Unmanned aerial vehicle intrusion detection and countermeasures

• US 10,237,743 B2
• Filed: 08/13/2018
• Issued: 03/19/2019
• Est. Priority Date: 09/28/2015
• Status: Active Grant

• Current Assignee: Department 13, Inc. (Department 13 International Ltd.)
• Original Assignee: Department 13, Inc. (Department 13 International Ltd.)
• Inventors: Shattil, Steve, Sen, Robi
• Primary Examiner(s): Pham, Brenda H
• Application Number:
  US16/102,098
• Publication Number:
  US 20190007841A1
• Time in Patent Office: 218 Days
• CPC Class Codes: H04K 2203/22 for communication related to vehicles
• CPC Class Codes: H04K 3/44 characterized by the control of the jamming waveform or modulation type
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/92 related to allowing or preventing remote control
• CPC Class Codes: H04L 27/0012 arrangements for identifying the type of modulation
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 69/323 in the physical layer [OSI layer 1]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

A system deploys electronic countermeasures against unmanned aerial vehicles (UAVs) that are determined to be a threat. A radio transceiver coupled to at least one antenna detects if radio signals are being communicated between a remote control unit and a UAV. A mitigation engine communicatively coupled to the radio transceiver synthesizes an exploit signal to be transmitted to the UAV, wherein the exploit signal is configured to inject commands into the UAV'"'"'s navigation system. If the system determines that the UAV is operating in an autopilot mode, it transmits an induce-mode signal that causes the UAVs to switch to a communication mode so the UAV is responsive to the exploit signal.

Claims

1. An apparatus, comprising:

a radio transceiver coupled to at least one antenna and configured to detect if radio signals are being communicated between a remote control unit and a remote-controlled vehicle, and to transmit signals to the remote-controlled vehicle; and

a mitigation engine communicatively coupled to the radio transceiver and configured to synthesize an exploit signal to be transmitted to the remote-control vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle'"'"'s navigation system;

wherein, upon determining the remote-controlled vehicle is operating in an autopilot mode, transmitting an induce-mode signal to induce the remote-controlled vehicle to switch to a communication mode to cause the remote-controlled vehicle to be responsive to the exploit signal.

2. The apparatus recited in claim 1, further comprising a threat analyzer comprising at least one processor configured to determine if the remote-controlled vehicle is a threat based on remote-sensing data.

3. The apparatus recited in claim 1, further comprising a response analyzer configured to detect a response from the remote-controlled vehicle, the response comprising at least one of a radio transmission from the remote-controlled vehicle and a change in the remote-controlled vehicle'"'"'s navigation, and the mitigation engine configured to adapt the exploit signal based on the response.

4. The apparatus recited in claim 1, further comprising a classifier comprising at least one processor coupled to a classification database and, responsive to sensor data, configured to classify the remote-controlled vehicle by at least one of manufacturer, model number, and operating system;

and wherein the mitigation engine is responsive to classification of the remote-controlled vehicle for selecting at least one of the exploit signal and the induce-mode signal.

5. The apparatus recited in claim 1, wherein the mitigation engine is configured to employ information about the remote-controlled vehicle obtained from sensor data to generate at least one of the exploit signal and the induce-mode signal.

6. The apparatus recited in claim 1, wherein the mitigation engine is configured to employ machine learning to apply exploits against the remote-controlled vehicle, monitor responses of the remote-controlled vehicle to each exploit, and adapt the exploit signal.

7. The apparatus recited in claim 1, wherein the radio transceiver comprises a plurality of network edge devices, the mitigation engine comprises a plurality of processors in a central-processing configuration or a Cloud-computing configuration, and a fronthaul network communicatively couples the mitigation engine to the plurality of network edge devices.

8. The apparatus recited in claim 1, wherein the radio transceiver comprises a plurality of airborne radio transceivers.

9. An apparatus comprising at least one processor, memory in electronic communication with the processor, and instructions stored in the memory, the instructions executable by the at least one processor to:

detect if radio signals are being communicated between a remote control unit and a remote-controlled vehicle;

synthesize an exploit signal to be transmitted to the remote-controlled vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle'"'"'s navigation system; and

upon determining the remote-controlled vehicle is operating in an autopilot mode, transmit an induce-mode signal to the remote-controlled vehicle to induce the remote-controlled vehicle to switch to a communication mode to cause the remote-controlled vehicle to be responsive to the exploit signal.

10. The apparatus recited in claim 9, further comprising instructions executable by the at least one processor to determine if the remote-controlled vehicle is a threat based on remote-sensing data.

11. The apparatus recited in claim 9, further comprising instructions executable by the at least one processor to:

detect a response from the remote-controlled vehicle, the response comprising at least one of a radio transmission from the remote-controlled vehicle and a change in the remote-controlled vehicle'"'"'s navigation; and

adapt the exploit signal based on the response.

12. The apparatus recited in claim 9, further comprising instructions executable by the at least one processor to:

responsive to sensor data, classify the remote-controlled vehicle by at least one of manufacturer, model number, and operating system; and

responsive to classification of the remote-controlled vehicle, select at least one of the exploit signal and the induce-mode signal.

13. The apparatus recited in claim 9, further comprising instructions executable by the at least one processor to employ information about the remote-controlled vehicle obtained from sensor data to generate at least one of the exploit signal and the induce-mode signal.

14. The apparatus recited in claim 9, wherein the instructions executable by the at least one processor are configured to employ machine learning to apply exploits against the remote-controlled vehicle, monitor responses of the remote-controlled vehicle to each exploit, and adapt the exploit signal.

15. The apparatus recited in claim 9, wherein the instructions to detect if radio signals are being communicated are executable by at least one processor residing on each of a plurality of network edge devices, and the instructions to synthesize the exploit signal are executable by a plurality of processors in a central-processing configuration or a Cloud-computing configuration.

16. The apparatus recited in claim 9, wherein the instructions to detect if radio signals are being communicated are executable by at least one processor residing on each of a plurality of airborne platforms.

17. A method, comprising:

determining if radio signals are being communicated between a remote control unit and a remote-controlled vehicle;

synthesizing an exploit signal to be transmitted to the remote-controlled vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle'"'"'s navigation system; and

upon determining the remote-controlled vehicle is operating in an autopilot mode, transmitting an induce-mode signal to the remote-controlled vehicle to induce the remote-controlled vehicle to switch to a communication mode to cause the remote-controlled vehicle to be responsive to the exploit signal.

18. The method recited in claim 17, further comprising determining if the remote-controlled vehicle is a threat based on remote-sensing data.

19. The method recited in claim 17, further comprising:

detecting a response from the remote-controlled vehicle, the response comprising at least one of a radio transmission from the remote-controlled vehicle and a change in the remote-controlled vehicle'"'"'s navigation; and

adapting the exploit signal based on the response.

20. The method recited in claim 17, further comprising:

responsive to sensor data, classifying the remote-controlled vehicle by at least one of manufacturer, model number, and operating system; and

responsive to classification of the remote-controlled vehicle, selecting at least one of the exploit signal and the induce-mode signal.

21. The method recited in claim 17, further comprising employing information about the remote-controlled vehicle obtained from sensor data to generate at least one of the exploit signal and the induce-mode signal.

22. The method recited in claim 17, wherein machine learning is employed for at least one of synthesizing the exploit signal and adapting the induce-mode signal.

23. The method recited in claim 17, further comprising detecting the radio signals by a plurality of network edge devices, and wherein synthesizing the exploit signal is performed by a plurality of processors in a central-processing configuration or a Cloud-computing configuration.

24. The method recited in claim 17, further comprising detecting the radio signals by at least one processor residing on each of a plurality of airborne platforms.