PiNcH：一种通过网络流量分析进行无人机检测的有效、高效和鲁棒的解决方案
PiNcH: an Effective, Efficient, and Robust Solution to Drone Detection via Network Traffic Analysis
摘要：
我们提出了PiNcH，一种方法来检测无人机的存在，其当前状态，以及它的运动，通过利用无人机和它的遥控器（RC）之间交换的通信流量。PiNcH是将标准分类算法应用于窃听流量，分析数据包到达间隔时间和大小等特征而构建的。PiNcH是完全被动的，它只需要廉价的通用硬件。为了评估我们的解决方案的有效性，我们收集了一架运行广泛的ArduCopter开源固件的无人机的真实通信痕迹，该固件目前安装在各种（30+）商业业余无人机上。我们针对不同的公开无线痕迹测试了我们的解决方案。结果证明，PiNcH可以高效且有效地：（i）在几种异构场景中识别无人机的存在;（ii）识别通电无人机的当前状态，即，飞行或躺在地面上;（iii）辨别无人机的运动;以及最后，（iv）享受在所请求的保证水平下识别无人机所需的时间的减小的上限。PiNcH的有效性也进行了评估，在存在严重的数据包丢失和逃避攻击。在后一种情况下，对手故意修改无人机-RC链路的业务的简档以避免检测。在上述两个案例中，国家人权党继续享有卓越的业绩。此外，与现有技术解决方案的比较证实了PiNcH在几种情况下的优异性能。请注意，所有无人机控制器生成的数据跟踪都已作为开源发布，以允许复制和促进后续行动。最后，我们的解决方案的质量和可行性，证明网络流量分析可以成功地用于无人机识别和状态判别。
英文摘要：
We propose PiNcH, a methodology to detect the presence of a drone, its current status, and its movements by leveraging just the communication traffic exchanged between the drone and its Remote Controller (RC). PiNcH is built applying standard classification algorithms to the eavesdropped traffic, analyzing features such as packets inter-arrival time and size. PiNcH is fully passive and it requires just cheap and general-purpose hardware. To evaluate the effectiveness of our solution, we collected real communication traces originated by a drone running the widespread ArduCopter open-source firmware, currently mounted on-board of a wide range (30+) of commercial amateur drones. We tested our solution against different publicly available wireless traces. The results prove that PiNcH can efficiently and effectively: (i) identify the presence of the drone in several heterogeneous scenarios; (ii) identify the current state of a powered-on drone, i.e., flying or lying on the ground; (iii) discriminate the movements of the drone; and, finally, (iv) enjoy a reduced upper bound on the time required to identify a drone with the requested level of assurance. The effectiveness of PiNcH has been also evaluated in the presence of both heavy packet loss and evasion attacks. In this latter case, the adversary modifies on purpose the profile of the traffic of the drone-RC link to avoid the detection. In both the cited cases, PiNcH continues enjoying a remarkable performance. Further, the comparison against state of the art solution confirms the superior performance of PiNcH in several scenarios. Note that all the drone-controller generated data traces have been released as open-source, to allow replicability and foster follow-up. Finally, the quality and viability of our solution, do prove that network traffic analysis can be successfully adopted for drone identification and status discrimination.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
