# Securing the Smart City Airspace: Drone Cyber Attack Detection through Machine Learning
## 3 Data Acquisition and Attack Vector Generation
### Exploratory Analysis  
_Discerning Malicious Outliers_  
In order to conduct an exploratory analysis, we first adopted the commonly used clustering algorithm, namely, unsupervised Gaussian mixture models (GMM) for cluster and outlier analysis as shown in Figure 2. This procedure was undertaken to identify potential anomalous points in the dataset. For the exploratory analysis, we only considered a subset of flight logs. Instead of using Euclidean distances, GMM uses probability distribution of various points (of the feature-value tuples of the dataset), to identify various data distributions that exist in the dataset. The advantage of using GMM is that it considers data points that belong to the same cluster and which follow a Gaussian distribution. Hence, each distribution is defined as a unique cluster. Figure 3 presents the various clusters formed in the partial dataset, which also contains outlier samples. Further analysis of the flight path data for this data subset yields the finding that there are anomalous flight events in flight log 19, as shown in Figure 3. \begin{table}
\begin{tabular}{c c} \hline \hline
**Field** & **Description** \\ \hline \multirow{2}{*}{ctrl\_throttle:D} & This indicates the throttle given to the drone \\  & from the user. \\ \hline \multirow{2}{*}{BatteryStatus:volLevel} & This field indicates the voltage level \\  & of the battery. \\ \hline Motor:Speed:RFront & Drone’s right front motor speed \\ \hline Motor:Speed:LFront & Drone’s left front motor speed \\ \hline Motor:Speed:LBack & Drone’s left back motor speed \\ \hline Motor:Speed:RBack & Drone’s right back motor speed \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._  
Figure 3: Identifying the flight number with abnormal pitch values. Figure 2: Pitch vs. roll in flight trajectory clusters obtained from GMM. Further analysis of flight19 logs using the CSVView tool indicates more anomalous events during the flight. The data revealed that an anomalous event occurred in the initial stages of the flight operations, which comprised a sharp increase in the pitch angle and a sharp descent of the drone along with a low/zero thrust to the drone, as shown in Figure 4. The sudden drop in the flight altitude can also be attributed to a cyber attack wherein an intruder deliberately hijacks the drone and suddenly impedes throttle to cause the drone to descend steeply and crash and get destroyed. The GPS jamming attack comprises a disruption of GPS signals through jamming of signals (radio) that are transmitted and received between a drone and a ground controller unit. Figure 5 shows the time window of the flight operation wherein the GPS signals become unreliable. A GPS jamming attack results in a similar situation wherein, GPS signals can be disrupted to cause the drone to loose the ability to identify its flying coordinates, and possibly trigger a Return To Home (RTH) routine [14]. A DoS event is the occurrence of a sudden loss in the power supply to the drone motors/rotors (hijacking). The thrust to the drone is provided by its four motors (two in front and two in the back), in a typical quadcoptor model. Through switching of these motors, the drones are maneuvered and its height is controlled. Figure 4: Abnormal operations in flight-log-19. Figure 5: Unreliable GPS signal observed in the drone. In regard to hijacking attacks, a sudden drop in motor speeds can occur when an intruder successfully gains access to the drone's ground controller or is successful in hijacking a remote asset such as an intermediary device that the ground controller is communicating with, and can thus deliberately power off the motors. This potential anomalous event is illustrated in Figure 6.  
A variant denial of service (DoS) attack scenario causes the data communication flow between a ground-based radio controller and resulting in significant communication loss. In-flight parameters, namely, 'osd_data:connectedToRC' and 'RC_Info:frame_lost:D' capture the status of the connection between the radio controller and the drone.