Aerospace and Electronic Systems - September 2018 - 15

Fouda

Figure 12.

ECP threat assessment process with CIA+M.

the utilisation of position in threat modelling if and where it
is beneficial to do so.
Each threat is given a severity, magnitude, and position in the
manner described previously, depending on its possible impact on
the UAS mission and possible attack entry nodes for the threat.
Using equation (3), the author has assigned the threat severity impacting the overall UAS mission with reference to possible attack
nodes in flight and on the ground. Figure 13a illustrates the three
chosen threats, while UAS is grounded preflight and during flight.
It is apparent that the largest threat from the small pool of chosen
threats to model on the UAS in ground mode is packet sniffing.
Packet sniffing in this scenario could facilitate the interception of
the UAS mission. Jamming and communication injection are less
likely to occur with lesser attack nodes around secure bases, and
the harm to the UAS would be less on ground after countering.
This is, however, an assumption for this scenario, as some bases
are prone to UAS cyberphysical attacks, depending on location of
UAS base. As the UAS progresses in its mission, it will eventually
be in flight mode, which could potentially be a conflict zone. Figure 13b illustrates the heightened security threat to a UAS in a zone
of possible EW attacks, where jammers and communication injections are expected or sensed by the UAS monitors. As expected, in
jamming and communication injection scenarios, the severity level
would reach 10 (the highest severity for our theoretical model).
These steps would be repeated in a real-time manner for all realtime states of the UAS to have a more immediate and informed
decision-making process and automated countermeasures in all
environments, tailored to each UAS architecture.
This modelling method would allow UAS governing bodies
and security experts to monitor the threat level in every state of
the UAS with location in real-time via the outlined vulnerability
analysis, modelling technique, and proposed mission integrity
metric to better assess security of UAS architectures. This short
case study also highlights the importance of such modelling techniques to determine software requirements for future UAS architecture design and implementation in response to threats when they
reach threshold levels, without the intervention of humans. Such
automated security countermeasures would heighten security and
ensure smart automation of cyberphysical protection of the aircraft
vehicle for a more safe and secure UAS and airspace for all.
SEPTEMBER 2018

Figure 13.

Example UAS threat modelling in (a) ground mode and (b) flight mode.

CONCLUSION
This security vulnerability assessment of cyberphysical systems
in unmanned aircrafts has shown that there was a need to define
threats on UAS in the cyber, electromagnetic, and physical space
with their interrelations and nature, as has been defined in this
article, as an ECP abstraction of UAS threats. The assessment
has also shown that in all classifications of UAS, including SDR
based, there exists vulnerabilities to all ECP attacks that can lead
to the complete hijacking of UAS, making it critical to introduce
UAS-specific security metrics related to the mission, as in the proposed CIA+M metric. All ECP attack threats identified were able
to attack UAS as stand-alone attack vectors or in concert for more
sophisticated larger-scale attacks, if countermeasures are not in
place. It is also apparent that the aviation industry should have
ECP security regulations that incorporate policies around securing the end-to-end UAS architecture, and not just system specific,
without performing a complete holistic ECP security assessment,
incorporating interdependent safety and operational end-to-end
scenarios and CIA+M. Decision making for ECP security-related
threats cannot be established soundly by using only network and
system-specific monitoring and analysis tools. There needs to be
an overall attack surface model, such as the novel model proposed
in this article, to incorporate attack vector analysis on the entire
architecture at a given point in time for any mission and identify
high-risk areas within the system in an early design phase. Vulnerabilities in UAS that could result in complete control of UAS by
adversaries is a real threat to UAS, potentially leading to the same
catastrophic impacts of the September 11 attack, and should be
taken seriously with rigorous UAS ECP security assessments. The
real-time UAS threat analysis theoretical case study presented in
this article has shown that the proposed mission integrity metric
allows for dynamic prioritization of threat monitoring tasks on the
basis of the phase of the mission that the UAS is in. Noting that
with different missions or mission phases, the UAS can be more
prone to different types of attack vectors.

IEEE A&E SYSTEMS MAGAZINE

Aerospace and Electronic Systems - September 2018

Table of Contents for the Digital Edition of Aerospace and Electronic Systems - September 2018