# Exposing Spoofing Attack on Flocking-Based Unmanned Aerial Vehicle Cluster: A Threat to Swarm Intelligence

Authors: Xinyu Huang; Yunzhe Tian; Yifei He; Endong Tong; Wenjia Niu; Chenyang Li; Jiqiang Liu; Liang Chang
Journal: Security and Communication Networks
 (2020)

---

## Abstract

With the rapid development of wireless communication technology and intelligent mobile devices, unmanned aerial vehicle (UAV) cluster is becoming increasingly popular in both civilian and military applications. Recently, a swarm intelligence-based UAV cluster study, aiming to enable efficient and autonomous collaboration, has drawn lots of interest. However, new security problems may be introduced with such swarm intelligence. In this work, we perform the first detailed security analysis to a kind of flocking-based UAV cluster with 5 policies, an upgrade version of the well-known Boids model. Targeting a realistic threat in a source-to-destination flying task, we design a data spoofing strategy and further perform complete vulnerability analysis. We reveal that such design and implementation are highly vulnerable. After breaking through the authentication of ad hoc on-demand distance vector (AODV) routing protocol by rushing attack, an attacker can masquerade as the first-arrival UAV within a specific scope of destination and generate data spoofing of arrival status to the following UAVs, so as to interfere with their normal flying paths of destination arrival and cause unexpected arrival delays amid urgent tasks. Experiments with detailed analysis from the 5-UAV cluster to the 10-UAV cluster are conducted to show specific feature composition-based attack effect and corresponding average delay. We also discuss promising defense suggestions leveraging the insights from our analysis.


---

## Body

## 1. Introduction

UAVs have been widely used in military and civilian fields due to their low cost and high flexibility. With the rapid development of wireless communication technology and mobile devices, the unmanned aerial vehicle cluster is becoming increasingly popular in tasks of monitoring, search, and rescue in a dangerous environment. Recently, swarm intelligence in the field of AI has been employed in the UAV cluster to provide an efficient and effective collaboration of UAVs that does not require any external remote guidance or any central-node UAV control, amid complex tasks difficult for a single UAV. Thus, the multi-UAV cluster aims to realize an autonomous mechanism by imitating different kinds of swarm including a flock of birds and a swarm of bees. Although such swarm intelligence has shown its potential to provide an efficient and effective UAV collaboration, few studies focus on the security issues brought by swarm intelligence. Thus, it is highly important to deep assess the security of swarm intelligence-based UAV cluster and discover a possible vulnerability that can be maliciously exploited.In this paper, we focus on the swarm intelligence of flocking inspired by birds. There is a classical model named Boids model [1] proposed by Reynolds in 1986, of which there is no central node and each UAV is autonomous through perceiving its neighbors’ information within a certain range nearby [2, 3]. Each UAV’s decision-making is based on three simple policies: dispersion, alignment, and cohesion. Such a collaboration mechanism of policies derives from the birds’ flocking; thus, it is also called flocking in short. In this work, we choose the latest upgraded version of the Boids model including five policies: alignment, homing, cohesion, dispersion, and following, which is more complete for flocking [4]. In the rest of this paper, the flocking is always referred to as this 5-policy flocking. Also, we target a source-to-destination flying task for cluster flying and perform the first detailed security analysis to the flocking-based UAV cluster flying. To the best of our knowledge, no similar work has focused on it.Facing cyberattacks, it is highly important to firstly understand potential security vulnerabilities so that they can be actively resolved before real large-scale deployment. As the first step, we implement the 5-policy flocking algorithm. Through tuning a set of parameters, we successfully realize the flocking to maintain a relatively stable formation for UAV cluster flying. Then we identify basic security challenges, involved authentication, data spoofing, and so on, aiming to understand whether the current design or implementation of the flocking algorithm for UAV cluster is vulnerable and why it is vulnerable and hope to provide insights on how to fundamentally protect it before large-scale UAV cluster deployment.For simplicity, we assume that the UAVs in the cluster move at a constant speed and use the mobile ad hoc network (MANET) [5] to exchange data with other UAVs within the specific range of wireless sensing. The data includes GPS location, speed direction, and arrival status. The only attack requirement that we limit is that there is just one UAV masqueraded to send spoofed data to other UAVs. This can be realized by a rushing attack to break through the authentication of the ad hoc on-demand distance vector (AODV) routing protocol [6, 7]. As reported in former work, such compromise can be performed physically [8], wirelessly [9], or through malware [10, 11]. Thus, only rushing attack one first-arrival UAV for data spoofing of arrival status is closer to the attack reality and ensures that our analysis has highly practical implications.In this work, we find that data spoofing of arrival status is very effective for autonomous flocking-based UAV cluster: through masqueraded UAV sending spoofed data to the following UAVs, the maximum percentage of delay can even reach up to nearly 50%, which completely subverts the advantage of the flocking, as a highly efficient algorithm. Figure1 shows an attack snapshot of the simulation for 8-UAV flocking-based flying from the left sources to the right destinations (denoted as red circles, respectively) in farmland. The axes represent the flying coordinates in meters. Figure 1(a)) shows the attack place occurring to the first-arrival UAV. As shown in Figure 1(b)), during the attack, some UAVs’ trajectories in the cluster have been affected (seen in the green circle) and caused an obvious delay to their destinations. We find that this is due to a vulnerability in the trade-off between security and formation stability: in the flocking algorithm, to maintain the stability of the cluster formation, once a UAV has reached its destination, its information will not be used in the other UAVs’ decision-making anymore.Figure 1
A snapshot of the simulation of 8-UAV flocking-based cluster flying. (a) The attack place to first-arrival UAV. (b) Arrival delays with affected trajectories in green circles.
(a)(b)In our experiment, we find the following: (1) fixing the arrival determining threshold with 20 meters, the delay percentage of smaller UAV cluster is higher than that of a larger cluster, which appears from cluster speed 10 m/s to 20 m/s; (2) lower arrival determining threshold will cause an opposite result, that is, larger cluster having higher delay percentage; (3) fixing the cluster’s speed, whatever the cluster size is, lower arrival determining threshold will cause a higher delay percentage; (4) the maximum delay percentage of 47.84% is obtained in the occasion of cluster size 9, cluster speed 16 m/s, and arrival determining threshold 12 meters.According to our analysis, the current flocking algorithm design is highly vulnerable to data spoofing, causing the whole UAV cluster to delay its arrival to a large extent. We also discuss promising defense directions leveraging the insights from our analysis.We summarize our contributions as follows:(i)
We perform the first security analysis of flocking-based UAV cluster flying. We formulate the problem with a highly realistic threat model, involved AODV link authentication, rushing attack, and data spoofing to UAV cluster and analyze the algorithm design to identify the data spoofing strategy.(ii)
Targeting the goal of causing unexpected arrival delays in flying task, we first perform vulnerability analysis to understand the attack effectiveness. We find that the flocking algorithm design and implementation are highly vulnerable, causing nearly 50% arrival delay in some cases.(iii)
Through massive experiments, we obtain detailed attack results under different cluster features, which helps to provide promising defense directions from our analysis and experimental results.


## 2. Background

In this section, we introduce the necessary background about the swarm intelligence in the UAV cluster and the flocking algorithm that we target.


### 2.1. UAV Swarm Intelligence

Swarming behavior is a common phenomenon in nature. Typical examples include flocks of birds migrating in formation, schools of fish parading in groups, colonies of ants working together, and colonies of bacteria that grow together. The common feature of these phenomena is that a certain number of autonomous individuals, through mutual collaboration and self-organization, present an orderly coordinated movement and behavior on the collective level [12]. In the early stage of research in this area, a lot of work focused on modeling and simulation of natural biological populations. Scholars use a large amount of experimental data to explore the influence of individual behavior and the relationship between individuals on the overall behavior of the group [13, 14].In the field of UAV, the Boids model is naturally applied as the earliest swarm intelligence model, establishing and maintaining collision-free cohesive flocking which requires only three simple policies between idealistic agents: (1) gathering: make the agents in the entire group closely adjacent; (2) keeping distance: adjacent agents keep a safe distance; (3) motion matching: neighboring agents have the same motion state. This model roughly describes the movement characteristics of swarms in nature. Lately, Sharma and Ghose extended the Boids and proposed a swarm intelligence algorithm to avoid cluster collisions [4]. Our work is based on Sharma et al.’s algorithm to build a flocking-based UAV cluster as our target of security analysis.


### 2.2. Flocking Algorithm

In a UAV cluster, the equation of motion in the two-dimensional plane for a UAV can be represented as(1)x˙i=vcosθi,y˙i=vsinθi,θ˙i=ηV,where xi, yi,θi are the x-axis coordinate, y-axis coordinate, and heading angle of the i-th UAV, respectively. V=v means UAV’s speed and η is the acceleration. The detailed calculation is shown as follows:(2)η=kΔθi,Δθi=w1θreq1−θi+w2θreq2−θi+⋯+wnθreqm−θi,where k is the acceleration constant and θreq1,θreq2,…,θreqm are the desired heading angles corresponding to different policies. We can vary the policy weights w1,w2,…,wm to obtain different composite policies.We target the flocking with five basic policies including cohesion, dispersion, following, homing, and alignment as shown in Table1.Table 1
Desired heading angles based on different policies in the flocking algorithm.
PoliciesDesired heading anglesNotationCohesionθCi=arctanYCρ,i−yi/XCρ,i−xiXCρ,i,YCρ,i: the centroid of all UAVs in sensor range ρDispersionθDi=arctanyi−YCd,i/XCd,i−xiXCd,i,YCd,i: the centroid of all UAVs within the dmin rangeFollowingθFi=θNi+θRi/2θRi=arctanYRi−yi/XRi−xiθNi=arctanYNi−yi/XNi−xiXRi,YRi: the coordinate of the randomly selected UAVXNi,YNi: the coordinate of the nearest UAVHomingθHi=arctanYHi−yi/XHi−xiXHi,YHi: the destination coordinateAlignmentθAi=1/ni∑j=1niθjθj: the heading angle of j-th UAVCombinedθi′=θi+ΔθiΔθi=whθHi−θi+waθAi−θi+wcθCi−θi+wdθDi−θi+wfθFi−θiwh,wa,wc,wd,wf: weightsWe usewh,wa,wc,wd,wf to represent the weight of homing, alignment, cohesion, dispersion, and following policies, respectively.Figure2 shows the heading angle computation of a UAV in the cluster. The above basic policies can ensure that the self-organized UAV swarm remains stable and collision-free during the flight. However, when the UAV swarm arrives near the destination, if the arrived UAV is still involved in the angle calculations for other unreached UAVs, the directions of the unreached UAVs will be affected not to reach their destinations. Thus, once there is a UAV in the cluster that has reached its destination, it has to be timely excluded from the calculations.Figure 2
The heading angle of a UAV in its sensor range. By combining the 5 policies’ weight, the heading angle is calculated according to vector addition.Also, in general, to determine whether a UAV has arrived, we calculate the distance between the current location of the UAV and the destination, in which the specified parameterR is defined as an arrival determining the threshold. When the distance between the current location of the UAV and the destination is less than R, the UAV is determined to have reached its destination.


## 2.1. UAV Swarm Intelligence

Swarming behavior is a common phenomenon in nature. Typical examples include flocks of birds migrating in formation, schools of fish parading in groups, colonies of ants working together, and colonies of bacteria that grow together. The common feature of these phenomena is that a certain number of autonomous individuals, through mutual collaboration and self-organization, present an orderly coordinated movement and behavior on the collective level [12]. In the early stage of research in this area, a lot of work focused on modeling and simulation of natural biological populations. Scholars use a large amount of experimental data to explore the influence of individual behavior and the relationship between individuals on the overall behavior of the group [13, 14].In the field of UAV, the Boids model is naturally applied as the earliest swarm intelligence model, establishing and maintaining collision-free cohesive flocking which requires only three simple policies between idealistic agents: (1) gathering: make the agents in the entire group closely adjacent; (2) keeping distance: adjacent agents keep a safe distance; (3) motion matching: neighboring agents have the same motion state. This model roughly describes the movement characteristics of swarms in nature. Lately, Sharma and Ghose extended the Boids and proposed a swarm intelligence algorithm to avoid cluster collisions [4]. Our work is based on Sharma et al.’s algorithm to build a flocking-based UAV cluster as our target of security analysis.


## 2.2. Flocking Algorithm

In a UAV cluster, the equation of motion in the two-dimensional plane for a UAV can be represented as(1)x˙i=vcosθi,y˙i=vsinθi,θ˙i=ηV,where xi, yi,θi are the x-axis coordinate, y-axis coordinate, and heading angle of the i-th UAV, respectively. V=v means UAV’s speed and η is the acceleration. The detailed calculation is shown as follows:(2)η=kΔθi,Δθi=w1θreq1−θi+w2θreq2−θi+⋯+wnθreqm−θi,where k is the acceleration constant and θreq1,θreq2,…,θreqm are the desired heading angles corresponding to different policies. We can vary the policy weights w1,w2,…,wm to obtain different composite policies.We target the flocking with five basic policies including cohesion, dispersion, following, homing, and alignment as shown in Table1.Table 1
Desired heading angles based on different policies in the flocking algorithm.
PoliciesDesired heading anglesNotationCohesionθCi=arctanYCρ,i−yi/XCρ,i−xiXCρ,i,YCρ,i: the centroid of all UAVs in sensor range ρDispersionθDi=arctanyi−YCd,i/XCd,i−xiXCd,i,YCd,i: the centroid of all UAVs within the dmin rangeFollowingθFi=θNi+θRi/2θRi=arctanYRi−yi/XRi−xiθNi=arctanYNi−yi/XNi−xiXRi,YRi: the coordinate of the randomly selected UAVXNi,YNi: the coordinate of the nearest UAVHomingθHi=arctanYHi−yi/XHi−xiXHi,YHi: the destination coordinateAlignmentθAi=1/ni∑j=1niθjθj: the heading angle of j-th UAVCombinedθi′=θi+ΔθiΔθi=whθHi−θi+waθAi−θi+wcθCi−θi+wdθDi−θi+wfθFi−θiwh,wa,wc,wd,wf: weightsWe usewh,wa,wc,wd,wf to represent the weight of homing, alignment, cohesion, dispersion, and following policies, respectively.Figure2 shows the heading angle computation of a UAV in the cluster. The above basic policies can ensure that the self-organized UAV swarm remains stable and collision-free during the flight. However, when the UAV swarm arrives near the destination, if the arrived UAV is still involved in the angle calculations for other unreached UAVs, the directions of the unreached UAVs will be affected not to reach their destinations. Thus, once there is a UAV in the cluster that has reached its destination, it has to be timely excluded from the calculations.Figure 2
The heading angle of a UAV in its sensor range. By combining the 5 policies’ weight, the heading angle is calculated according to vector addition.Also, in general, to determine whether a UAV has arrived, we calculate the distance between the current location of the UAV and the destination, in which the specified parameterR is defined as an arrival determining the threshold. When the distance between the current location of the UAV and the destination is less than R, the UAV is determined to have reached its destination.


## 3. Threat Model

### 3.1. Communication

In the UAV cluster, MANET is a common-used communication network to support UAVs’ communication (see Figure3) [15]. There are two channels: data channel and protocol channel. In our experiment, we limit three data to transmit including heading angle, coordinate, and arrival status.Figure 3
The MANET-based UAV communication. The transmitted data is limited to the heading angle, coordinate, and arrival status.As we can see, MANET is an ad hoc decentralized type of wireless network that does not rely on a preexisting infrastructure, such as routers in wired networks or access points in managed (infrastructure) wireless networks [5]. Instead, each node participates in routing by forwarding data to other nodes, so the determination of which nodes forward data is made dynamically based on network connectivity and the routing algorithm in use [16]. Such wireless networks lack the complexities of infrastructure setup and administration while enabling UAVs to create and join networks anytime efficiently.Due to common attacks in MANET, there is also a communication-related threat to the flocking-based cluster [17], such as wormhole attack, rushing attack, joint attack, Sybil attack, denial of service attacks, and eavesdropping attacks. In this work, we only utilize one communication attack: the rushing attack.Through the rushing attack, data spoofing can be performed. Previous work has demonstrated sensor spoofing attacks to single UAV, such as GPS spoofing [18, 19] to misguide UAV’s trajectory and optical spoofing [20, 21] to gain an implicit control channel. Thus, it is confident to assume that the attacker can perform data spoofing in any type, physically [8], wirelessly [9], or through malware [10, 11].


### 3.2. AODV Link Authentication

MANET is inherently vulnerable to attack due to its fundamental characteristics, such as open medium, distributed nodes, the autonomy of nodes participation in a network (nodes can join and leave the network on its will), lack of centralized authority which can enforce security on the network, distributed coordination, and cooperation [6].Many of the routing protocols devised for use in MANET have their individual character and rules. The most widely used routing protocol is AODV, which relies on the individual node’s cooperation in establishing a valid routing table. However, it only enables a weak link authentication based on all nodes trusted in the network. In the AODV protocol, each node first establishes a valid route to the destination before transmitting its data. Sender node broadcasts an RREQ (route request) message to neighbors and valid route replies with RREP (route reply) with proper route information. The AODV protocol uses a duplicate suppression mechanism to limit the route request and reply chatter in the network (see Figure4). In Figure 4(a)), there are three RREQ messages. Due to the first arrival of the blue path, the duplicate suppression is triggered to ensure that the blue path is a valid link-authenticated one as the right subfigure shows.Figure 4
The duplicate suppression mechanism in AODV protocol, only with a weak link authentication. (a) RREQ process. (b) RREP process.
(a)(b)Although AODV has high efficiency and complexity, AODV does not have heavy node authentication. Thus, once a malicious node can join and disrupt the network by hijacking the routing tables or bypassing valid routes, then it has a chance to eavesdrop on the network if the node can establish the shortest route to any destination by exploiting the unsecured routing protocols [6].As shown in Figure5, the attacker joins the network easily using a rushing attack. The attacker quickly forwards a malicious RREP. Due to duplicate suppression, an actual valid RREP message from the valid node will be discarded and consequently, the attacking node becomes part of the route. After that, the attacker can change the data from the initiator node. To maximize the realism of our threat model, in this paper we assume that only one heading UAV is attacked.Figure 5
Rushing attack launched by the attacker node.


## 3.1. Communication

In the UAV cluster, MANET is a common-used communication network to support UAVs’ communication (see Figure3) [15]. There are two channels: data channel and protocol channel. In our experiment, we limit three data to transmit including heading angle, coordinate, and arrival status.Figure 3
The MANET-based UAV communication. The transmitted data is limited to the heading angle, coordinate, and arrival status.As we can see, MANET is an ad hoc decentralized type of wireless network that does not rely on a preexisting infrastructure, such as routers in wired networks or access points in managed (infrastructure) wireless networks [5]. Instead, each node participates in routing by forwarding data to other nodes, so the determination of which nodes forward data is made dynamically based on network connectivity and the routing algorithm in use [16]. Such wireless networks lack the complexities of infrastructure setup and administration while enabling UAVs to create and join networks anytime efficiently.Due to common attacks in MANET, there is also a communication-related threat to the flocking-based cluster [17], such as wormhole attack, rushing attack, joint attack, Sybil attack, denial of service attacks, and eavesdropping attacks. In this work, we only utilize one communication attack: the rushing attack.Through the rushing attack, data spoofing can be performed. Previous work has demonstrated sensor spoofing attacks to single UAV, such as GPS spoofing [18, 19] to misguide UAV’s trajectory and optical spoofing [20, 21] to gain an implicit control channel. Thus, it is confident to assume that the attacker can perform data spoofing in any type, physically [8], wirelessly [9], or through malware [10, 11].


## 3.2. AODV Link Authentication

MANET is inherently vulnerable to attack due to its fundamental characteristics, such as open medium, distributed nodes, the autonomy of nodes participation in a network (nodes can join and leave the network on its will), lack of centralized authority which can enforce security on the network, distributed coordination, and cooperation [6].Many of the routing protocols devised for use in MANET have their individual character and rules. The most widely used routing protocol is AODV, which relies on the individual node’s cooperation in establishing a valid routing table. However, it only enables a weak link authentication based on all nodes trusted in the network. In the AODV protocol, each node first establishes a valid route to the destination before transmitting its data. Sender node broadcasts an RREQ (route request) message to neighbors and valid route replies with RREP (route reply) with proper route information. The AODV protocol uses a duplicate suppression mechanism to limit the route request and reply chatter in the network (see Figure4). In Figure 4(a)), there are three RREQ messages. Due to the first arrival of the blue path, the duplicate suppression is triggered to ensure that the blue path is a valid link-authenticated one as the right subfigure shows.Figure 4
The duplicate suppression mechanism in AODV protocol, only with a weak link authentication. (a) RREQ process. (b) RREP process.
(a)(b)Although AODV has high efficiency and complexity, AODV does not have heavy node authentication. Thus, once a malicious node can join and disrupt the network by hijacking the routing tables or bypassing valid routes, then it has a chance to eavesdrop on the network if the node can establish the shortest route to any destination by exploiting the unsecured routing protocols [6].As shown in Figure5, the attacker joins the network easily using a rushing attack. The attacker quickly forwards a malicious RREP. Due to duplicate suppression, an actual valid RREP message from the valid node will be discarded and consequently, the attacking node becomes part of the route. After that, the attacker can change the data from the initiator node. To maximize the realism of our threat model, in this paper we assume that only one heading UAV is attacked.Figure 5
Rushing attack launched by the attacker node.


## 4. Attack Construction

In this section, we describe the attack goal and present the data spoofing attack to affect the flocking.


### 4.1. Attack Goal: Arrival Delay

As the first security study on the flocking-based UAV cluster, our analysis in this paper focuses on interfering with the UAV cluster’s normal flying paths to the destination, causing unexpected delays. More specifically, the attacker aims to pretend to be the first arrived UAV to further send spoofed data to the following UAVs and interferes with their heading angles (see Figure6).Figure 6
The illustration of attack for interfering heading angle by comparing different centroids.Such an attack can cause economic losses and affect production work. For example, one of the most potential applications of UAV cluster is for monitoring, search, and rescue in a dangerous environment. Using UAVs to do such a task can reduce unnecessary casualties, and thus, it is highly important to ensure that such flying is well protected and functions correctly and efficiently. Of course, the attacker can also attack multiple heading UAVs at the same time.


### 4.2. Security Analysis and Attack Flow

Our security analysis consists of the following key steps:(1)
Data spoofing strategy identification: before analyzing the vulnerability of the flocking algorithm, we first need to identify meaningful data spoofing strategies. We analyze the parameter data flow to understand how the spoofed data can potentially influence the UAV cluster.(2)
Vulnerability analysis: with the data spoofing strategy identified, we then further perform vulnerability analysis to reveal the attack consequences. To ensure the generality of this analysis, we choose the most potential application of UAV cluster in flying tasks for monitoring, search, and rescue in a dangerous environment and compare the flying trajectory and total time of the task with and without attack.(3)
Cause analysis and exploit construction: with the attack effectiveness for data spoofing quantified, we perform cause analysis for the successful attacks to understand why the current flocking algorithm is vulnerable. Leveraging the insights, we construct corresponding exploits.Figure7 shows the attacked data flow. An attacker can masquerade as the first-arrival UAV within a specific scope of destination and generate data spoofing of arrival status to the following UAVs. Note that GPS and gyroscope are not spoofed. Due to the affected heading angle computed based on weights set of policies, the attacker can interfere with normal flying paths of destination arrival, causing unexpected arrival delays.Figure 7
The attacked data flow in the UAV swarm.The detailed data spoofing attack process is shown in Algorithm1.Algorithm 1:Data spoofing attack algorithm.
Input: R (arrival determining threshold), UAVi(i-th UAV)Output: θi',attack (desired combined heading angle of the i-th UAV after the attack)(1)
//normal(2)
when the first-arrival UAVt is within R scope of its destination then:(3)
UAVt sends arrival status (T) to the following UAVs;(4)
UAVi flies along its desired combined heading angle θi′ calculated by flocking algorithm without UAVt;(5)
//with attack(6)
when the first-arrival UAVt is within R scope of its destination then:(7)
Attacker masquerades asUAVt exploiting rushing attack;(8)
The attacker generates data spoofing of arrival status and sends the malicious arrival status (F) to following UAVs;(9)
UAVi flies along its desired combined heading angle θi′,attack calculated by flocking algorithm including UAVt;(10)
returnθi′,attack


## 4.1. Attack Goal: Arrival Delay

As the first security study on the flocking-based UAV cluster, our analysis in this paper focuses on interfering with the UAV cluster’s normal flying paths to the destination, causing unexpected delays. More specifically, the attacker aims to pretend to be the first arrived UAV to further send spoofed data to the following UAVs and interferes with their heading angles (see Figure6).Figure 6
The illustration of attack for interfering heading angle by comparing different centroids.Such an attack can cause economic losses and affect production work. For example, one of the most potential applications of UAV cluster is for monitoring, search, and rescue in a dangerous environment. Using UAVs to do such a task can reduce unnecessary casualties, and thus, it is highly important to ensure that such flying is well protected and functions correctly and efficiently. Of course, the attacker can also attack multiple heading UAVs at the same time.


## 4.2. Security Analysis and Attack Flow

Our security analysis consists of the following key steps:(1)
Data spoofing strategy identification: before analyzing the vulnerability of the flocking algorithm, we first need to identify meaningful data spoofing strategies. We analyze the parameter data flow to understand how the spoofed data can potentially influence the UAV cluster.(2)
Vulnerability analysis: with the data spoofing strategy identified, we then further perform vulnerability analysis to reveal the attack consequences. To ensure the generality of this analysis, we choose the most potential application of UAV cluster in flying tasks for monitoring, search, and rescue in a dangerous environment and compare the flying trajectory and total time of the task with and without attack.(3)
Cause analysis and exploit construction: with the attack effectiveness for data spoofing quantified, we perform cause analysis for the successful attacks to understand why the current flocking algorithm is vulnerable. Leveraging the insights, we construct corresponding exploits.Figure7 shows the attacked data flow. An attacker can masquerade as the first-arrival UAV within a specific scope of destination and generate data spoofing of arrival status to the following UAVs. Note that GPS and gyroscope are not spoofed. Due to the affected heading angle computed based on weights set of policies, the attacker can interfere with normal flying paths of destination arrival, causing unexpected arrival delays.Figure 7
The attacked data flow in the UAV swarm.The detailed data spoofing attack process is shown in Algorithm1.Algorithm 1:Data spoofing attack algorithm.
Input: R (arrival determining threshold), UAVi(i-th UAV)Output: θi',attack (desired combined heading angle of the i-th UAV after the attack)(1)
//normal(2)
when the first-arrival UAVt is within R scope of its destination then:(3)
UAVt sends arrival status (T) to the following UAVs;(4)
UAVi flies along its desired combined heading angle θi′ calculated by flocking algorithm without UAVt;(5)
//with attack(6)
when the first-arrival UAVt is within R scope of its destination then:(7)
Attacker masquerades asUAVt exploiting rushing attack;(8)
The attacker generates data spoofing of arrival status and sends the malicious arrival status (F) to following UAVs;(9)
UAVi flies along its desired combined heading angle θi′,attack calculated by flocking algorithm including UAVt;(10)
returnθi′,attack


## 5. Attack Evaluation

### 5.1. Setup

We perform a real-world source-to-destination flying task in a simulation environment. The swarm consists of five to ten UAVs and uses the flocking algorithm. This paper uses a laptop computer as the simulation experiment platform to match the real attack scene, and the software platform is MATLAB R2019b. The experimental environment configuration is shown in Table2.Table 2
Experimental environment configuration.
Experimental environmentEnvironmental configurationOperating systemmacOSCPU2.4 GHz Intel Core i5Memory16 GBHardware500 GMain toolsMATLAB R2019b


### 5.2. Feature Computation

We hope to bring a delay of the UAV swarm arriving at the target points. When the cluster is about to reach the target, we launch a rushing attack to the arrived UAV in the MANET, by changing the arrival status data fromT (arrived) to F (not arrived), and send the arrival status data to other UAVs. In this way, the following UAVs will calculate to get a wrong heading angle which will increase the length of their trajectories to the target points and cause arrival delay. In the analysis, we use the increased delay time under attack as a percentage of the original time of the flying task to quantify the effectiveness of our attack.


### 5.3. Influence from Speed

We first evaluate the impact of UAV speed on our attack. We take six different UAV speeds from 10 m/s to 20 m/s to study the effect of speed changes on the delay under a fixed arrival determining thresholdR = 20 m. In order to have universal applicability, we conduct experiments in the case of 5–10 UAV clusters. In the experiments, the initial coordinates of UAVs are random points within five to ten ranges (to ensure the initial safety distance). The target points are 1000 m away from the initial coordinates and the structure of target points is consistent with the initial points’ structure. The velocity of UAVs is from V=10m/s to V=20m/s, the maximum communication range among UAVs is ρ=150m, the threshold for the application of the cohesion policy is dmax=120m, and the threshold for the application of the dispersion policy is dmin=30m. The threshold for judging whether the UAV has reached the target point is R=20m; that is, when the distance between the location of the UAV and its target point is less than 20 m, it can be regarded as having arrived. The weight of 5 policies is wh=0.9,wa=0.5,wc=0.2,wd=0.4, and wf=0.1. This set of weights can ensure that the UAV cluster can fly smoothly to the destination when it is not attacked.The experiment results are shown in Figure8. Figures 8(a)–8(f)) are corresponding to different UAV numbers of the cluster from 5 to 10. We can see that the medium numbers in each experiment are over 10% and tend to increase first and then decrease with the speed of the cluster. The corresponding average percentage of delays increment is summarized in Table 3. We use the increased delay time as a percentage of the original time of the task to quantify the effectiveness of our attack. In these columns, each value is the average delay increment under attack as a percentage of the average task completion time without attack.Figure 8
Delay increment for multi-UAV clusters of different sizes at a speed from 10 to 20 m/s and withR = 20. (a) Boxplot for 5-UAV clusters. (b) Boxplot for 6-UAV clusters. (c) Boxplot for 7-UAV clusters. (d) Boxplot for 8-UAV clusters. (e) Boxplot for 9-UAV clusters. (f) Boxplot for 10-UAV clusters.
(a)(b)(c)(d)(e)(f)Table 3
Average delay increment comparison withR = 20.
Speed (m/s)5-UAV cluster (%)6-UAV cluster (%)7-UAV cluster (%)8-UAV cluster (%)9-UAV cluster (%)10-UAV cluster (%)1015.7012.7910.3713.089.7610.901213.7714.4711.7217.7411.5512.421412.8317.3315.5319.109.5211.011625.0015.9723.6927.7612.8311.521822.3922.2211.1718.2913.6613.762015.6416.1715.6721.6613.7017.03In this experiment, we fix the arrival determining the threshold at 20 meters. We find the following: (1) from the general trend, the delay increment percentage of a smaller UAV cluster is higher than that of a larger cluster; (2) for a given cluster size, the average percentage of delay increment first increases with cluster speed and then decreases; (3) the maximum delay increment percentage of 27.76% is obtained in the occasion of cluster size 8 and cluster speed 16 m/s.


### 5.4. Influence from ThresholdR

Then, we evaluate the impact of arrival determining thresholdR on our attack. We took five different arrival determining threshold from 12 m to 20 m for experiments to study the effect of arrival determining threshold R on the delay under different UAV speeds. In order to have universal applicability, we conducted experiments in the case of 5–10 UAV clusters. In the experiment, the initial coordinates of UAVs are random points within five to ten ranges (to ensure the initial safety distance). The target points are 1000 m away from the initial coordinates and the structure of target points is consistent with the initial points’ structure. The velocity of UAVs is from V=10m/s to V=20m/s, the maximum communication range between UAVs is ρ=150m, the threshold for the application of the cohesion policy is dmax=120m, and the threshold for the application of the dispersion policy is dmin=30m. The arrival determining threshold R is between 12 m and 20 m. The weight of 5 policies is wh=0.9,wa=0.5,wc=0.2,wd=0.4, and wf=0.1.The experiment results are shown in Figure9. The corresponding average percentage of delays increment is summarized in Tables 4–9. In this experiment, we find that when fixing the cluster’s speed, lower arrival determining threshold R will cause a higher delay increment percentage no matter what the cluster size; the maximum delay increment percentage of 47.84% is obtained in the occasion of cluster size 9, cluster speed 16 m/s, and arrival determining threshold 12 meters.Figure 9
Average delay increment comparison for multi-UAV clusters of different sizes at a speed from 10 to 20 m/s and with R from 12 to 20 m. (a) Result for 5-UAV clusters. (b) Result for 6-UAV clusters. (c) Result for 7-UAV clusters. (d) Result for 8-UAV clusters. (e) Result for 9-UAV clusters. (f) Result for 10-UAV clusters.
(a)(b)(c)(d)(e)(f)Table 4
Average delay increment for 5-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1226.5825.7128.7434.2143.2436.231424.3522.0025.6131.5131.5825.591612.1514.7418.7530.9923.6826.98188.9310.6417.7227.5423.2926.23209.7011.0310.3914.9013.7815.60Table 5
Average delay increment for 6-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1231.8434.7628.6528.1429.9533.851423.1829.4722.7521.7928.1721.671625.7120.8322.4920.0122.3116.391819.6313.7118.9914.0915.0514.882012.2011.3813.7512.0614.2910.34Table 6
Average delay increment for 7-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1228.4630.7032.1131.2537.3540.301419.8421.3626.8425.0031.4328.481614.5718.9019.1015.2920.0024.651810.3711.9613.2215.1920.5910.632010.737.7811.758.4411.767.46Table 7
Average delay increment for 8-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1224.5044.7128.7241.9346.5646.221421.4833.6228.9832.5123.5638.631616.6414.4820.4130.4715.9925.431810.2017.2118.677.7620.328.83209.3510.448.099.8211.8410.47Table 8
Average delay increment for 9-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1225.4429.7723.6847.8438.9428.741417.0418.0719.6726.6627.9719.341615.4113.1618.3422.5520.1615.641814.1011.9516.6719.5212.8012.85208.1310.7313.378.9012.9210.60Table 9
Average delay increment for 10-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1237.8438.2439.1542.3635.3835.931434.1634.4337.0830.5333.1835.191625.7019.2923.5411.179.4016.29187.8712.0410.128.7610.099.39205.7912.153.717.618.466.14


## 5.1. Setup

We perform a real-world source-to-destination flying task in a simulation environment. The swarm consists of five to ten UAVs and uses the flocking algorithm. This paper uses a laptop computer as the simulation experiment platform to match the real attack scene, and the software platform is MATLAB R2019b. The experimental environment configuration is shown in Table2.Table 2
Experimental environment configuration.
Experimental environmentEnvironmental configurationOperating systemmacOSCPU2.4 GHz Intel Core i5Memory16 GBHardware500 GMain toolsMATLAB R2019b


## 5.2. Feature Computation

We hope to bring a delay of the UAV swarm arriving at the target points. When the cluster is about to reach the target, we launch a rushing attack to the arrived UAV in the MANET, by changing the arrival status data fromT (arrived) to F (not arrived), and send the arrival status data to other UAVs. In this way, the following UAVs will calculate to get a wrong heading angle which will increase the length of their trajectories to the target points and cause arrival delay. In the analysis, we use the increased delay time under attack as a percentage of the original time of the flying task to quantify the effectiveness of our attack.


## 5.3. Influence from Speed

We first evaluate the impact of UAV speed on our attack. We take six different UAV speeds from 10 m/s to 20 m/s to study the effect of speed changes on the delay under a fixed arrival determining thresholdR = 20 m. In order to have universal applicability, we conduct experiments in the case of 5–10 UAV clusters. In the experiments, the initial coordinates of UAVs are random points within five to ten ranges (to ensure the initial safety distance). The target points are 1000 m away from the initial coordinates and the structure of target points is consistent with the initial points’ structure. The velocity of UAVs is from V=10m/s to V=20m/s, the maximum communication range among UAVs is ρ=150m, the threshold for the application of the cohesion policy is dmax=120m, and the threshold for the application of the dispersion policy is dmin=30m. The threshold for judging whether the UAV has reached the target point is R=20m; that is, when the distance between the location of the UAV and its target point is less than 20 m, it can be regarded as having arrived. The weight of 5 policies is wh=0.9,wa=0.5,wc=0.2,wd=0.4, and wf=0.1. This set of weights can ensure that the UAV cluster can fly smoothly to the destination when it is not attacked.The experiment results are shown in Figure8. Figures 8(a)–8(f)) are corresponding to different UAV numbers of the cluster from 5 to 10. We can see that the medium numbers in each experiment are over 10% and tend to increase first and then decrease with the speed of the cluster. The corresponding average percentage of delays increment is summarized in Table 3. We use the increased delay time as a percentage of the original time of the task to quantify the effectiveness of our attack. In these columns, each value is the average delay increment under attack as a percentage of the average task completion time without attack.Figure 8
Delay increment for multi-UAV clusters of different sizes at a speed from 10 to 20 m/s and withR = 20. (a) Boxplot for 5-UAV clusters. (b) Boxplot for 6-UAV clusters. (c) Boxplot for 7-UAV clusters. (d) Boxplot for 8-UAV clusters. (e) Boxplot for 9-UAV clusters. (f) Boxplot for 10-UAV clusters.
(a)(b)(c)(d)(e)(f)Table 3
Average delay increment comparison withR = 20.
Speed (m/s)5-UAV cluster (%)6-UAV cluster (%)7-UAV cluster (%)8-UAV cluster (%)9-UAV cluster (%)10-UAV cluster (%)1015.7012.7910.3713.089.7610.901213.7714.4711.7217.7411.5512.421412.8317.3315.5319.109.5211.011625.0015.9723.6927.7612.8311.521822.3922.2211.1718.2913.6613.762015.6416.1715.6721.6613.7017.03In this experiment, we fix the arrival determining the threshold at 20 meters. We find the following: (1) from the general trend, the delay increment percentage of a smaller UAV cluster is higher than that of a larger cluster; (2) for a given cluster size, the average percentage of delay increment first increases with cluster speed and then decreases; (3) the maximum delay increment percentage of 27.76% is obtained in the occasion of cluster size 8 and cluster speed 16 m/s.


## 5.4. Influence from ThresholdR

Then, we evaluate the impact of arrival determining thresholdR on our attack. We took five different arrival determining threshold from 12 m to 20 m for experiments to study the effect of arrival determining threshold R on the delay under different UAV speeds. In order to have universal applicability, we conducted experiments in the case of 5–10 UAV clusters. In the experiment, the initial coordinates of UAVs are random points within five to ten ranges (to ensure the initial safety distance). The target points are 1000 m away from the initial coordinates and the structure of target points is consistent with the initial points’ structure. The velocity of UAVs is from V=10m/s to V=20m/s, the maximum communication range between UAVs is ρ=150m, the threshold for the application of the cohesion policy is dmax=120m, and the threshold for the application of the dispersion policy is dmin=30m. The arrival determining threshold R is between 12 m and 20 m. The weight of 5 policies is wh=0.9,wa=0.5,wc=0.2,wd=0.4, and wf=0.1.The experiment results are shown in Figure9. The corresponding average percentage of delays increment is summarized in Tables 4–9. In this experiment, we find that when fixing the cluster’s speed, lower arrival determining threshold R will cause a higher delay increment percentage no matter what the cluster size; the maximum delay increment percentage of 47.84% is obtained in the occasion of cluster size 9, cluster speed 16 m/s, and arrival determining threshold 12 meters.Figure 9
Average delay increment comparison for multi-UAV clusters of different sizes at a speed from 10 to 20 m/s and with R from 12 to 20 m. (a) Result for 5-UAV clusters. (b) Result for 6-UAV clusters. (c) Result for 7-UAV clusters. (d) Result for 8-UAV clusters. (e) Result for 9-UAV clusters. (f) Result for 10-UAV clusters.
(a)(b)(c)(d)(e)(f)Table 4
Average delay increment for 5-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1226.5825.7128.7434.2143.2436.231424.3522.0025.6131.5131.5825.591612.1514.7418.7530.9923.6826.98188.9310.6417.7227.5423.2926.23209.7011.0310.3914.9013.7815.60Table 5
Average delay increment for 6-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1231.8434.7628.6528.1429.9533.851423.1829.4722.7521.7928.1721.671625.7120.8322.4920.0122.3116.391819.6313.7118.9914.0915.0514.882012.2011.3813.7512.0614.2910.34Table 6
Average delay increment for 7-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1228.4630.7032.1131.2537.3540.301419.8421.3626.8425.0031.4328.481614.5718.9019.1015.2920.0024.651810.3711.9613.2215.1920.5910.632010.737.7811.758.4411.767.46Table 7
Average delay increment for 8-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1224.5044.7128.7241.9346.5646.221421.4833.6228.9832.5123.5638.631616.6414.4820.4130.4715.9925.431810.2017.2118.677.7620.328.83209.3510.448.099.8211.8410.47Table 8
Average delay increment for 9-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1225.4429.7723.6847.8438.9428.741417.0418.0719.6726.6627.9719.341615.4113.1618.3422.5520.1615.641814.1011.9516.6719.5212.8012.85208.1310.7313.378.9012.9210.60Table 9
Average delay increment for 10-UAV clusters at a speed of 10–20 m/s and withR of 12–20 m.
ThresholdR (m)V = 10 m/s (%)V = 12 m/s (%)V = 14 m/s (%)V = 16 m/s (%)V = 18 m/s (%)V = 20 m/s (%)1237.8438.2439.1542.3635.3835.931434.1634.4337.0830.5333.1835.191625.7019.2923.5411.179.4016.29187.8712.0410.128.7610.099.39205.7912.153.717.618.466.14


## 6. Defense Suggestion

As our research shows, even though the swarm intelligence algorithm shows high effectiveness under a benign set of weights, the current algorithm design is still very vulnerable to data spoofing attacks. In order to proactively solve these problems before large-scale deployment, this section discusses the defense direction based on the insights derived from our analysis.From our experimental analysis, compared with the higher arrival determining thresholdR, a lower R will cause a higher delay percentage because it is difficult to fly very close to the destination especially at a highly fast speed and under the data spoofing attack. Thus, we suggest increasing R in a reasonable practical range to match the speed. But it is a trade-off between accuracy and safety because if we use a too high value of R, the cluster will lose its accuracy and stop too far away from the destination.Similarly, UAVs at a constant higher speed will not steadily fly to the destination when it approaches the destination and under the attack. To ensure the efficiency of performing tasks, the speed setting can be divided into two stages. In the beginning, UAVs fly at a higher speed. When they approach their destinations, a lower speed should be adopted for a steady fly towards the destination.Another possible defense is increasing the weight of homing policy and decreasing the weight of cohesion, following, and alignment policies especially when the swarm approaches the destination. In this case, although the first-arrival UAV is attacked, the following UAVs will still fly towards their destination due to the enhanced homing force and thus can decrease the influence of attack. Thus, it is highly important to adjust policy weights and speed dynamically and timely according to the current state to achieve a robust, conflict-free, and efficient UAV swarm.The data spoofing attack against UAV clusters is rooted from the attacker breaking through the vulnerable authentication of AODV exploiting a rushing attack. Several robust defenses against rushing attack can be introduced in the multi-UAV cluster communication network [7], such as secure neighbor detection which allowed the sender and the receiver to verify that the other party is within the normal direct wireless communication range because the attacker often forwards an RREQ beyond the normal radio transmission range to achieve faster transit; randomized RREQ forwarding allowed a node first to collect a number of RREQs and select one at random to forward to replace traditional duplicate suppression mechanism in AODV which could be exploited by rushing attackers and blacklist mechanisms using the property of nonrepudiation to spread information about identified malicious nodes. Also, there is always a trade-off issue between strong authentication and flocking efficiency, requiring further light authentication study.


## 7. Related Works

### 7.1. Data Spoofing in UAV

In [8, 9], the authors demonstrated the feasibility of infiltrating internal networks to launch data spoofing through the network node. Lately, a lot of studies show the sensor’s attack to launch data spoofing. More specifically, the GPS spoofing [18, 22] by sending interfering signals is very common. In addition to GPS sensors, other sensors including optical sensors [20, 21] and context-aware services [23–26] can also be threatened to cause data spoofing physically [8, 19, 20, 27–29], wirelessly [9, 30, 31], or through malware [10, 11]. Similar to previous work, our data spoofing is launched through a node in the ad hoc network. Some attacks have been revealed involving wormhole attack, rushing attack, joint attack, Sybil attack, denial of service attacks, and eavesdropping attacks [17]. Prior to our work, there are some related works to attack UAV. The detailed comparison is given in Table 10. We can see that our work focuses on attacking the swarm algorithm as our directed target, compared to those physical sensors or software modules. In addition, compared to the Partial Differential Equation (PDE) algorithm [31], the flocking algorithm enables more control policy that is more practical in real applications. As to the attack effect, general effects include position error, crash, unstable flight, path deviation, and time delay. Although without a crash, our method discovers the attack to cause a heavy time delay of swarm flight, which is still unacceptable in emerging tasks of monitoring, search, and rescue.Table 10
Comparison of different attack methods.
MethodTargetAttack effectPhysicallySon et al. [27]Gyroscopic sensorCrashChoi et al. [28]GPS sensorPath deviationTrippel et al. [29]AccelerometersUnstable flightDavidson et al. [20]Optical flow sensorPosition errorTippenhauer et al. [19]GPS sensorPosition errorThrough malwareDash et al. [11]Software stackUnstable flightMazloom et al. [10]Software stackUnstable flightWirelesslyHighnam et al. [30]Wireless channelDisrupted communicationsGhanavati et al. [31]PDE algorithmTime delayOur methodFlocking algorithmTime delay


### 7.2. Autonomous UAV Cluster and Security

Privacy leak and collision are two common security issues for the UAV cluster. In the works [32–35], researchers studied privacy issues in UAV clusters, such as privacy refers to preventing the inference of the leader’s identity in leader-follower structure swarms. Our work belongs to the latter security issue of flocking-based cluster and collision. Reynolds proposed the Boids model in 1986, which is the earliest flocking model [1]. Zaera et al. intended to develop neural network-based controllers for schooling behavior in three dimensions, using realistic Newtonian kinematics, such as inertia and drag [36]. Vicsek et al. proposed a particle swarm model [37], in which each particle moves at the same unit speed, and the direction is the average of the direction of its neighbor particles. Although this model only achieves the overall direction consistency of the particle swarm and ignores the collision avoidance of each particle, it still makes an important contribution to the modeling of swarm agents. Sharma and Ghose extended the Boids model and proposed a swarm intelligence algorithm to avoid cluster collisions [4].One of the recent applications of the self-organized swarm intelligence algorithm is collective UAVs [38], where decentralized control algorithms for groups of autonomous UAVs can be developed on the basis of interactions as a prerequisite for safe operation. In comparison, our attack target is based on the 5-policy flocking algorithm, which has more widespread applications.The largest UAV cluster so far was developed by Ehang with more than 1000 UAVs. However, these UAVs were individually programmed for predefined trajectories or were centrally controlled and did not satisfy the autonomy with swarm intelligence [39]. The US military had an experiment with fixed-wing drone swarms called Perdix [40, 41]. Unfortunately, there is no public information about its control mechanisms, communication schemes, or possible collision avoidance behaviors to reliably evaluate. In comparison, we target a lab-level UAV cluster with 10 UAVs.A previous related work is the intrusion detection-based multi-UAV mission execution [42]. In their method, a subflight area is demarcated by the coordinates of the waypoints in the assigned tasks of the UAV. According to the UAV’s GPS coordinates, if the current UAV exceeds this area, it is considered suspicious and will cut off the connection with other UAVs, and the others reconnect. In comparison, our method focuses on flocking-based UAV collaboration, and we do not perform GPS spoofing but arrival status spoofing, which is a special parameter in the swarm intelligence of flocking.


## 7.1. Data Spoofing in UAV

In [8, 9], the authors demonstrated the feasibility of infiltrating internal networks to launch data spoofing through the network node. Lately, a lot of studies show the sensor’s attack to launch data spoofing. More specifically, the GPS spoofing [18, 22] by sending interfering signals is very common. In addition to GPS sensors, other sensors including optical sensors [20, 21] and context-aware services [23–26] can also be threatened to cause data spoofing physically [8, 19, 20, 27–29], wirelessly [9, 30, 31], or through malware [10, 11]. Similar to previous work, our data spoofing is launched through a node in the ad hoc network. Some attacks have been revealed involving wormhole attack, rushing attack, joint attack, Sybil attack, denial of service attacks, and eavesdropping attacks [17]. Prior to our work, there are some related works to attack UAV. The detailed comparison is given in Table 10. We can see that our work focuses on attacking the swarm algorithm as our directed target, compared to those physical sensors or software modules. In addition, compared to the Partial Differential Equation (PDE) algorithm [31], the flocking algorithm enables more control policy that is more practical in real applications. As to the attack effect, general effects include position error, crash, unstable flight, path deviation, and time delay. Although without a crash, our method discovers the attack to cause a heavy time delay of swarm flight, which is still unacceptable in emerging tasks of monitoring, search, and rescue.Table 10
Comparison of different attack methods.
MethodTargetAttack effectPhysicallySon et al. [27]Gyroscopic sensorCrashChoi et al. [28]GPS sensorPath deviationTrippel et al. [29]AccelerometersUnstable flightDavidson et al. [20]Optical flow sensorPosition errorTippenhauer et al. [19]GPS sensorPosition errorThrough malwareDash et al. [11]Software stackUnstable flightMazloom et al. [10]Software stackUnstable flightWirelesslyHighnam et al. [30]Wireless channelDisrupted communicationsGhanavati et al. [31]PDE algorithmTime delayOur methodFlocking algorithmTime delay


## 7.2. Autonomous UAV Cluster and Security

Privacy leak and collision are two common security issues for the UAV cluster. In the works [32–35], researchers studied privacy issues in UAV clusters, such as privacy refers to preventing the inference of the leader’s identity in leader-follower structure swarms. Our work belongs to the latter security issue of flocking-based cluster and collision. Reynolds proposed the Boids model in 1986, which is the earliest flocking model [1]. Zaera et al. intended to develop neural network-based controllers for schooling behavior in three dimensions, using realistic Newtonian kinematics, such as inertia and drag [36]. Vicsek et al. proposed a particle swarm model [37], in which each particle moves at the same unit speed, and the direction is the average of the direction of its neighbor particles. Although this model only achieves the overall direction consistency of the particle swarm and ignores the collision avoidance of each particle, it still makes an important contribution to the modeling of swarm agents. Sharma and Ghose extended the Boids model and proposed a swarm intelligence algorithm to avoid cluster collisions [4].One of the recent applications of the self-organized swarm intelligence algorithm is collective UAVs [38], where decentralized control algorithms for groups of autonomous UAVs can be developed on the basis of interactions as a prerequisite for safe operation. In comparison, our attack target is based on the 5-policy flocking algorithm, which has more widespread applications.The largest UAV cluster so far was developed by Ehang with more than 1000 UAVs. However, these UAVs were individually programmed for predefined trajectories or were centrally controlled and did not satisfy the autonomy with swarm intelligence [39]. The US military had an experiment with fixed-wing drone swarms called Perdix [40, 41]. Unfortunately, there is no public information about its control mechanisms, communication schemes, or possible collision avoidance behaviors to reliably evaluate. In comparison, we target a lab-level UAV cluster with 10 UAVs.A previous related work is the intrusion detection-based multi-UAV mission execution [42]. In their method, a subflight area is demarcated by the coordinates of the waypoints in the assigned tasks of the UAV. According to the UAV’s GPS coordinates, if the current UAV exceeds this area, it is considered suspicious and will cut off the connection with other UAVs, and the others reconnect. In comparison, our method focuses on flocking-based UAV collaboration, and we do not perform GPS spoofing but arrival status spoofing, which is a special parameter in the swarm intelligence of flocking.


## 8. Conclusions

In this work, we perform the first security analysis of the flocking algorithm that is most widely used in UAV clusters. Targeting a highly realistic threat model in AODV link authentication through rushing attack-based data spoofing, we perform vulnerability analysis and find that the current flocking algorithm design is highly vulnerable to data spoofing attacks. The evaluation results in the simulation environment validate the effectiveness of the attack and show that the attack can even cause nearly 50% arrival delay. Defense directions are then discussed leveraging the insights.This work serves as a first step to understand the new security problems and challenges in the flocking, a main kind of swarm intelligence algorithm of UAVs. It is expected to inspire a series of follow-up studies, including but not limited to (1) more extensive evaluation with UAV clusters with different formation structures, (2) more extensive analysis considering other swarm intelligence algorithms, such as the one imitating bees or ants, and (3) more concrete defense approach and evaluation.



---

*Source: 8889122-2020-12-10.xml*