Aerospace and Electronic Systems - September 2018 - 13

Fouda

Figure 10.

Weighted attack surface model for seven UAS attack vulnerabilities on a given architecture.

two-dimensional function was chosen as a representation of attack
vectors on a given UAS architecture for a weighted attack surface
model, as displayed in Figure 10.
n

Weighted Attack Surface ( x, y ) =  f ( x, y )i ,

(1)

i =0

where x, y are the distances to origin in the horizontal and vertical
axis of the plot surface, respectively, and where the Gaussian function f(x,y)i for each vector i is
  ( x − x )2 ( y − y )2
i
i
f ( x, y )i = f (VS )i exp  − 
+
2
  2σ x2i
2
σ
yi
 


,



(2)

where the total number of Gaussian n represents the total number
of attack vectors n = Σ attack vectors Σ in UAS. σ xi ,σ yi is the standard deviation width of each vector, representing the magnitude
of vulnerabilities, and the function f(Vs)i represents the amplitude
component of the Gaussian for each attack vector i in the model,
to illustrate the overall weighing severity of the attack vector i. For
this model, a weighing severity from the set  = 3,5,7,10 was used
for the time when a UAS is beyond line of sight, time = BLOS,
2

10

7
f (VS )i = 
5
3

Attack vectori
Attack vectori
Attack vectori
Attack vectori

Impact = unacceptable
Impact = high risk
.
Impact = medium risk
Impact = low risk

(3)

The weighted attack surface model displayed in Figure 10 can incorporate attack vectors coming from all ECP threats; however,
due to the complex nature of cyberattack vectors and their rooted
paths in complex CP architectures, the attack surface model seems
to be more ideal for cyberattack vectors and therefore was used as
an illustration in this article.
SEPTEMBER 2018

Security metrics currently used for all systems are concerned
with three main attributes of security: confidentiality, integrity, and
availability (CIA). CIA is commonly used as a key metric of InfoSec. For UAS, however, it is not sufficient to measure security
of the overall threats from ECP attacks based only on data-driven
security measures. UAS are unique in the sense that they have mission-critical requirements, and anything from cyberspace, electromagnetic space, or physical space that tampers with this mission,
should be of highest priority to the UAS industry. Therefore, the
author proposes CIA+M metrics for UAS security metrics, where
mission (M) is an integrity metric of the UAS mission. Every threat
in ECP should be assessed against CIA+M, with prioritization of
all threats mapping to M as most critical to resolve.
Figure 11 illustrates all UAS vulnerabilities from ECP attacks
and how they interrelate in the impact on the physical systems
CIA, data CIA, and the new proposed metric, mission (M) integrity, following the process in Figure 12. The mapping of all ECP
attacks and vulnerabilities shows their complementing features to
one another and proves that overall UAS security should be looked
at holistically, not just atomistically, to secure UAS.

CASE STUDY: REAL-TIME UAS THREAT ANALYSIS
Real-time UAS threat analysis can be a challenging task in both
conflict and friendly zones. We present a short theoretical case
study to illustrate the utilisation and advantage of the proposed
modelling method and mission integrity metric in a theoretical
UAS mission scenario. A typical UAS mission would see the unmanned aircraft in two main states: flight and ground mode. To
demonstrate how the novel UAS threat modelling method can be
utilised in observing and monitoring real-time UAS threats during
these two simplified states, we first identify the vulnerabilities and
threats to the UAS architecture. The author has picked three threats
from the UAS architectures in Figure 5 to simplify the demonstration of the modelling method. The three chosen threats to be mod-

IEEE A&E SYSTEMS MAGAZINE

Aerospace and Electronic Systems - September 2018

Table of Contents for the Digital Edition of Aerospace and Electronic Systems - September 2018