Unmanned aerial vehicle intrusion detection and countermeasures

• US 10,051,475 B2
• Filed: 09/28/2016
• Issued: 08/14/2018
• Est. Priority Date: 09/28/2015
• Status: Active Grant

• Current Assignee: Department 13, Inc. (Department 13 International Ltd.)
• Original Assignee: Department 13, Inc. (Department 13 International Ltd.)
• Inventors: Shattil, Steve, Sen, Robi
• Primary Examiner(s): Pham, Brenda H
• Application Number:
  US15/279,425
• Publication Number:
  US 20170094527A1
• Time in Patent Office: 685 Days
• Field of Search: 370349, 3703101, 370328, 370338, 370252
• CPC Class Codes: H04K 2203/22 for communication related to vehicles
• CPC Class Codes: H04K 3/44 characterized by the control of the jamming waveform or modulation type
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/92 related to allowing or preventing remote control
• CPC Class Codes: H04L 27/0012 arrangements for identifying the type of modulation
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 69/323 in the physical layer [OSI layer 1]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

A system detects unmanned aerial vehicles (UAVs) and deploys electronic countermeasures against one or more UAVs that are determined to be a threat. A signal detector detects radio signals communicated between a remote control unit and UAV. A feature extractor extracts signal features from the detected radio signals, and a classifier processes the detected radio signals based on its signal features and determines whether the detected radio signals correspond to a known or unknown radio protocol. A threat analyzer determines if a detected UAV is a threat based on at least one of remote-sensing data and classification(s) of the detected radio signals. When a UAV system employs an unknown radio protocol, a mitigation engine synthesizes an exploit based on corresponding extracted signal features. A response analyzer detects a response from the UAV system when an exploit is activated and may adapt the exploit based on the response. In some cases, the exploits can be configured against a UAV in autopilot mode.

Claims

1. An apparatus, comprising:

a radio receiver coupled to at least one antenna and configured to detect radio signals communicated between a remote control unit and a remote-controlled vehicle;

a feature extractor comprising at least one processor configured to extract signal features from detected radio signals;

a classifier comprising at least one processor coupled to a classification database and configured to classify the detected radio signals based on the signal features and determine whether the detected radio signals correspond to a known or unknown radio protocol;

a threat analyzer comprising at least one processor configured to determine if a detected remote-controlled vehicle is a threat based on at least one of remote-sensing data and classification of the detected radio signals; and

a mitigation engine comprising at least one processor configured to synthesize an exploit for a remote-control system that employs an unknown radio protocol based on corresponding extracted signal features.

2. The apparatus recited in claim 1, further comprising a response analyzer configured to detect a response from at least one of the remote-controlled vehicle and the remote control unit when an exploit is activated, update classification of the detected radio signals, and adapt the exploit based on the response.

3. The apparatus recited in claim 1, wherein the radio receiver is configured to measure a plurality of signal attributes from the detected radio signals, filter the detected radio signals based on the plurality of signal attributes, and couple filtered radio signals to the feature extractor.

4. The apparatus recited in claim 1, wherein the radio receiver comprises a Fourier transform and the detected radio signals comprise spectrum data produced by the Fourier transform, and a filter configured to select at least one portion of the spectrum data based on at least one filter criterion, the radio receiver configured to couple the at least one portion of the spectrum data to the feature extractor.

5. The apparatus recited in claim 1, wherein the feature extractor employs at least one of automatic modulation recognition and cyclostationary processing.

6. The apparatus recited in claim 1, wherein the threat detector is configured to evaluate detected radio signals to determine that at least one remote-controlled vehicle is a threat before the at least one remote-controlled vehicle is airborne.

7. The apparatus recited in claim 1, wherein the threat detector is configured to evaluate a target system'"'"'s behavior to determine if it spoofed its authentication data.

8. The apparatus recited in claim 1, wherein the mitigation engine is configured to employ a protocol attack.

9. A non-transitory computer readable storage medium including processor-executable code for storing instructions operable to:

detect radio signals communicated between a remote control unit and a remote-controlled vehicle;

extract signal features from detected radio signals;

classify the detected radio signals based on the signal features and determine whether the detected radio signals correspond to a known or unknown radio protocol;

determine if a detected remote-controlled vehicle is a threat based on at least one of remote-sensing data and classification of the detected radio signals; and

synthesize an exploit for a remote-control system that employs an unknown radio protocol based on corresponding extracted signal features.

10. The medium recited in claim 9, further comprising instructions operable to detect a response from at least one of the remote-controlled vehicle and the remote control unit when an exploit is activated, update classification of the detected radio signals, and adapt the exploit based on the response.

11. The medium recited in claim 9, further comprising instructions operable to measure a plurality of signal attributes from the detected radio signals, filter the detected radio signals based on the plurality of signal attributes, and couple filtered radio signals to a feature extractor.

12. The medium recited in claim 9, further comprising instructions operable to process the detected radio signals with a Fourier transform to provide detected radio signals comprising spectrum data produced by the Fourier transform, filter the spectrum data based on at least one filter criterion to produce at least one portion of the spectrum data, and couple the at least one portion of the spectrum data to a feature extractor.

13. The medium recited in claim 9, wherein extract signal features comprises at least one of automatic modulation recognition and cyclostationary processing.

14. The medium recited in claim 9, wherein determine if the detected remote-controlled vehicle is a threat comprises evaluating detected radio signals to determine that at least one remote-controlled vehicle is a threat before the at least one remote-controlled vehicle is airborne.

15. The medium recited in claim 9, wherein determine if the detected remote-controlled vehicle is a threat comprises evaluating a target system'"'"'s behavior to determine if it spoofed its authentication data.

16. The medium recited in claim 9, wherein synthesize an exploit comprises employing a protocol attack.

17. A method, comprising:

detecting radio signals communicated between a remote control unit and a remote-controlled vehicle;

extracting signal features from detected radio signals;

classifying the detected radio signals based on the signal features to determine whether the detected radio signals correspond to a known or unknown radio protocol;

determining if a detected remote-controlled vehicle is a threat based on at least one of remote-sensing data and classification of the detected radio signals; and

synthesizing an exploit for a remote-control system that employs an unknown radio protocol based on the signal features.

18. The method recited in claim 17, synthesizing comprises detecting a response from at least one of the remote-controlled vehicle and the remote control unit when an exploit is activated, updating classification of the detected radio signals, and adapting the exploit based on the response.

19. The method recited in claim 17, wherein detecting comprises measuring a plurality of signal attributes from the detected radio signals, filtering the detected radio signals based on the plurality of signal attributes, and coupling filtered radio signals to a feature extractor.

20. The method recited in claim 17, wherein the detecting comprises applying a Fourier transform such that the detected radio signals comprise spectrum data, selecting at least one portion of the spectrum data based on at least one filter criterion, and coupling the at least one portion of the spectrum data to the feature extractor.

21. The method recited in claim 17, wherein determining that at least one remote-controlled vehicle is a threat is based on at least one of the detected radio signal and additional sensor data.

22. The method recited in claim 17, wherein determining that at least one remote-controlled vehicle is a threat comprises evaluating a target system'"'"'s behavior to determine if it spoofed authentication data.