# Detection of Stealthy Adversaries for Networked Unmanned Aerial Vehicles

Mohammad Bahrami and Hamidreza Jafarnejadsani Mohammad Bahrami and Hamidreza
Jafarnejadsani are with the Department of Mechanical Engineering, Stevens
Institute of Technology, Hoboken, NJ 07030, USA,
<EMAIL_ADDRESS>
###### Abstract

A network of unmanned aerial vehicles (UAVs) provides distributed coverage,
reconfigurability, and maneuverability in performing complex cooperative
tasks. However, it relies on wireless communications that can be susceptible
to cyber adversaries and intrusions, disrupting the entire network’s
operation. This paper develops model-based centralized and decentralized
observer techniques for detecting a class of stealthy intrusions, namely zero-
dynamics and covert attacks, on networked UAVs in formation control settings.
The centralized observer that runs in a control center leverages switching in
the UAVs’ communication topology for attack detection, and the decentralized
observers, implemented onboard each UAV in the network, use the model of
networked UAVs and locally available measurements. Experimental results are
provided to show the effectiveness of the proposed detection schemes in
different case studies.

This paper has been accepted for publication in the proceedings of 2022
International Conference on Unmanned Aircraft Systems (ICUAS)

## Supplementary Material

Video: https://youtu.be/lVT_muezKLU

Code: https://github.com/SASLabStevens/TelloSwarm

##  I Introduction

Teams of autonomous robots, particularly Unmanned Aerial Vehicles (UAVs), are
of interest as their cooperation allows for distributed coverage,
reconfigurability, and mobility in a wide range of applications such as search
and rescue missions, surveillance, wildfire monitoring, and delivery.
Networked UAVs rely on information exchange over a wireless communication
network to coordinate and cooperate. However, numerous studies have shown the
vulnerabilities of wireless networks to spoofing attacks, malicious
intrusions, and Denial of Service (DoS), which raises security concerns in
safety- and time-critical applications. This paper addresses the problem of
detecting a class of _stealthy_ attacks on the control system of networked
UAVs in a setting where UAVs cooperate to achieve a particular formation, and
their communication network is subject to topology switching.

Figure 1:  The experimental setup for multi-UAV formation control using a
motion capture system for positioning.

###  I-A Related work

_Multi-UAV cooperation._ Cooperation and coordination of a network of robots
(UAVs) in the forms of swarming and formation control have been extensively
studied [1, 2]. Formation control has been adopted in performing collaborative
tasks such as coverage control for sensor networks [3], forest firefighting
[4], and sensor planning for precision agriculture [5]. A team of UAVs can
achieve formation by exchanging their spatial local information (e.g. position
and velocity states) and in different settings such as leader-follower,
leaderless consensus-based, and virtual structure approaches [2]. This paper
focuses on consensus-based formation control of a team of UAVs coordinating
their relative positions over a switching communication network.

_Adversary and cyber-attack detection for UAVs._ The susceptibility of
networked UAVs to cyber adversaries and attacks has been reported in [6, 7].
There are also different defense mechanisms against attacks and adversaries.
Intrusion Detection Systems (IDS) that operate often based on the statistical
characteristics of transmitted data can significantly limit possible attacks,
thereby improving the network security [8]. However, IDS’ invariance to the
system’s dynamics renders them incapable of detecting stealthy attacks devised
based on networked UAVs’ dynamical characteristics. Examples of such attacks
are zero-dynamics attack [9], covert attack [10], and replay attack [11].
Challenges of IDS and also model-based monitoring frameworks in detecting
stealthy attacks on a single UAV have been studied in [12, 13]. Redundancy in
hardware and software has been adopted to detect and mitigate a class of
attacks on a single UAV [14]. Secure planning against stealthy (GPS spoofing)
attack has been studied using control theoretic [15] and reinforcement
learning [16] approaches. Only a few studies have considered the detection
problem of stealthy attacks on networked UAVs, which are encryption and
encoding for detection of false data injection (FDI) attacks [17], information
fusion for GPS spoofing detection [18], distributed observers for cyberattack
detection and isolation [19], and finally learning-based methods to detect
stealthy FDI attacks targeting a single UAV in cooperative localization [20]
and to detect anomalies in swarming drones [21]. However, none of these
studies have considered the detection problem of stealthy attacks, namely
zero-dynamics attack (ZDA) and covert attack, on coordination of networked
UAVs.

_Statement of contributions._ We study the detection of _stealthy_ attacks on
a team of UAVs coordinating their relative positions, over a wireless network
with switching communication links, to achieve formation. Stealthy attacks are
designed based on the high-level coordination model (communication topology)
of the UAVs to maximize the attack’s effect on the cooperation performance as
well as the attack’s stealthiness in monitored signals.

The main contributions of this paper are as follows: We develop centralized
and decentralized attack detection strategies against _stealthy_ attacks,
namely zero-dynamics attack (ZDA) and covert attack, that adversely affect the
coordination objective of networked UAVs while remaining stealthy in the
monitoring signals. We investigate switching communication links in terms of
their role in attack detection and system reconfigurability. We demonstrate an
experimental implementation of the stealthy attacks on a team of small UAVs
and evaluate the effectiveness of our proposed methods in the timely detection
of stealthy attacks.

##  II Problem Formulation

###  II-A Notations

We use $\mathbb{R}$, $\mathbb{R}_{>0}$, $\mathbb{R}_{\geq 0}$, $\mathbb{N}$,
and $\mathbb{Z}_{\geq 0}$ to denote the set of reals, positive reals, non-
negative reals, natural numbers, and non-negative integers, respectively.
$\boldsymbol{1}_{n}$, $\boldsymbol{0}_{n}$, ${I}_{n}$ and
$\boldsymbol{0}_{n\times m}$ stand for the $n$-vector of all ones, the
$n$-vector of all zeros, the identity $n$-by-$n$ matrix, and the $n$-by-$m$
zero matrix, respectively111We may omit the subscripts when clear from the
context.. In addition, we use $\mathfrak{e}_{i}$ to denote the $i$-th
canonical vector in n. We use $\mathrm{col}(\cdot)$ and $\mathrm{diag}(\cdot)$
to denote the column and diagonal concatenation of vectors or matrices, and
$\otimes$ to denote the Kronecker product. Finally, for any set $\mathcal{F}$,
$|\mathcal{F}|$ denotes its cardinality.

###  II-B Quadrotor’s dynamics

We consider a team of $N$ homogeneous unmanned aerial vehicles (quadrotor
UAVs) that cooperate to achieve a geometric shape/formation in 2. Attached to
the center of mass of each quadrotor, the body frame
$\\{\boldsymbol{\mathcal{B}}^{i}\\}$ with unit axes $\\{\mathaccent
382{\mathfrak{b}}^{i}_{1},\mathaccent 382{\mathfrak{b}}^{i}_{2},\mathaccent
382{\mathfrak{b}}^{i}_{3}\\},\ i\in\\{1,\dots,N\\}=:\mathcal{V}$, whose
position and orientation with respect to the inertial global frame
$\\{\boldsymbol{\mathcal{I}}\\}$ with unit vectors $\left\\{\mathaccent
382{\mathfrak{e}}_{x},\mathaccent 382{\mathfrak{e}}_{y},\mathaccent
382{\mathfrak{e}}_{z}\right\\}$ (see Figure 2a) are, respectively, determined
by a vector
${p}_{i}=\mathrm{col}\left({p}^{x}_{\vphantom{{\bar{i}}}i},{p}^{\smash{y}}_{\vphantom{{\bar{i}}}i},{p}^{z}_{\vphantom{{\bar{i}}}i}\right)\in\\{\boldsymbol{\mathcal{I}}\\},\
\forall\,i\in\mathcal{V}$ and a rotation matrix
$R_{i}(\psi_{i},\phi_{i},\theta_{i})\in{\rm{SO}}(3)$ in the special orthogonal
group with $\psi_{i}$, $\phi_{i}$, and $\theta_{i}$ being the respective
$z\\!-\\!x\\!-\\!y$ Euler angles. Then, the rigid body motion of the
quadrotors follows [22]

$\displaystyle\dot{p}_{i}$ $\displaystyle={v}_{i},\ \ $ $\displaystyle
m\dot{v}_{i}$ $\displaystyle=-mg\mathaccent
382{{\mathfrak{e}}}_{z}+R_{i}{f_{i}},$ (1a) $\displaystyle\dot{R}_{i}$
$\displaystyle=R_{i}\Omega^{\times}_{i},\ \ $ $\displaystyle
J\dot{\Omega}_{i}$ $\displaystyle=-\Omega_{i}\times
J\Omega_{i}+\boldsymbol{\tau}_{i},$ (1b)

where ${p}_{i}\in{}^{3}$ and
$R_{i}(\psi_{i},\phi_{i},\theta_{i})\in{\rm{SO}}(3)$ are the position and
orientation of the $i$-th quadrotor in the inertial frame
$\\{\boldsymbol{\mathcal{I}}\\}$, $m$ is the mass of the quadrotor, $g$ is the
gravitational acceleration, and finally
$f_{i}\in\\{\boldsymbol{\mathcal{B}}^{i}\\}$ is the total thrust. Also, in the
rotational dynamics, $\Omega_{i}\in{}^{3}$ is the angular velocity,
$J\in{}^{3\times 3}$ is the inertia matrix, and
$\boldsymbol{\tau}_{i}\in{}^{3}$ is the total torque, all expressed in
respective body-fixed frames. Finally, the notation $\Omega^{\times}_{i}$
denotes the skew-symmetric matrix, such that
$\Omega^{\times}_{i}r=\Omega_{i}\times r$ for any vector $r\in{}^{3}$ and the
cross product $\times$.

Figure 2:  (a) Illustration of reference frames. (b) The coordination control
architecture.

###  II-C Formation control

The cooperative control of quadrotor UAVs, shown in Figure 2b, follows a
hierarchical structure, where at the high level, the UAVs coordinate with each
other and their formation/position controller cooperatively generates the
desired attitude/orientation and the desired total thrust for a low-level
attitude controller. In this paper, we focus on 2D formation in the
$x\\!-\\!y$ plane, for which cooperative control protocols will be designed
based on a linearized model of the UAVs’ transnational dynamics in (1a) around
a hovering state and under small-angle approximations as follows [22]:

$\displaystyle\ddot{p}^{x}_{\vphantom{{\bar{i}}}i}$
$\displaystyle=g(\Delta\theta_{i}\cos(\psi_{i})+\Delta\phi_{i}\sin(\psi_{i})),$
(2a) $\displaystyle\ddot{p}^{y}_{\vphantom{{\bar{i}}}i}$
$\displaystyle=g(\Delta\theta_{i}\sin(\psi_{i})-\Delta\phi_{i}\cos(\psi_{i}),$
(2b) $\displaystyle\ddot{p}^{z}_{\vphantom{{\bar{i}}}i}$
$\displaystyle=-g+{f_{i}}/{m},$ (2c)

in which $\Delta\theta_{i}$ and $\Delta\phi_{i}$ denote, respectively, the
deviation of pitch and roll angles of the $i$-th quadrotor from their
equilibrium point $\theta_{i}=\phi_{i}=0$. Associated with each UAV, we define
an intermediary frame $\\{\boldsymbol{\mathcal{I}^{\prime}}\\}$ with unit axes
$\left\\{\mathaccent 382{\mathfrak{e}}_{x}\vphantom{.}\\!^{\prime},\mathaccent
382{\mathfrak{e}}_{y}\vphantom{.}\\!^{\prime},\mathaccent
382{\mathfrak{e}}_{z}\vphantom{.}\\!^{\prime}\right\\}$ and orientation
$R_{z}(\psi_{i})$ such that $p_{i}=R_{z}(\psi_{i})p^{\prime}_{i}$ for vectors
$p_{i}\in\\{\boldsymbol{\mathcal{I}}\\}$ and
$p^{\prime}_{i}\in\\{\boldsymbol{\mathcal{I}^{\prime}}\\}$ (see Figure 2a).
Assuming all UAVs have consensus on a desired yaw angle $\psi_{i}=\psi^{*},\
\forall\,i\in\mathcal{V}$, $\\{\boldsymbol{\mathcal{I}^{\prime}}\\}$ will be
the common reference frame of the UAVs in which the linearized equation of
motion in (2) can be represented by

$\displaystyle\ddot{p}^{x^{\prime}}_{\vphantom{{\bar{i}}}i}$
$\displaystyle=+g\Delta\theta_{i},$ (3a)
$\displaystyle\ddot{p}^{y^{\prime}}_{\vphantom{{\bar{i}}}i}$
$\displaystyle=-g\Delta\phi_{i},$ (3b)
$\displaystyle\ddot{p}^{z^{\prime}}_{\vphantom{{\bar{i}}}i}$
$\displaystyle=-g+{f_{i}}/{m},$ (3c)

that shows the decoupled dynamics in the
$x^{\prime}_{i},y^{\prime}_{i},z^{\prime}_{i}$ directions222We will omit the
superscript ′ in the rest of paper for notational simplicity.. We let the
reference commands for pitch and roll angles in (3a)-(3b) be

$\displaystyle\theta_{i}^{\rm cmd}$ $\displaystyle=+u_{i}^{x}/g,\ \
\phi_{i}^{\rm cmd}=-u_{i}^{y}/g,$ (4)

where $u_{i}^{x}$ and $u_{i}^{y}$ are the formation control inputs to be
designed, respectively, in the $x$ and $y$ directions. It is also necessary to
mention that $\theta_{i}^{\rm cmd}$ and $\phi_{i}^{\rm cmd}$ in (4) will be
desired setpoints for each UAV’s low-level (on-board) attitude controller, and
that we use independent PID controllers to stabilize the altitude of
quadrotors ($z_{i}$-dynamics in (2c)) around a desired hovering point.
Therefore, the altitude dynamics in (2c) and the rotational dynamics in (1b)
are dropped from the high-level state space of networked UAVs and the reduced-
order planar dynamics is obtained by substituting (4) for $\Delta\theta_{i}$
and $\Delta\phi_{i}$ in (3a) and (3b) as follows:

$\displaystyle\Sigma_{i}:\left\\{\begin{array}[]{l}\dot{\boldsymbol{p}}_{i}(t)=\boldsymbol{v}_{i}(t)\\\
\dot{\boldsymbol{v}}_{i}(t)=\boldsymbol{u}_{i}(t)\end{array},\right.\ \
i\in\mathcal{V}=\\{1,\dots,N\\},$ (7)

in which
$\boldsymbol{p}_{i}(t)\coloneqq\mathrm{col}({p}^{x}_{\vphantom{{\bar{i}}}i},{p}^{\smash{y}}_{\vphantom{{\bar{i}}}i})\in{}^{2},$
and
$\boldsymbol{v}_{i}(t)\coloneqq\mathrm{col}(\dot{p}^{x}_{\vphantom{{\bar{i}}}i},\dot{p}^{x}_{\vphantom{{\bar{i}}}i})\in{}^{2}$
are the stacked positions and velocities in the $x$ and $y$ directions, and
$\boldsymbol{u}_{i}(t)\coloneqq\mathrm{col}(u_{i}^{x},u_{i}^{y})\in{}^{2}$
denotes their corresponding control input for each UAV.

_Desired formation reference._ We define a desired configuration (formation
shape) by specifying a set of $N$ desired setpoints
$\boldsymbol{p}^{\boldsymbol{*}}_{1},\boldsymbol{p}^{\boldsymbol{*}}_{2},\dots,\boldsymbol{p}^{\boldsymbol{*}}_{\scriptscriptstyle
N}$ in 2 that form the desired relative positions333In the context of
formation control, these reference states are called _formation states_ [23]
or _shape vectors_ [24] depending on the design methods and their underlying
assumptions.
$\\{\boldsymbol{p}^{\boldsymbol{*}}_{ij}=\boldsymbol{p}^{\boldsymbol{*}}_{i}-\boldsymbol{p}^{\boldsymbol{*}}_{j}\in{}^{2}\mid\forall\,i,j\in\mathcal{V},\
i\neq j\\}$, all expressed in the UAVs’ common frame. The formation references
are transmitted to the UAVs from a ground control center. We follow the
consensus-based formation settings [23] where the UAVs coordinate their
relative positions to reach the desired relative positions
$\boldsymbol{p}^{\boldsymbol{*}}_{ij}$’s, which is formulated as

$\displaystyle\lim\limits_{t\rightarrow{\infty}}\left|\boldsymbol{p}_{i}(t)-\boldsymbol{p}_{j}(t)-\boldsymbol{p}^{\boldsymbol{*}}_{ij}\right|$
$\displaystyle=\boldsymbol{0},$ $\displaystyle\forall\;i,j\in\mathcal{V},$
(8a)
$\displaystyle\lim\limits_{t\rightarrow{\infty}}\left|\boldsymbol{v}_{i}(t)\right|$
$\displaystyle=\boldsymbol{0},$ $\displaystyle\forall\;i\in\mathcal{V}.$ (8b)

_Inter-UAV communication._ We model the switching inter-UAV communication by
an undirected graph
$\mathcal{G}_{\sigma(t)}=(\mathcal{V},\mathcal{E}_{\sigma(t)})$, where the
vertex set $\mathcal{V}=\\{1,\dots,N\\}$ represents the index set of $N$ UAVs
in (1) (with their respective reduced models in (7)), and the edge set
$\mathcal{E}_{\sigma(t)}\subseteq\mathcal{V}\times\mathcal{V}$ represents the
communication links such that an edge $(i,j)\in\mathcal{E}_{\sigma(t)}$
implies information exchange between the $i$-th and $j$-th UAV in a given
active mode determined by the right-continuous switching signal
$\sigma(t):\mathbb{R}_{\geq
0}\rightarrow{\mathcal{Q}:=\\{1,2,\dots,q\\}},\,q\in\mathbb{N},$ at time $t$,
with $\mathcal{Q}$ being the finite index set of possible communication
graphs. The UAVs’ interaction is further encoded into a symmetric adjacency
matrix
$\mathsf{A}_{\sigma(t)}\coloneqq[a^{\sigma(t)}_{ij}]\in\mathbb{R}^{N\times
N}_{\geq 0}$ such that $a^{\sigma(t)}_{ij}=a^{\sigma(t)}_{ji}=1$ if an edge
$(i,j)\in\mathcal{E}_{\sigma(t)}$, and
$a^{\sigma(t)}_{ij}=a^{\sigma(t)}_{ji}=0$, otherwise. Also, the set of the
neighbors of the $i$-th node (UAV) in any active mode $\sigma(t)$ is defined
as
$\mathcal{N}_{\sigma(t)}^{i}=\\{j\in\mathcal{V}\mid(i,j)\in\mathcal{E}_{\sigma(t)}\\}$.

Throughout this paper, we assume the inter-UAV’s communication graphs
$\mathcal{G}_{\sigma(t)}$’s are connected in all modes.

To meet the formation constraints in (8), we use the following consensus-based
distributed control protocol:

$\displaystyle\boldsymbol{u}_{i}$
$\displaystyle=\boldsymbol{u}_{{\rm{n}}_{i}}+{\boldsymbol{u}}_{{\rm
a}_{i}},\quad i\in\mathcal{V},$ (9)
$\displaystyle\boldsymbol{u}_{{\rm{n}}_{i}}$
$\displaystyle=-\alpha\sum_{j\in\mathcal{N}^{i}_{\sigma(t)}}a^{\sigma(t)}_{ij}(\boldsymbol{p}_{i}-\boldsymbol{p}_{j}-\boldsymbol{p}^{\boldsymbol{*}}_{ij})-\gamma\boldsymbol{v}_{i}\vspace*{-1ex}$
(10)

where $\boldsymbol{u}_{{\rm{n}}_{i}}\in{}^{2}$ denotes the nominal control
input with $a^{\sigma(t)}_{ij}$ being the entry of the symmetric adjacency
matrix associated with the UAVs’ switching communication graph
$\mathcal{G}_{\sigma(t)}$. Also, $\alpha\in\mathbb{R}_{>0}$ and
$\gamma\in\mathbb{R}_{>0}$ are the control gains. $\boldsymbol{u}_{{\rm
a}_{i}}\in{}^{2}$ is the vector-valued malicious signal injected in the
control channel of the $i$-th UAV.

We let an unknown subset
$\mathcal{A}=\\{i_{1},i_{2},\dots\\}\subset\mathcal{V}$ denote the set of UAVs
subject to attack ${\boldsymbol{u}}_{{\rm a}_{i}}\neq\boldsymbol{0}$, which we
refer to as compromised UAVs, and we refer to the rest of UAVs
$\Sigma_{i}\text{'s with}\;{\boldsymbol{u}}_{{\rm
a}_{i}}=\boldsymbol{0},\;\forall\,i\in\mathcal{V}\setminus{\mathcal{A}}$, in
(7) as uncompromised UAVs.

_Network-level dynamics._ Given (7), (9) and (10), the dynamics of the
networked UAVs can be represented by

$\displaystyle\Sigma:\dot{\mathbf{x}}=\mathbf{A}_{\sigma(t)}\mathbf{x}+\mathbf{B}^{\boldsymbol{F}}_{\sigma(t)}\mathbf{x}^{\boldsymbol{*}}+\mathbf{B}_{\\!\mathcal{A}}\mathbf{u}_{\rm
a},\ \ \mathbf{x}(t_{0})=\mathbf{x}_{0},$ (11)

in which, the system states and matrices are given by

$\displaystyle\mathbf{x}(t)$
$\displaystyle=\mathrm{col}\left(\boldsymbol{p}_{1},\dots,\boldsymbol{p}_{\scriptscriptstyle
N},\boldsymbol{v}_{1},\dots,\boldsymbol{v}_{\scriptscriptstyle
N}\right)\in{}^{4N},$ (12a) $\displaystyle{\mathbf{x}^{\boldsymbol{*}}}$
$\displaystyle=\mathrm{col}\left(\boldsymbol{p}^{\boldsymbol{*}}_{1},\dots,\boldsymbol{p}^{\boldsymbol{*}}_{\scriptscriptstyle
N},\boldsymbol{0}_{2},\dots,\boldsymbol{0}_{2}\right)\in{}^{4N},$ (12b)
$\displaystyle\mathbf{A}_{\sigma(t)}$
$\displaystyle=A_{\sigma(t)}\\!\otimes\\!I_{2},\,\mathbf{B}^{\boldsymbol{F}}_{\sigma(t)}\\!=\\!-\mathbf{A}_{\sigma(t)},\,\mathbf{B}_{\\!\mathcal{A}}\\!=\\!B_{\\!\mathcal{A}}\\!\otimes\\!I_{2},$
(12c) $\displaystyle A_{\sigma(t)}$ $\displaystyle=\begin{bmatrix}0_{N\times
N}&I_{N}\\\ -\alpha\mathsf{L}_{\sigma(t)}&-\gamma
I_{N}\end{bmatrix},\;B_{\\!\mathcal{A}}=\begin{bmatrix}0\\\ {\rm
B}_{\\!\mathcal{A}}\end{bmatrix},$ (12d) $\displaystyle{\rm
B}_{\\!\mathcal{A}}$
$\displaystyle=\big{[}\mathfrak{e}_{i_{1}}\;\mathfrak{e}_{i_{2}}\;\dots\;\mathfrak{e}_{i_{\scriptscriptstyle|\mathcal{A}|}}\big{]},\
\ \mathbf{u}_{\rm a}=\mathrm{col}\left({\boldsymbol{u}}_{{\rm
a}_{i}}\right)_{i\in\mathcal{A}},$ (12e)

where $\mathsf{L}_{\sigma(t)}$ is the Laplacian matrix of graph
$\mathcal{G}_{\sigma(t)}$, encoding the inter-UAVs’ communication links,
defined as $\mathsf{L}_{\sigma(t)}\coloneqq[l^{\sigma(t)}_{ij}]\in{}^{N\times
N}$ with $l^{\sigma(t)}_{ii}=\sum_{j\neq i}a^{\sigma(t)}_{ij}$ and
$l^{\sigma(t)}_{ij}=-a^{\sigma(t)}_{ij}$ if $i\neq j$. $\mathfrak{e}_{i}$ is
the $i$-th vector of the canonical basis in N corresponding to the $i$-th UAV
compromised by attack ${\boldsymbol{u}}_{{\rm a}_{i}},\ i\in\mathcal{A}$.

_Network-level measurements._ We define the system measurements $\mathbf{y}$
to be composed of the position of a set of UAVs $\mathcal{M}_{\rm p}=\\{{\rm
p}_{1},{\rm p}_{2},\dots\\}\subset\mathcal{V}$ and/or the velocity of a set of
UAVs $\mathcal{M}_{\rm v}=\\{{\rm v}_{1},{\rm
v}_{2},\dots\\}\subset\mathcal{V}$ that are transmitted to a ground control
center for monitoring. More precisely,

$\displaystyle\mathbf{y}$
$\displaystyle={\mathbf{C}}{\mathbf{x}}-\mathbf{u}_{\rm s},\ \
\mathbf{C}=C\otimes I_{2},\ \ \mathcal{M}=\\{\mathcal{M}_{\rm
p},\mathcal{M}_{\rm v}\\},$ (13a) $\displaystyle{C}$
$\displaystyle=\mathrm{diag}\left(C_{\rm p},C_{\rm v}\right),$ (13b)
$\displaystyle{C}_{\rm p}$
$\displaystyle=\mathrm{col}\big{(}\mathfrak{e}^{\scriptscriptstyle\top}_{{\rm
p}_{1}},\mathfrak{e}^{\scriptscriptstyle\top}_{{\rm
p}_{2}},\dots,\mathfrak{e}^{\scriptscriptstyle\top}_{{\rm
p}_{\scriptscriptstyle{|\mathcal{M}_{\rm
p}|}}}\big{)}\in{}^{\scriptscriptstyle|\mathcal{M}_{\rm p}|\times N},$ (13c)
$\displaystyle{C}_{\rm v}$
$\displaystyle=\mathrm{col}\big{(}\mathfrak{e}^{\scriptscriptstyle\top}_{{\rm
v}_{1}},\mathfrak{e}^{\scriptscriptstyle\top}_{{\rm
v}_{2}},\dots,\mathfrak{e}^{\scriptscriptstyle\top}_{{\rm
v}_{\scriptscriptstyle{|\mathcal{M}_{\rm
v}|}}}\big{)}\in{}^{\scriptscriptstyle|\mathcal{M}_{\rm v}|\times N},$ (13d)

where $\mathbf{u}_{\rm s}=\mathrm{col}\big{(}\mathbf{u}_{{\rm
s}_{1}},\mathbf{u}_{{\rm s}_{2}},\dots,\mathbf{u}_{{\rm
s}_{\scriptscriptstyle|\mathcal{M}|}}\big{)}\\!\in\\!{}^{\scriptscriptstyle
2|\mathcal{M}|}$ denotes the vector-valued sensory attacks on the
measurements.

######  Proposition II.1.

(Formation convergence). Assume that the formation configuration is feasible
and that the communication graph is connected in each mode. Then, under the
control protocol (9), and in the absence of attacks, the states of the UAVs in
(7) converge to the desired formation configuration in (8).

###### Proof.

The proof follows a change of variables as in [25] and a convergence analysis
similar to that in [9]. The details are omitted here due to space limitation.
∎

Note that the UAV’s dynamics in (7) as well as the control protocol (10) for
the $x$ and $y$ directions are decoupled. Thus, for notational simplicity, we
may use the following

$\displaystyle\Sigma:\dot{\rm{x}}$ $\displaystyle={A}_{\sigma(t)}{\rm
x}+{B}^{\boldsymbol{F}}_{\sigma(t)}{\rm
x}^{\boldsymbol{*}}+{B}_{\\!\mathcal{A}}{\rm u}_{\rm a},\ \
{\rm{x}}(t_{0})={\rm{x}}_{0},$ (14a) $\displaystyle{\rm y}$
$\displaystyle={{C}}{\rm{x}}-{\rm u}_{\rm s},$ (14b)

to represent the dynamics in (11) with its monitored states in (13b) in only
one direction of the $x\\!-\\!y$ plane. Accordingly,
${\rm{x}}=\mathrm{col}\left({\rm{p}},{\rm{v}}\right)\in{}^{2N}$ in (14)
denotes the stacked vector of all positions
${\rm{p}}=\mathrm{col}\left({\rm{p}}_{i}\right)_{i\in\mathcal{V}}$ and
velocities ${\rm{v}}=\mathrm{col}\left({\rm{v}}_{i}\right)_{i\in\mathcal{V}}$
in one direction with their corresponding formation references ${\rm
x}^{\boldsymbol{*}}\in{}^{2N}$ as well as attack inputs ${\rm u}_{\rm
a}\in{}^{\scriptscriptstyle|\mathcal{A}|}$ and ${\rm u}_{\rm
s}\in{}^{\scriptscriptstyle|\mathcal{M}|}$, and other system matrices are
given in (12d)-(12e) and (13b) with
${B}^{\boldsymbol{F}}_{\sigma(t)}=-{A}_{\sigma(t)}$.

###  II-D Attack stealthiness

Motivated by the susceptibility of wireless networks to adversarial intrusions
[6, 7], we study the worst-case scenario adversarial settings where an
attacker leverages _a priori_ system knowledge of the UAVs’ coordination or a
prerecorded sequence of sensory data to design sophisticated stealthy attacks
implementable through actuator attacks ${\boldsymbol{u}}_{{\rm
a}_{i}}\\!(t)\text{'s},\ i\in\mathcal{A}$ in (9) and sensor attacks
$\mathbf{u}_{\rm s}(t)$ in (13a).

Here, _a priori_ system knowledge refers to the initial configuration of the
networked system (11) with the measurements (13) (or equivalently (14)),
denoted by the tuple
$\hat{\Sigma}(\hat{\mathbf{A}}_{\sigma(t)},\hat{\mathbf{C}},\sigma(t)=1)$ with
$\hat{\mathbf{A}}_{\sigma(t)}$ and $\hat{\mathbf{C}}$ being the approximations
of their counterparts in (11) and (13). The amount of _a priori_ system
knowledge needed for designing _stealthy_ attacks varies for different attacks
[26], and will be quantified in Section III-A.

_Stealthy_ attacks refer to a class of adversarial intrusions (cyber attacks
[10, 11, 27]) ${\boldsymbol{u}}_{{\rm a}_{i}}\text{'s},\ i\in\mathcal{A}$ in
(9) and $\mathbf{u}_{\rm s}$ in (13a) that disrupt the system’s normal
operation while remain stealthy in the monitored measurements (13), that is

$\mathbf{y}(\mathbf{x}_{0},\mathbf{u}_{\rm a},\mathbf{u}_{\rm
s},t)=\mathbf{y}^{\rm n}({\mathbf{x}}^{\rm
n}_{0},\mathbf{0},\mathbf{0},t),\quad\forall\,t\in[t_{0},t_{d}),$ (15)

where $\mathbf{y}^{\rm n}({\mathbf{x}}^{\rm
n}_{0},\mathbf{0},\mathbf{0},t)=\mathbf{C}\mathbf{x}^{\rm n}$ is the output
associated with an attack-free system with the same dynamics as in (14a), and
$\mathbf{x}_{0}$ and ${\mathbf{x}}^{\rm n}_{0}$ are the actual and a possible
initial states, respectively. Also, $t_{0}$ is the initial time instant and
$t_{d}$ is the attack detection time instant, i.e., the time instant at which
condition in (15) no longer holds and attacks lose their stealthiness.

###  II-E Problem statement: attack detection

We consider the attack detection problem as a hypothesis testing problem with
the null and alternative hypotheses

$\displaystyle\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}:{\rm
attack}\text{-}{\rm free},\ \text{vs.}\ \
\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{1}$}}:{\rm attacked},$
(16)

for which we present detection frameworks in Section III-B.

##  III Observer Design and Analysis for Attack Detection

In this section, we characterize the models for stealthy attacks on the
networked UAVs in (11) and develop centralized and decentralized detection
schemes.

###  III-A Realization of stealthy attacks

Given system in (11), let $\mathcal{M}$ in (13a) be a set of monitored states
and let $\mathcal{A}$ be a set of compromised UAVs subject to attack
${\boldsymbol{u}}_{{\rm a}_{i}}\neq\boldsymbol{0}$ in (9). In what follows, we
characterize stealthy attacks in terms of different realizations of (15).

_Zero-dynamics attack (ZDA)._ ZDA refers to the class of attacks based on the
zero dynamics of the system
$({A}_{\sigma(t)},{B}_{\\!\mathcal{A}},{C},\sigma(t)=1)$ in (14) that are
(nontrivial) state trajectories excited through input directions
$B_{\\!\mathcal{A}}$ and invisible at the output ${\rm{y}}$, and that can be
characterized by the rank deficiency of matrix pencil

$P(\lambda_{o})=\begin{bmatrix}\lambda_{o}I_{N}-{A}_{1}&-{B}_{\\!\mathcal{A}}\\\
{C}&\boldsymbol{0}\end{bmatrix},$ (17)

for some $\lambda_{o}\in\mathbb{R}_{>0}$ [9].

######  Proposition III.1.

Assume the system in (11) in its initial active mode $\sigma(t)=1$ has
unstable zero dynamics, i.e., the matrix pencil $P(\lambda_{o})$ in (17) is
rank deficient for some $\lambda^{x}_{o},\
\lambda^{y}_{o},\in\mathbb{R}_{>0}$, and that the attacker’s a priori
knowledge of the system
$\hat{\Sigma}(\hat{\mathbf{A}}_{\sigma(t)},\hat{\mathbf{C}},\sigma(t)=1)=({\mathbf{A}}_{\sigma(t)},{\mathbf{C}},\sigma(t)=1)$.
Then, there exists a stealthy attack policy

$\displaystyle\mathbf{u}_{\rm
a}\\!=\\!\mathrm{col}\left({\boldsymbol{u}}_{{\rm
a}_{i}}\right)_{i\in\mathcal{A}},\ {\boldsymbol{u}}_{{\rm a}_{i}}\\!=\\![{\rm
u}^{x}_{{\rm a}_{i}}(0)e^{\lambda^{x}_{o}t}\ \ {\rm u}^{y}_{{\rm
a}_{i}}(0)e^{\lambda^{y}_{o}t}\ ]^{\top}\\!,$ (18)

in dynamics (11) that causes part of system states exponentially deviate from
the formation configuration in (8) while the condition in (15) holds. In this
attack model, the measurement signals are not compromised, i.e.,
$\mathbf{u}_{\rm s}=\boldsymbol{0}$.

###### Proof.

The proof follows from [27, Prop. II.4] and so is omitted here. ∎

It is noteworthy that the assumption on _a priori_ system knowledge in
Proposition III.1 can be relaxed. In the cases that only a subset of the
system model as _a priori_ is disclosed to the attacker, that is
$\hat{\Sigma}(\hat{\mathbf{A}}_{\sigma(t)},\hat{\mathbf{C}},\sigma(t)=1)\approx({\mathbf{A}}_{\sigma(t)},{\mathbf{C}},\sigma(t)=1)$,
a ZDA can be realized that only affects the UAVs within the known subset of
the system, which is known as local ZDA [26].

_Covert attack_ [10]. Covert attacks are a class of intrusions through input
channels ${\mathbf{B}_{\\!\mathcal{A}}}$ whose covertness at the output is
obtained by alteration of the measurement signals (13a) and whose realization
requires perfect knowledge of the system i.e.
$\hat{\Sigma}(\hat{\mathbf{A}}_{\sigma(t)},\hat{\mathbf{C}},\sigma(t)=1)=({\mathbf{A}}_{\sigma(t)},{\mathbf{C}},\sigma(t)=1)$.
Let attack policy $\mathbf{u}_{\rm
a}(t)=\mathrm{col}\left({\boldsymbol{u}}_{{\rm
a}_{i}}\right)_{i\in\mathcal{A}}:\mathbb{R}_{\geq 0}\mapsto{}^{2}$ in (11) be
any continuous signal initiated at time instant $t_{\rm a}\in\mathbb{R}_{\geq
0}$. Then, the attack is covert and (15) holds if the attacker alters the
measurement (13a) by

$\displaystyle\mathbf{u}_{\rm s}(t)={\mathbf{C}}{\int^{t}_{t_{\rm
a}}e^{{\mathbf{A}}_{1}(t-{\tau})}\mathbf{B}_{\\!\mathcal{A}}\mathbf{u}_{\rm
a}({\tau})d{{\tau}}}.$ (19)

We refer to [27] for details of the derivation and proof.

_Cooperative DoS and replay attack._ It is shown that a denial-of-service
(DoS), interfering in a UAVs’ communication, causes unstable and unsafe
flights [28]. We formulate a scenario where replay attacks444A replay attack
is the case that the attacker replays (periodically) a sequence of stored data
as real-time measurements to conceal any deviation from a normal operation.
[11] are implemented in cooperation with a DoS in order to keep the DoS
stealthy in the networked-level measurements (13a). Here, the cooperatively-
stealthy DoS and replay attack take place when the UAVs have reached the
formation configuration in (8) and thus are hovering only, giving the attacker
the opportunity to record and store slow-varying measurements (13a) for a time
interval $T_{r}\in\mathbb{R}_{>0}$ before starting the attacks
$\mathbf{u}_{\rm a}$ and $\mathbf{u}_{\rm s}$ respectively in (11) and (13a)
that is $\mathbf{u}_{\rm a}(t)=\boldsymbol{0}$ and $\mathbf{u}_{\rm
s}(t)=\boldsymbol{0},\;\forall\,t\in[t_{0}\;t_{\rm a})$ where $t_{\rm
a}>T_{r}$. Then, upon starting a DoS at a time instant $t_{\rm
a}\in\mathbb{R}_{>0}$, causing one or more UAVs lose their inter-communication
and deviating from the equilibrium states (8), a concurrent replay attack
$\mathbf{u}_{\rm s}$ in $\eqref{eq:measurments_a}$ given by

$\displaystyle\mathbf{u}_{\rm
s}(t)=\mathbf{C}\mathbf{x}(t)-\mathbf{y}(t-nT_{r}),\ n\in\mathbb{N},\ \ t\geq
t_{\rm a},$ (20)

causes the stealthiness condition in (15) holds.

We note that _a priori_ system knowledge is not required for the cooperative
DoS and replay attack that is
$\hat{\Sigma}(\hat{\mathbf{A}}_{\sigma(t)},\hat{\mathbf{C}},\sigma(t))=\emptyset$.

###  III-B Observer-based detection framework

The susceptibility of observers/monitors to the sophisticated attacks
satisfying the stealthiness condition in (15) has been demonstrated in both
deterministic and stochastic settings in [9, 10, 11]. Motivated by this
challenge, we present centralized and decentralized detection schemes to
address the attack detection problem formulated as in (16).

####  III-B1 Centralized detection scheme

In the centralized detection scheme, we leverage switching links in the inter-
UAVs’ communication topology to generate model discrepancy rendering the
stealthy attacks detectable in the measurements (13) monitored in a ground
control center. Note that the UAVs’ communication may be subject to switching
connections in two senses. First, a communication link failure induced due to
operation in uncertain environments, and second, a planned switch (addition or
removal of connections) triggered for security and performance reasons.
Regardless of the underlying causes of switching links in the inter-UAVs’
communication, we investigate their effect on the detection of stealthy
attacks.

Consider the dynamical system in (14), a centralized attack detection monitor
(central monitor), derived based on the initial (normal) communication mode of
UAVs ($\sigma(t)=1$), is given by

$\displaystyle\dot{\hat{{\rm{x}}}}$ $\displaystyle={A}_{\sigma(t)}\hat{\rm
x}+{{B}}^{\boldsymbol{F}}_{\sigma(t)}{\rm
x}^{\boldsymbol{*}}+{{H}}({\rm{y}}-\hat{\rm y}),$ $\displaystyle\sigma(t)=1,$
$\displaystyle\hat{\rm{y}}$ $\displaystyle={C}\hat{\rm x},$
$\displaystyle\hat{\rm{x}}(0)=\boldsymbol{0},$ (21)
$\displaystyle{\rm{r}}_{0}$ $\displaystyle={\rm{y}}-\hat{\rm{y}},$ central
residual,

where $H$ is an observer gain such that $(A_{\sigma(t)}-HC)$ is stable in all
modes and $\lim_{t\rightarrow\infty}{\rm{r}}_{0}=\boldsymbol{0}$ in the
absence of attacks [27]. Also, we let ${\rm
r}_{0}^{j}(t)={C}^{j}({\rm{x}}-\hat{\rm{x}})$ denote the $j$-th component of
the residual ${\rm{r}}_{0}$ with ${C}^{j}$ being the $j$-th row vector of
matrix ${C}$ in (13b). Then, in the absence of attacks, an upper bound on the
residuals is obtained as follows:

$\displaystyle|{\rm{r}}_{0}^{j}(t)|\leq{\bar{k}_{j}}e^{-\bar{\lambda}_{j}t}\bar{\omega}+\epsilon_{0}=:\epsilon^{j}_{0},$
(22)

where ${\bar{k}_{j}}$ and $\bar{\lambda}_{j}$ are positive constants such that
$|{C}^{j}e^{({A}_{1}-{H}{C})t}|\\!\leq\\!{\bar{k}_{j}}e^{-\bar{\lambda}_{j}t}$,
$\bar{\omega}$ is an upper bound such that
$|\rm{e}(0)|\\!=\\!|\rm{x}(0)-\hat{\rm{x}}(0)|\\!=\\!|\rm{x}(0)|\leq\bar{\omega}$,
and $\epsilon_{0}\\!\in\\!\mathbb{R}_{>0}$ is a sufficiently small constant to
account for measurement noises.

Given the central monitor (III-B1) and its corresponding thresholds in (22),
the hypothesis testing problem in (16) can be quantified either by

$\displaystyle\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}$
$\displaystyle:{\rm attack}\text{-}{\rm free},$ if
$\displaystyle|{\rm{r}}_{0}^{j}(t)|$ $\displaystyle\leq\epsilon^{j}_{0},\ \
\forall\,j\in\mathcal{M},$ (23a)
$\displaystyle\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{1}$}}$
$\displaystyle:{\rm attacked},$ if $\displaystyle|{\rm{r}}_{0}^{j}(t)|$
$\displaystyle>\epsilon^{j}_{0},\ \ \exists\,j\in\mathcal{M},$ (23b)

or by

$\displaystyle{\rm{r}}_{0}^{\top}\boldsymbol{\Sigma}^{-1}_{{\rm{r}}_{\scriptscriptstyle
0}}{\rm{r}}_{0}\overset{\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}}{\underset{\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{1}$}}}{\lesseqgtr}}\texttt{threshold},\vspace{-1ex}$
(24)

with $\boldsymbol{\Sigma}_{{\rm{r}}_{\scriptscriptstyle 0}}$ being the
covariance of the residual ${\rm{r}}_{0}$ having a zero-mean Gaussian
distribution in stochastic settings where a discretized version of (III-B1) as
a Kalman filter is used, together with $\chi^{2}$ (chi-squared) tests, for
attack detection [11].

As shown in [11, 27], $\chi^{2}$ detectors, Kalman filters, and Luenberger-
type observers/monitors fail in detecting the stealthy attacks that were
presented in Section III-A provided the stealthiness condition (15) holds,
causing a false validation of the null hypothesis (23a). Here, based on the
results in [27, Th. III.3], we evaluate the effect of switching connections in
inter-UAVs’ communication on the violation of (15) and thus on the validation
of the null hypothesis (23a). This procedure will be presented in Algorithm 2
in Section IV.

####  III-B2 Decentralized detection scheme

In the decentralized detection scheme, a set of UAVs, equipped with on-board
(local) monitors, leverage the information exchange with their neighbouring
UAVs to locally detect the stealthy attacks on their neighbours. Upon attack
detection, a local monitor triggers an inter-UAV communication switch and
informs other local monitors as part of a contingency plan (see Algorithm 2).

Note that in the networked UAVs with a connected communication graph
$\mathcal{G}_{\sigma(t)}$, any UAV has access to the states of itself as well
as the position states of the set of its immediate neighbors
$\mathcal{N}^{i}_{\sigma(t)}$ (cf. control protocol (10)). Accordingly, we
define, for the $i$-th UAV in the network, a set of local measurements,
indexed by set $\mathcal{M}^{i}$, as follows:

$\displaystyle\mathcal{M}^{i}$
$\displaystyle=\mathcal{N}^{i}_{\sigma(t)}\cup\\{i\\},$
$\displaystyle\sigma(t)$ $\displaystyle=1\in\mathcal{Q},$ (25a)
$\displaystyle{\mathbf{y}}_{i}$ $\displaystyle=\mathbf{C}_{i}{\mathbf{x}},\
\,\text{and}\ \,{\rm{y}}_{i}={C}_{i}{\rm x},$ $\displaystyle\mathbf{C}_{i}$
$\displaystyle=C_{i}\otimes I_{2},$ (25b) $\displaystyle C_{i}$
$\displaystyle=\mathrm{diag}\left({\rm C}_{{\rm
p},i},\mathfrak{e}_{i}^{\scriptscriptstyle\top}\right),$ $\displaystyle{\rm
C}_{{\rm p},i}$
$\displaystyle=\mathrm{col}\big{(}\mathfrak{e}^{\scriptscriptstyle\top}_{j}\big{)}_{j\in\mathcal{M}^{i}}.$
(25c)

where $\mathbf{x}$ and ${\rm x}$ are the system states in (11) and (14),
respectively. Different from the networked measurements in (13), the local
measurements in (25) are not transmitted through compromised network channels
to the control center for monitoring. Instead, they are locally available for
each UAV, and thus are not subject to alterations by sensory attacks.

Given the local measurements (25) and dynamics (14), we define the local
attack detector $\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}$ for the $i$-th
UAV as follows:

$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}\\!:\\!\left\\{\begin{array}[]{ll}\dot{\hat{{\rm{x}}}}_{i}={A}_{\sigma(t)}\hat{\rm
x}_{i}+{{B}}^{\boldsymbol{F}}_{\sigma(t)}{\rm
x}^{\boldsymbol{*}}+{{H}}^{i}({\rm{y}}_{i}-\hat{\rm
y}_{i}),&\sigma(t)\in\mathcal{Q},\\\ \hat{\rm{y}}_{i}={C}_{i}\hat{\rm
x},&\hat{\rm{x}}(0)=\boldsymbol{0},\\\
\,{\rm{r}}_{i}={\rm{y}}_{i}-\hat{\rm{y}}_{i},&\text{local
residual},\end{array}\right.$ (26)

where $\hat{\rm x}_{i}$ is the local estimation of ${\rm x}$ in (14), and
$H^{i}$ is an observer gain such that $(A_{\sigma(t)}-H^{i}C_{i})$ is stable
in all modes. Therefore, in the absence of attacks,
$\lim_{t\rightarrow\infty}{\rm{r}}_{i}=\boldsymbol{0}$, and similar to the
central monitor’s, the $j$-th component of local residuals,
${\rm{r}}^{j}_{i}$’s, hold an upper bound (threshold) as follows:

$\displaystyle|{\rm{r}}_{i}^{j}(t)|\leq{\bar{k}_{i,j}}e^{-\bar{\lambda}_{i,j}t}\bar{\omega}+\epsilon_{i}=:\epsilon^{j}_{i},$
(27)

where ${\bar{k}_{i,j}}$ and $\bar{\lambda}_{i,j}$ are positive constants such
that
$|{C}^{j}_{i}e^{({A}_{1}-{H}^{i}{C^{j}_{i}})t}|\leq{\bar{k}_{i,j}}e^{-\bar{\lambda}_{i,j}t}$,
$\bar{\omega}$ is an upper bound such that
$|{\rm{e}}_{i}(0)|=|\rm{x}(0)-\hat{{\rm
x}}_{i}(0)|=|\rm{x}(0)|\leq\bar{\omega}$, and $\epsilon_{i}\in\mathbb{R}_{>0}$
is a sufficiently small constant to account for measurement noises.

Now, the hypothesis testing problem in (16) can be revisited and quantified
using local residuals as follows:

$\displaystyle\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}$
$\displaystyle\\!:\\!{\rm attack}\text{-}{\rm free},\;$ if
$\displaystyle|{\rm{r}}_{i}^{j}(t)|\leq\epsilon^{j}_{i},\;\forall\,j\in\mathcal{M}^{i},\,\forall\,i\in\mathcal{D},$
(28a) $\displaystyle\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{1}$}}$
$\displaystyle\\!:\\!{\rm attacked},$ if
$\displaystyle|{\rm{r}}_{i}^{j}(t)|>\epsilon^{j}_{i},\;\exists\,j\in\mathcal{M}^{i},\,\exists\,i\in\mathcal{D},$
(28b)

where $\mathcal{D}$ is the set of all the UAVs equipped with a local detector
as in (26).

Note that a successful attack detection using the hypothesis testing (28) does
depend on the sensitivity of the local residuals, ${\rm r}_{i}$’s, to the
stealthy attacks. In this regard, the following results characterize the
capability of local detectors in detecting stealthy attacks.

######  Proposition III.2.

Consider dynamics (14) and let the $i$-th UAV be equipped with the local
attack detector $\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}$ in (26) and
local measurements (25). Then, stealthy ZDA and covert attacks are detectable
in $\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}$’s residual ${\rm r}_{i}$ if
the set of compromised UAVs satisfies
$\mathcal{A}\subseteq\mathcal{N}_{\sigma(t)}^{i},\ \sigma(t)=1\in\mathcal{Q}$.

###### Proof.

Omitted due to space limitation. ∎

Note that the $i$-th UAV’s local monitor,
$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}},\ i\in\mathcal{D}$ secures the
networked UAVs against the stealthy attacks on its neighbors’ set
${\mathcal{N}}^{i}_{\sigma(t)}$. Therefore, the problem of interest is to
determine a set $\mathcal{D}\subseteq\mathcal{V}$ of local detectors
$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}\text{'s},\,i\in\mathcal{D}$ such
that they cover the entire set $\mathcal{V}$ of UAVs.

######  Proposition III.3.

Consider the networked UAVs with the dynamics in (14) subject to stealthy
attacks on a set of compromised UAVs $\mathcal{A}\subseteq\mathcal{V}$ and let
the set

$\displaystyle\mathcal{D}\coloneqq\\{i\in\mathcal{V}\mid\bigcup_{i\in\mathcal{D}}{\mathcal{N}}^{i}_{\sigma(t)}=\mathcal{V},\
\sigma(t)=1\in\mathcal{Q}\\},$ (29)

represent the set of UAVs equipped with local attack detectors
$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}$’s in (26). Then, stealthy ZDA
and covert attacks undetectable in
$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}$’s residual ${\rm r}_{i},\
\forall\,i\in\mathcal{D}$, is impossible, securing the entire network set
$\mathcal{V}$ of UAVs against stealthy attacks.

###### Proof.

Omitted due to space limitation. ∎

(a) Formation References (b) V-shape Formation

(c) mode 1 (d) mode 2 (e) mode 3 (f) mode 4

Figure 3:  Multi-UAV’s formation and communication topology. (a) Formation
references specifying a V-shape in the $x\\!-\\!y$ plane. (b) V-shape
formation of UAVs. (c)-(f) Inter-UAV’s communication graph
$\mathcal{G}_{\sigma(t)}$ with four modes
$\sigma(t)=\\{1,2,3,4\\}=:\mathcal{Q}$. UAVs initially communicate in mode
$\sigma(t)=1$ and may switch to other modes $\sigma(t)=\\{2,3,4\\}$ if
activated by a local detector. Blue nodes indicate the UAVs equipped with a
local monitor and orange nodes specify the UAVs monitored by the ground
control center. Algorithm 1 Attack detection by the $i$-th local monitor,
$i\in\mathcal{D}$

1:$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}},\ i\in\mathcal{D}$ in (26) and
(29), $\mathbf{y}_{i}$ in (25), $\epsilon^{j}_{i}$ in (27)

2:procedure local hypothesis testing (28)

3: while $\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}$ in (28a)
do

4: Compute local residual ${\rm r}_{i}$ as in (26)

5: Compute corresponding thresholds $\epsilon^{j}_{i}$ as in (27)

6: if $|{\rm r}^{j}_{i}|>\epsilon^{j}_{i}$ then

7: Reject the null hypothesis
$\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}$ in (28a)
$\triangleright$ Stealthy

attack is locally detected.

8: cooperate with other local detectors in $\mathcal{D}$ to

run a contingency plan for the entire network.

9: end if

10: end while

11:end procedure

Algorithm 2 Topology switching for centralized attack detection

1:local observer: $\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}},\
i\in\mathcal{D}$ in (26) and (29), $\mathbf{y}_{i}$ in (25),
$\epsilon^{j}_{i}$ in (27); centralized observer:
$\Sigma_{\scriptscriptstyle\mathcal{O}}^{\scriptscriptstyle\mathcal{M}}$ in
(III-B1), $\mathbf{y}$ in (13), $\epsilon^{j}_{0}$ in (22)

2:procedure Central hypothesis testing (23)

3: Run Algorithm 1

4: if $\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{1}$}}$ in (28b)
then

5: Switch to a new comm. mode $\sigma(t)\in\mathcal{Q}\setminus{1}$
$\triangleright$ Stealthy

attack has been detected locally.

6: end if

7: while $\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}$ in (23a)
do

8: Compute central residual ${\rm r}_{0}$ as in (III-B1)

9: Compute corresponding thresholds $\epsilon^{j}_{0}$ as in (22)

10: if $|{\rm r}^{j}_{0}|>\epsilon^{j}_{0}$ then

11: Reject the null hypothesis
$\mathcal{H}^{\raisebox{0.0pt}{\scriptsize$\mathfrak{0}$}}$ in (23b)
$\triangleright$ Stealthy

attack is detected globally at the control center.

12: end if

13: end while

14:end procedure

(a) UAVs’ position in the $x\\!-\\!y$ plane. (b) Coordination of UAVs in the
$y$ direction.

Figure 4: Experiment 1: ZDA on UAVs $1,4,5$ and topology switching from mode
$1$ to $4$. (a) UAVs’ position in the $x\\!-\\!y$ plane with the colorbars
quantifying the time span. The $\times$ markers and the colored circles show,
respectively, the UAVs’ initial position and final position during the
experiment. Finally, the gray lines visualize the V-shape formation achieved
by the final position of the UAVs. (b) The relative positions of UAVs in the
$y$ direction corresponding to the inter-UAV communication links in mode
$\sigma(t)=1$, shown in Figure 3c. Also, the dashed lines, labeled by ${\rm
p}^{*}_{ij},\ i,j\in\mathcal{V}$, denote the desired relative positions based
on the formation references in Figure 3a.

It is worth mentioning that a trivial solution for (29) is
$\mathcal{D}=\mathcal{V}$ that is all of the UAVs are equipped with a local
detector, although this set can be optimally selected.

(a) Residuals of local monitor $\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$
run on UAV $1$. The stealthy ZDA is locally detected at $t=3.22\
$\mathrm{s}\mathrm{e}\mathrm{c}$$.

(b) Residuals of local monitor $\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$
run on UAV $3$.

(c) Residuals of central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ run
on the control center.

Figure 5: Experiment 1: ZDA on UAVs $1,4,5$ and topology switching from mode
$1$ to $4$, which is triggered by local monitor
$\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ at $t=3.22\
$\mathrm{s}\mathrm{e}\mathrm{c}$$. (a)-(b) The notation ${\rm r}^{i}_{1},\
i\in\\{1,3,4,5\\}$ (${\rm r}^{i}_{3},\ i\in\\{1,2,3,5\\}$), denotes the
residual of position estimation for the UAV $1$’s ($3$’s) neighbors obtained
by its local monitor $\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$
($\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$) in the $x$ and $y$ directions
with the respective thresholds $\epsilon^{x}_{1}$ ($\epsilon^{x}_{3}$) and
$\epsilon^{y}_{1}$ ($\epsilon^{y}_{3}$) as given in (27). (c) The notation
${\rm r}^{i}_{0},\ i\in\\{3,5\\}$, denotes the residual of position estimation
for UAVs $3$ and $5$ by the central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ in
the $x$ and $y$ directions with the threshold $\epsilon_{0}$ as given in (22).

Given Propositions III.2 and III.3, one can verify that the networked UAVs can
be secured against stealthy attacks using a set of local monitors, given by
(26), that locally detect stealthy attacks, addressing problem (28). A
procedure for this local hypothesis testing will be presented in Algorithm 1
in Section IV.

##  IV Experimental Results

We conducted a set of experiments that serve two purposes. First, the
evaluation of the stealthiness of intrusions/deception attacks, described in
Section III-A, on the wireless communication network of a team of quadrotor
UAVs in real-time practical settings. Second, the performance evaluation of
the detection schemes presented in Section III-B.

###  IV-A Experimental Setup

Our experimental setup consists of a team of five homogeneous quadrotors
(Tello Drones555https://www.ryzerobotics.com/tello.), shown in Figure 1,
flying in a $6\ $\mathrm{m}$\times 4\ $\mathrm{m}$\times 3\ $\mathrm{m}$$
flight area that is equipped with a VICON666https://www.vicon.com. motion
capture system with 10 cameras. The VICON system provides the ground truth
position and orientation of each UAV at $50\ $\mathrm{H}\mathrm{z}$$ for a
central PC running Ubuntu 20.04 with ROS Noetic.

In our experiments, we use the VICON system’s ground truth data available in
the central PC to compute the high-level formation control commands that are
sent to each UAV at $50\ $\mathrm{H}\mathrm{z}$$ and to run the central and
local monitors, presented in Section III-B. The central PC transmits the high-
level formation control commands to the UAVs through different Wi-Fi channels
and the UAVs’ on-board attitude controllers use the received control commands
to stabilize and steer the UAVs to their desired pose (see Figure 2b). This
connection setup allows us to replicate the peer-to-peer communication of the
UAVs and also to implement stealthily intrusions on the Wi-Fi channels in a
controlled setting.

###  IV-B Results

We performed several experiments that serve as a proof of concept of the real-
world applicability of the proposed attack detection methods in multi-UAV
cooperation settings. In these tests, the UAVs are tasked with achieving a
V-shape formation. The spacial configuration of the V-shape formation and a
picture of its real-world implementation are shown in Figures 3a and 3b,
respectively.

In our experiments, the UAVs, indexed by $\mathcal{V}=\\{1,2,3,4,5\\}$,
coordinate using the control protocol (10), initially in communication mode
$\sigma(t)=1$, shown in Figure 3c, to achieve the V-shape formation. The UAVs
also have consensus on their yaw angle $\psi_{i}=\psi^{*}=0,\
\forall\,i\in\mathcal{V}$ as well as their hovering altitude. We select the
position of UAVs $3$ and $5$ as the network-level monitored states at the
ground control center that is $\mathcal{M}_{\rm p}=\\{3,5\\}$ and
$\mathcal{M}_{\rm v}=\emptyset$ in (13). These measurements are used in the
realization of the central monitor (attack detector
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$) in
(III-B1) and its residuals in (22). We also let $\mathcal{D}=\\{1,3\\}$ in
(29), that is UAVs $1$ and $3$, which have the respective set of neighbors
$\mathcal{N}^{1}_{\sigma(t)=1}=\\{3,4,5\\}$ and
$\mathcal{N}^{3}_{\sigma(t)=1}=\\{1,2,5\\}$, and the local measurements
$\mathbf{y}_{i}(\text{or}\,{\rm y}_{i}),\ i\in\mathcal{D}$ in (25), are
selected as the host UAVs for local monitors (attack detectors
$\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}$’s) in (26). Accordingly, the
condition (29) holds which in turn guarantees the local monitors of UAVs $1$
and $3$ are sufficient to locally detect the stealthy attacks on the entire
network of UAVs in a decentralized manner. Also, as described earlier in
Sections II-C, the UAVs follow a decoupled dynamics in the $x$ and $y$
directions, and therefore we implement central and local monitors
independently for the $x$\- and $y$-direction dynamics based on the
discretized models of (14), (III-B1), and (26) with the sampling time $T_{\rm
s}=0.02\ $\mathrm{s}\mathrm{e}\mathrm{c}$$.

In the following, we present the results of attack detection through the
centralized detection scheme with central (global) hypothesis testing (23) and
the central monitor (III-B1) as well as through the decentralized detection
scheme with local hypothesis testing (28) and the local monitors of UAVs $1$
and $3$. The procedure of the local hypothesis testing is presented in
Algorithm 1 and that of the central hypothesis testing is presented in
Algorithm 2.

(a) UAVs’ position in the $x\\!-\\!y$ plane. The central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$
detects the ZDA at $t=5.6\ $\mathrm{s}\mathrm{e}\mathrm{c}$$ and ends the
experiment.

(b) Residuals of local monitor $\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$
run on UAV $1$. The stealthy ZDA is locally detected at $t=5.08\
$\mathrm{s}\mathrm{e}\mathrm{c}$$.

(c) Residuals of central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ run
on the control center. The stealthy ZDA is detected at $t=5.6\
$\mathrm{s}\mathrm{e}\mathrm{c}$$ using Algorithm 2.

Figure 6: Experiment 2: ZDA on UAVs $1,4,5$ and topology switching from mode
$1$ to $3$, which is triggered by local monitor
$\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ at $t=5.08\
$\mathrm{s}\mathrm{e}\mathrm{c}$$. (a) UAVs’ position in the $x\\!-\\!y$ plane
with the same annotations as in Figure 4a. (b)-(c) The residuals of local
monitor $\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ and central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ with
the same annotations as in Figures 5a and 5c, respectively.

(a) UAVs’ position in the $x\\!-\\!y$ plane. (b) Realization of stealthiness
condition (15) using $\mathbf{u}_{\rm s}$ in (19) with the starting time
$t_{\rm a}=5\ $\sec$$.

(c) Residuals of local monitor $\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$
run on UAV $1$. The stealthy ZDA is detected at $t=6.4\
$\mathrm{s}\mathrm{e}\mathrm{c}$$ using Algorithm 1.  (d) Residuals of central
monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ run
on the control center.

Figure 7: Experiment 3: covert attack on UAV $2$ and topology switching from
mode $1$ to $2$, which is triggered by local monitor
$\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ at $t=6.4\
$\mathrm{s}\mathrm{e}\mathrm{c}$$. (a) UAVs’ position in the $x\\!-\\!y$ plane
with the same annotations as in Figure 4a, except the gray lines that
visualize the V-shape formation achieved by the UAVs at $t_{\rm a}=5\
$\mathrm{s}\mathrm{e}\mathrm{c}$$, the starting time of the covert attack. (b)
The effect of measurement alteration using sensory attack $\mathbf{u}_{\rm s}$
starting at $t_{\rm a}=5\ $\mathrm{s}\mathrm{e}\mathrm{c}$$. (c)-(d) The
residuals of local monitor $\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$ and
central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ with
the same annotations as in Figures 5a and 5c, respectively.

####  IV-B1 Stealthy zero-dynamics attack

We conducted two experiments evaluating the effectiveness of the central and
local monitors in detection of stealthy zero-dynamics attack (ZDA). In the
first experiment, UAVs $1,\ 4,$ and $5$ are compromised such that their
control channels are subject to the discretized version of ZDA signals in (18)
as $\mathbf{u}_{\rm a}=\mathrm{col}\left({\boldsymbol{u}}_{{\rm
a}_{i}}\right)_{i\in\mathcal{A}}$, $\mathcal{A}=\\{1,4,5\\}$ with
${\boldsymbol{u}}_{{\rm a}_{i}}=[{\rm u}^{x}_{{\rm
a}_{i}}(0)e^{\lambda^{x}_{o}(kT_{\rm s})}\ \ {\rm u}^{y}_{{\rm
a}_{i}}(0)e^{\lambda^{y}_{o}(kT_{\rm s})}\ ]^{\top}$,
$\lambda^{x}_{o}=\lambda^{y}_{o}=0.5,\ k\in\mathbb{Z}_{\geq 0},\ {\rm
u}^{x}_{{\rm a}}(0)=[{\rm u}^{x}_{{\rm a}_{1}}(0)\ {\rm u}^{x}_{{\rm
a}_{4}}(0)\ {\rm u}^{x}_{{\rm a}_{5}}(0)]^{\scriptscriptstyle\top}=[-2.34{\rm
x}^{\rm a}_{4}(0)\ 10.24{\rm x}^{\rm a}_{4}(0)\ {-2.34}{\rm x}^{\rm
a}_{4}(0)]^{\scriptscriptstyle\top},$ $\\!{\rm u}^{y}_{{\rm a}}(0)=-0.7{\rm
u}^{x}_{{\rm a}}(0),\ {\rm x}^{\rm a}_{4}(0)=0.0086$, and the starting time
$t=(kT_{\rm s})=0,\ k=0$. The network-level measurements (13) with
$\mathcal{M}_{\rm p}=\\{3,5\\}$ and $\mathcal{M}_{\rm v}=\emptyset$, on the
other hand, are not subject to sensory attacks that is $\mathbf{u}_{\rm
s}=\boldsymbol{0}$.

In the first experiment, as shown in Figure 4a, all the UAVs start from some
initial positions and coordinate to achieve the desired formation while the
stealthy ZDA steers UAV $4$ away from its desired configuration that meets
(8). This effect has been illustrated in Figure 4b showing the relative
positions of the UAVs as well as their desired values in the $y$ direction
over time. It is necessary to note that UAV $4$ hits the safety net enclosing
the indoor flight area at $t\approx 9.8\ $\mathrm{s}\mathrm{e}\mathrm{c}$$.

In terms of attack detection, Figures 5a and 5b show the residuals of local
monitors $\Sigma^{\,i}_{\scriptscriptstyle\mathcal{O}}\text{'s},\
i\in\\{1,3\\}$ in (26) for UAVs $1$ and $3$, respectively. Also, Figure 5c
shows the residuals of the central monitor
$\Sigma_{\scriptscriptstyle\mathcal{O}}^{\scriptscriptstyle\mathcal{M}}$ in
(III-B1) available in the control center. One can verify that the local
monitor of UAV $1$, $\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$, running
Algorithm 1, has detected the stealthy ZDA in a timely manner ($t=3.22\
$\mathrm{s}\mathrm{e}\mathrm{c}$$) that is before UAV $4$ collides with the
safety net of the flight area at $t\approx 9.8\
$\mathrm{s}\mathrm{e}\mathrm{c}$$. However, the ZDA remains stealthy in the
residuals of the UAV $3$’s local monitor,
$\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$, and those of the central
monitor running Algorithm 2, regardless of the switch in the inter-UAV’s
communication topology from mode 1 to mode 4 (see Figure 3) that is triggered
by the local monitor $\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ at
$t=3.22\ $\mathrm{s}\mathrm{e}\mathrm{c}$$. This is due to the fact that
switching from mode $1$ to mode $4$ does not meet the necessary conditions
required for a topology switching to render stealhy attacks detectable for the
central monitor in (III-B1). The details of such conditions have been studied
in [27, Th. III.3].

In the second experiment, with the results shown in Figure 6, the UAVs are
under the same ZDA as in the first experiment expect ${\rm x}^{\rm
a}_{4}(0)=0.012$. The local monitor
$\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ successfully detects the ZDA at
$t=5.08\ $\mathrm{s}\mathrm{e}\mathrm{c}$$ (see Figure 6b) and then triggers a
switch in the UAVs’ communication from mode $1$ to mode $3$ (cf. Figure 3)
that as opposed to Experiment 1, this topology switching results in detection
of stealthy ZDA by the central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$ at
$t=5.6\ $\mathrm{s}\mathrm{e}\mathrm{c}$$ (see Figure 6c).

It is necessary to note that any topology switching in the inter-UAVs
communications results in a discrepancy between the actual dynamics of
networked UAVs and its nominal counterpart that is used by the attacker to
design stealthy attacks. Yet, the model discrepancy in Experiment 1 did not
interfere with the stealthiness of ZDA in the central monitor’s residuals
while it renders ZDA detectable in the central monitor’s residuals in
Experiment 2. These results indicate that not only zero-dynamics attacks (ZDA)
can be implemented in real-time on networked UAVs with partial measurements,
they also can remain stealthy regardless of switches in the inter-UAVs’
communication topology. Theoretical results to detect stealthy ZDA through
topology switching in networked systems with full-state measurements and with
partial measurements can be found, respectively, in [9] and [27].

####  IV-B2 Covert attack

Similar to the ZDA case, we evaluated the detection of covert attack on
networked UAVs subject to topology switching by using the local monitors
$\Sigma^{\,1}_{\scriptscriptstyle\mathcal{O}}$ and
$\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$, and the central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$. In
this experiment, a covert attack, $\mathbf{u}_{a_{i}},\
i\in\mathcal{A}=\\{2\\}$, in the form of a ramp signal with a slope of $3\
$\mathrm{D}\mathrm{e}\mathrm{g}\,$$, as the roll and pitch angles’
perturbation, and the starting time of $t_{\rm a}=5\
$\mathrm{s}\mathrm{e}\mathrm{c}$$ is injected through the control channel of
UAV $2$. The covert attack’s effect on the UAVs’ formation is shown in Figure
7a. As illustrated, all of the UAVs have deviated from their desired formation
configuration that meets (8). The effect of this deviation/perturbation on the
measurements $\mathbf{y}$ in (13) is simultaneously canceled out by
implementing the discretized version of the sensory attack $\mathbf{u}_{\rm
s}$ given in (19). Figure 7b illustrates how the alteration of actual
measurement $\mathbf{y}$ of the monitored UAV $3$ using the sensory attack
$\mathbf{u}_{\rm s}$ gives rise to a false state estimation by the central
monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$,
rendering the injected attack covert in the central residuals. The local
monitors, however, are not subject to such alterations and thus are capable of
detecting the covert attack in a timely manner as shown in Figure 7c for the
local monitor $\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$ of UAV $3$. We
note that the local monitor $\Sigma^{\,3}_{\scriptscriptstyle\mathcal{O}}$
triggers a topology switch from mode $1$ to mode $2$ (cf. Figure 3) at $t=6.4\
$\mathrm{s}\mathrm{e}\mathrm{c}$$ to make the covert attack detectable in the
residuals of the central monitor
$\Sigma^{\scriptscriptstyle\mathcal{M}}_{\scriptscriptstyle\mathcal{O}}$.
However, the attack remains stealthy in the central residuals, shown in Figure
7d, regardless of topology switching. The results, consistent with those in
the ZDA case, shows the outperformance of the decentralized detection scheme
(Algorithm 1) over the centralized detection scheme (Algorithm 2). It is worth
mentioning that one can leverage a larger number of switching communication
links on which the centralized monitor relies to improve the performance of
the centralized detection scheme. However, this solution raises other
challenges such as switching-induced unobservability as well as communication
overhead. In the case of the decentralized detection scheme that relies on the
network model of UAVs, scalability is a concern for larger teams of UAVs, for
which clustering-based solutions such as the one in [27] can be applied.

##  V Conclusions

In this paper, we studied the detection of sophisticated stealthy attacks
including zero-dynamics and covert attacks on networked UAVs with switching
communication topology in formation control settings. Centralized and
decentralized attack detection schemes were developed to detect the stealthy
attacks. We performed indoor flight tests using quadrotor UAVs to evaluate the
effectiveness of our proposed methods. The experiments showed feasibility of
stealthy attacks on UAV networks which was previously investigated only in
theory or simulations. The experiments also validated our theoretical
developments and the effectiveness of the attack detection schemes proposed in
this paper. The experimental results demonstrated the importance of timely
detection of stealthy attacks and trade-offs existing in centralized vs.
decentralized attack detection. Future work will be devoted to extending the
results to more complex cooperative settings where we will incorporate
cooperative attack mitigation and mission adaptation.

## Acknowledgment

This research is partially supported by the National Science Foundation (award
no. 2137753).

## References

  * [1] S.-J. Chung, A. A. Paranjape, P. Dames, S. Shen, and V. Kumar, “A survey on aerial swarm robotics,” _IEEE Transactions on Robotics_ , vol. 34, no. 4, pp. 837–855, 2018.
  * [2] K.-K. Oh, M.-C. Park, and H.-S. Ahn, “A survey of multi-agent formation control,” _Automatica_ , vol. 53, pp. 424–440, 2015.
  * [3] J. Cortes, S. Martinez, T. Karatas, and F. Bullo, “Coverage control for mobile sensing networks,” _IEEE Transactions on robotics and Automation_ , vol. 20, no. 2, pp. 243–255, 2004.
  * [4] K. Harikumar, J. Senthilnath, and S. Sundaram, “Multi-uav oxyrrhis marina-inspired search and dynamic formation control for forest firefighting,” _IEEE Transactions on Automation Science and Engineering_ , vol. 16, no. 2, pp. 863–873, 2018.
  * [5] P. Tokekar, J. Vander Hook, D. Mulla, and V. Isler, “Sensor planning for a symbiotic uav and ugv system for precision agriculture,” _IEEE Transactions on Robotics_ , vol. 32, no. 6, pp. 1498–1511, 2016.
  * [6] M. R. Manesh and N. Kaabouch, “Cyber-attacks on unmanned aerial system networks: Detection, countermeasure, and future research directions,” _Computers & Security_, vol. 85, pp. 386–401, 2019.
  * [7] J.-P. Yaacoub, H. Noura, O. Salman, and A. Chehab, “Security analysis of drones systems: Attacks, limitations, and recommendations,” _Internet of Things_ , vol. 11, p. 100218, 2020.
  * [8] G. Choudhary, V. Sharma, I. You, K. Yim, R. Chen, and J.-H. Cho, “Intrusion detection systems for networked unmanned aerial vehicles: a survey,” in _2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC)_. IEEE, 2018, pp. 560–565.
  * [9] Y. Mao, H. Jafarnejadsani, P. Zhao, E. Akyol, and N. Hovakimyan, “Novel stealthy attack and defense strategies for networked control systems,” _IEEE Transactions on Automatic Control_ , 2020.
  * [10] R. S. Smith, “Covert misappropriation of networked control systems: Presenting a feedback structure,” _IEEE Control Systems Magazine_ , vol. 35, no. 1, pp. 82–92, 2015.
  * [11] Y. Mo and B. Sinopoli, “Secure control against replay attacks,” in _2009 47th annual Allerton conference on communication, control, and computing (Allerton)_. IEEE, 2009, pp. 911–918.
  * [12] C. Kwon, W. Liu, and I. Hwang, “Analysis and design of stealthy cyber attacks on unmanned aerial systems,” _Journal of Aerospace Information Systems_ , vol. 11, no. 8, pp. 525–539, 2014.
  * [13] P. Dash, M. Karimibiuki, and K. Pattabiraman, “Out of control: stealthy attacks against robotic vehicles protected by control-based techniques,” in _Proceedings of the 35th Annual Computer Security Applications Conference_ , 2019, pp. 660–672.
  * [14] F. Fei, Z. Tu, R. Yu, T. Kim, X. Zhang, D. Xu, and X. Deng, “Cross-layer retrofitting of uavs against cyber-physical attacks,” in _2018 IEEE International Conference on Robotics and Automation (ICRA)_. IEEE, 2018, pp. 550–557.
  * [15] Y.-C. Liu, G. Bianchin, and F. Pasqualetti, “Secure trajectory planning against undetectable spoofing attacks,” _Automatica_ , vol. 112, p. 108655, 2020.
  * [16] A. K. Bozkurt, Y. Wang, and M. Pajic, “Secure planning against stealthy attacks via model-free reinforcement learning,” in _2021 IEEE International Conference on Robotics and Automation (ICRA)_. IEEE, 2021, pp. 10 656–10 662.
  * [17] L. Liu, H. Wu, Z. Xi, and Y. Cui, “Fdi attack detection for formation control of quantized uav systems by coding sensor outputs,” in _2020 International Conference on Unmanned Aircraft Systems (ICUAS)_. IEEE, 2020, pp. 1278–1285.
  * [18] C. Liang, M. Miao, J. Ma, H. Yan, Q. Zhang, and X. Li, “Detection of global positioning system spoofing attack on unmanned aerial vehicle system,” _Concurrency and Computation: Practice and Experience_ , p. e5925, 2020.
  * [19] L. Negash, S.-H. Kim, and H.-L. Choi, “Distributed observes for cyberattack detection and isolation in formation-flying unmanned aerial vehicles,” _Journal of Aerospace Information Systems_ , vol. 14, no. 10, pp. 551–565, 2017.
  * [20] E. M. Khanapuri, R. Sharma, and K. Brink, “Learning-based detection of stealthy false data injection attack applied to cooperative localization problem,” in _AIAA SCITECH 2022 Forum_ , 2022, p. 2543.
  * [21] H. Ahn, “Deep learning based anomaly detection for a vehicle in swarm drone system,” in _2020 International Conference on Unmanned Aircraft Systems (ICUAS)_. IEEE, 2020, pp. 557–561.
  * [22] R. Mahony, V. Kumar, and P. Corke, “Multirotor aerial vehicles: Modeling, estimation, and control of quadrotor,” _IEEE Robotics and Automation magazine_ , vol. 19, no. 3, pp. 20–32, 2012.
  * [23] W. Ren and N. Sorensen, “Distributed coordination architecture for multi-robot formation control,” _Robotics and Autonomous Systems_ , vol. 56, no. 4, pp. 324–333, 2008.
  * [24] M. Turpin, N. Michael, and V. Kumar, “Decentralized formation control with variable shapes for aerial robots,” in _2012 IEEE international conference on robotics and automation_. IEEE, 2012, pp. 23–30.
  * [25] W. Ren, “Consensus strategies for cooperative control of vehicle formations,” _IET Control Theory & Applications_, vol. 1, no. 2, pp. 505–512, 2007.
  * [26] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “A secure control framework for resource-limited adversaries,” _Automatica_ , vol. 51, pp. 135–148, 2015.
  * [27] M. Bahrami and H. Jafarnejadsani, “Privacy-preserving stealthy attack detection in multi-agent control systems,” in _2021 60th IEEE Conference on Decision and Control (CDC)_ , 2021, pp. 4194–4199.
  * [28] J. Chen, Z. Feng, J.-Y. Wen, B. Liu, and L. Sha, “A container-based dos attack-resilient control framework for real-time uav systems,” in _2019 Design, Automation & Test in Europe Conference & Exhibition (DATE)_. IEEE, 2019, pp. 1222–1227.


parameters in that scenario grows linearly with the number of tasks. (Table 5
lists each model’s parameter count.) Although the number of effective
parameters is far smaller than the actual parameter count (see Appendix B.1),
we also tested learning 100 tasks in sequence with a fixed 10 dendritic
segments per neuron. This network maintains a constant 35 million non-zero
parameters (same as a 10-layer MLP) independent of the number of tasks. As
Figure 17 shows, our modified network achieves $78.5\%$ accuracy on 100 tasks,
close to the network with 100 dendritic segments.

Why does an Active Dendrites Network not suffer from a severe drop in accuracy
with significantly fewer dendritic segments for a large number of tasks? We
hypothesize that since the dendritic segments are dense and prototype context
vectors are sparse (as most pixels in an MNIST image are black), a single
segment can learn to identify multiple context vectors, and thus there can be
far fewer dendritic segments than unique context vectors.

Figure 17:  Continual learning accuracy on permutedMNIST: an Active Dendrites
Network with the same number of dendritic segments per neuron as the number of
tasks (blue), and one with exactly 10 dendritic segments per neuron (red). We
also included 3- and 10-layer MLPs on 10 and 100 tasks. All results are
averaged over 8 independent trials.