We propose PiNcH, a methodology to detect the presence of a drone and its current status leveraging just the communication traffic exchanged between the drone and its Remote Controller (RC). PiNcH is built applying standard classification algorithms to the eavesdropped traffic, analyzing features such as packets inter-arrival time and size. PiNcH does not require either any special hardware or to transmit any signal. Indeed, it is fully passive and it resorts to cheap and general purpose hardware. To evaluate the effectiveness of our solution, we collected real communication measurements from the 3DR SOLO drone, being the most popular open-source hardware, running the widespread ArduCopter open-source firmware, mounted on-board on a wide range of commercial amateur drones. Then, we test our solution against different publicly available wireless traces. The results prove that PiNcH can efficiently and effectively: (i) identify the presence of the drone in several heterogeneous scenarios; (ii) identify the current state of a powered-on drone, i.e., flying or lying on the ground; (iii) discriminate the movement of the drone; and, finally, (iv) estimate a lower bound on the time required to identify a drone with the requested level of assurance. The quality and viability of our solution do prove that network traffic analysis can be successfully adopted for drone identification and pave the way for future research in the area.
A fingerprinting approach for drone identification is proposed in @cite_37 . Authors analyzed the WiFi communication protocol used by drones and developed three unique methods to identify a specific drone model: (i) examining the time intervals between probe request frames; (ii) utilizing the signal strength carried in the frame header; and, finally (iii) exploiting some frame header fields with specific values. However, fingerprint approaches require specific equipment to be used, such as the Software Defined Radios (SDRs).
@cite_37
1981870545 2813832714 2889328478 2148633529
We propose a new fingerprinting technique that differentiates between unique devices over a Wireless Local Area Network (WLAN) simply through the timing analysis of 802.11 probe request frames. Our technique can be applied to spoof detection, network reconnaissance, and implementation of access control against masquerading attacks. Experimental results indicate that our technique is consistent and accurate in differentiating between unique devices. In contrast with existing wireless fingerprinting techniques, our technique is passive, non-invasive and does not require the co-operation of fingerprintee hosts. Swarms of Unmanned Aerial Vehicles (drones) could provide great benefit when used for disaster response and indoor search and rescue scenarios. In these harsh environments where GPS availability cannot be ensured, prior work often relies on cameras for control and localization. This creates the challenge of identifying each drone, i.e., finding the association between each physical ID (such as their radio address) and their visual ID (such as an object tracker output). To address this problem, prior work relies on visual cues such as LEDs or colored markers to provide unique information for identification. However, these methods often increase deployment difficulty, are sensitive to environmental changes, not robust to distance and might require hardware changes. In this paper, we present IDrone, a robust physical drone identification system through motion matching and actuation feedback. The intuition is to (1) identify each drone by matching the motion detected through their inertial sensors and from an external camera, and (2) control the drones so they move in unique patterns that allow for fast identification, while minimizing the risk of collision involved in controlling drones with uncertain identification. To validate our approach, we conduct both simulation and real experimentation with autonomous drones for the simplified case of a stationary Spotter (powerful drone equipped with the camera). Overall, our initial results show that our approach offers a great tradeoff between fast identification and small collision probability. In particular, IDrone achieves faster identification time than safety-based baseline actuation (one-at-a-time), and significantly higher survival rate compared to fast, non-safety-based baseline actuation (random motion). To better address the growing threats of small commercial Unmanned Aerial Systems (UASs), we developed novel methods to identify specific types of drone models by building their wireless communication profiles with machine learning algorithms. In this paper, we present a basic framework for identifying unique features and discuss basic methods for several drone models. The results based on our proposed methods demonstrate their effectiveness. We continue to collect experimental results involving several popular drones and investigate more features to enhance the accuracy of our methods. We also outline our future work involving additional drone models and further methods used to improve identification accuracy. The broadcast nature of the wireless medium poses a serious challenge to the security of wireless communications and networks. Traditional computational security strategies always fail to prevent the eavesdropper from overhearing the communications. Recently, the unique characteristics of wireless channel fingerprints, e.g. randomness and reciprocity, have been successfully used to enhance the security of the wireless network. We expand our previous work on exploring particular physical parameters of fingerprints, and focus on a new scheme in which we use the RAKE receiver to differentiate users under low transmission power. RAKE receiver may capture and estimate fingerprints through poor autocorrelation of the spreading coding. As the fingerprint is incomputable and unpredictable, and may only be detected by the pair of transmitter and receiver, it may be fully utilized to design an efficient authentication method. Simulation results strongly verify the efficiency of our proposed method, especially in the case of low SNR.