairly identifiable by the algorithms and k-NN shows superior performance. Figure 7 showcases the overall performance in identifying attacks from the dataset. It is evident that, among these five popular algorithms, clustering-based techniques are more suitable for identifying the three types of attacks in IoFT environment, i.e., API exploit, Wi-Fi cracking, and deauthentication. In future instances, the endeavor will be taken towards other types of cyberattacks and the effectiveness of other algorithms will be investigated. At present in the given circumstances of ECU-IoFT dataset, the _CBLOF_ technique [35] outperforms the rest of the techniques to identify the three attacks showcased in this paper.  
Based on the signature analysis of deauthentication attacks, it is observed that these attacks do not require the attacker to be a member of the Wi-Fi network. The attackers can launch attacks just being within the vicinity of Wi-Fi Access Point. To address such attacks, the Wi-Fi network administrators can set some access control mechanisms to hinder such attacks. The drone manufacturers can also incorporate more strong authentication policies to ensure the safety and security of the drone users. Since these low-cost drones are mostly used in the education sector, the compromised drone ecosystem will jeopardize the original objectives. We are hopeful that, this paper will reinforce the need for robust cyber security in low-end drones and create awareness for the users.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **API Exploit** & **Deauthentication** & **Cracking** \\ \hline k-NN & 100\% & 2.83\% & 100\% \\ LOF & 100\% & 0\% & 37.83\% \\ CBLOF & 100\% & 100\% & 81.07\% \\ LDCOF & 100\% & 100\% & 63.72\% \\ HBOS & 100\% & 0\% & 37.53\% \\ \hline \hline \end{tabular}
\end{table}
Table 5: Hit rates of anomaly detection algorithms.  
Figure 6: Anomaly detection algorithms.