Attention Meets UAVs: A Comprehensive Evaluation of DDoS Detection in Low-Cost UAVs

TL;DR

This paper evaluates machine learning and deep learning models, especially attention-based models like TST, for detecting DDoS attacks on low-cost UAVs, achieving high accuracy and fast detection times.

Contribution

It introduces a comprehensive evaluation of various ML and DL algorithms, highlighting the effectiveness of attention mechanisms and proposing an on-board DDoS detection system for UAVs.

Findings

Attention-based models outperform non-attention models.

TST achieves an F1 score of up to 0.999 with 0.1s runtime.

Learnable positional embeddings improve detection accuracy.

Abstract

This paper explores the critical issue of enhancing cybersecurity measures for low-cost, Wi-Fi-based Unmanned Aerial Vehicles (UAVs) against Distributed Denial of Service (DDoS) attacks. In the current work, we have explored three variants of DDoS attacks, namely Transmission Control Protocol (TCP), Internet Control Message Protocol (ICMP), and TCP + ICMP flooding attacks, and developed a detection mechanism that runs on the companion computer of the UAV system. As a part of the detection mechanism, we have evaluated various machine learning, and deep learning algorithms, such as XGBoost, Isolation Forest, Long Short-Term Memory (LSTM), Bidirectional-LSTM (Bi-LSTM), LSTM with attention, Bi-LSTM with attention, and Time Series Transformer (TST) in terms of various classification metrics. Our evaluation reveals that algorithms with attention mechanisms outperform their counterparts in general, and TST stands out as the most efficient model with a run time of 0.1 seconds. TST has demonstrated an F1 score of 0.999, 0.997, and 0.943 for TCP, ICMP, and TCP + ICMP flooding attacks respectively. In this work, we present the necessary steps required to build an on-board DDoS detection mechanism. Further, we also present the ablation study to identify the best TST hyperparameters for DDoS detection, and we have also underscored the advantage of adapting learnable positional embeddings in TST for DDoS detection with an improvement in F1 score from 0.94 to 0.99.