DronLomaly: Runtime detection of anomalous drone behaviors via log analysis and deep learning

• Main Authors: SHAR, Lwin Khin, MINN, Wei, TA, Nguyen Binh Duong, FAN, Jianli, JIANG, Lingxiao, LIM, Daniel Wai Kiat
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2022
• Subjects: Drone security; Anomaly detection; Log analysis; Deep learning; Numerical Analysis and Scientific Computing; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/7545; https://ink.library.smu.edu.sg/context/sis_research/article/8548/viewcontent/Drone_Log_Anomaly_Detection_camera_ready.pdf
• Institution: Singapore Management University

Drones are increasingly popular and getting used in a variety of missions such as area surveillance, pipeline inspection, cinematography, etc. While the drone is conducting a mission, anomalies such as sensor fault, actuator fault, configuration errors, bugs in controller program, remote cyber- attack, etc., may affect the drone’s physical stability and cause serious safety violations such as crashing into the public. During a flight mission, drones typically log flight status and state units such as GPS coordinates, actuator outputs, accelerator readings, gyroscopic readings, etc. These log data may reflect the above-mentioned anomalies. In this paper, we propose a novel, deep learning-based log analysis approach for detecting anomalies in the drone log that could lead to physical instabilities. We train a LSTM-based deep learning model on the normal flight logs produced by a baseline drone. Essentially, the model learns the sequential patterns of flight state units and correlations among them. The model can then be used to detect anomalies in the state units as the log entries are being recorded by the drone’s control program at runtime. In our experiments, we built detection models based on several logs produced by 3 different drone control programs, namely DJI, ArduPilot and PX4, and used them to detect anomalies in the logs. On average, our approach achieves 0.968 recall and 0.963 precision, and it can detect anomalies during runtime within a few milliseconds.