I. INTRODUCTION

NMANNED arial vehicles (UAVs) have recently seen a widespread use for a variety of applications, such as research missions, mailing delivery, and disaster management. With autonomous control, UAVs (e.g., drones) are inherently susceptible to a variety of cyberattacks aiming for sabotaging their operations or accessing their data and trajectory information. In other words, a malfunction resulting from a cyberattack (i.e., jamming) potentially compromises sensitive payloads or, in some extreme scenarios, leads to aerial collisions. Hence, the risks of cyberattacks associated with the functionality of UAVs must be acknowledged and mitigated.

Cyberattacks on UAVs branch into data interception, data manipulation, and denial-of-service. Data interception is often encountered with broadcast authentication protocols, which use cryptographic and non-cryptographic techniques [1][2][3][4][5]. On the other hand, secure location verification (e.g., multilateration) were adopted to sideline the impacts of data manipulation attacks [6,7]. However, these solutions are inefficient for jamming detection provided that attackers can easily launch interference with software-defined radios (SDRs) to disrupt the trajectory of a UAV. As a result, developing jamming detection techniques that also adhere to the existing standards is of grave importance. In this work, radiometric transmissions (i.e., signal features) are used to train a machine learning (ML) algorithm within a receiver module for jamming detection and classification. To this end, SDR units are exploited to launch jamming attacks and collect signal features. The underlying approach facilitates minimal modifications to standards and considers realistic attack setups unlike other reported efforts that assume software/hardware changes and simulation-based scenarios [8][9][10][11][12][13][14][15][16][17]. It is noteworthy to point out that ML was proposed for satellite communications, vehicle Ad Hoc networks, 5G networks, Internet of Things, and UAVs with applications to jamming detection, trajectory optimization, swarm communication, situational awareness, and malicious attack mitigation [18][19][20][21][22][23][24][25].

The groundwork of this research was laid for in a previous effort that resulted in large experimental datasets of signal features [26]. These features were obtained via SDRs and GNURadio flowgraphs built with an external computer. Feature extraction was followed by training and validating multiple ML algorithms for detecting/classifying different jamming attacks. The work herein extends on [26] in the following aspects:

1. The ML algorithm with the highest detection rate (DR) is integrated with the GNURadio feature extraction flowgraph to create an all-inclusive seamless receiver module that is capable of preforming real-time decision-making for jamming detection/classification. 2. The developed module is incorporated into a drone via onboard Raspberry Pi processor paired with a low-profile SDR (i.e., HackRF One). This entails loading the processor with the Python code generated from the overall module and verifying the jamming classification process. This article is organized as follows: Section II details the integration of the ML algorithm and GNURadio feature extraction flowgraph into one receiver module. Here, the extracted features are fed directly to the classification algorithm. Section III elaborates on exploiting the module to enable a drone for detecting and classifying specific jamming types. This setup is realized with on-board SDR and Raspberry Pi processer. Conclusions are provided in Section IV. U Fig. 1. Simplified GNURadio flowgraphs for (a) launching jamming attacks and (b) receiver module for extracting signal features and executing jamming detection/classification. Further details on each jamming attack and ML training/testing are available in [26].

II. MODULE DEVELOPMENT AND VALIDATION

In this section, a real-time jamming detection/classification module is developed and tested on a computer prior porting to the drone's on-board processor. This module enables the detection and classification of four types of jamming attacks: barrage, single-tone, successive-pulse, and protocol-aware. This module also considers IEEE 802.11 orthogonal frequency division multiplexing (OFDM) communication technology at 2.4 GHz center frequency. Fig. 1(a) shows a simplified GNURadio flowgraph that conveys how each jamming type is launched, whereas Fig. 1(b) illustrates the feature extraction and ML classification blocks at the receiver side. The five-class random forest (RF) classifier developed in a previous effort is utilized here for its high DR, i.e., 92% in comparison to the other investigated algorithms [26]. In this setup, eight signal features are extracted. Of these features, three are OFDMspecific (i.e., subcarrier length, cyclic prefix length, subcarrier spacing). The subcarrier length indicates the number of the subcarriers being used. The cyclic prefix length controls symbol overlapping, and the subcarrier spacing is the frequency separation among subcarriers [27]. The OFDM Estimator block shown in Fig. 1(b) is used to extract these features [28]. Two other features are energy-specific; namely, average received power and threshold. The latter is a binary indicator that returns 1 once the average received power exceeds a certain level and returns 0 otherwise. Such features are extracted with the use of the Energy Detector block [28]. Finally, three additional features; specifically, signal-to-noise ratio (SNR), average signal power, and average noise power are extracted from the SNR Estimator Probe block. It is worthy to be pointed out that the average received power obtained from the Energy Detector block conveys noise energy; whereas the average signal power obtained from the SNR Estimator Probe presents the estimated signal power excluding noise power. For the training and validation of the RF classifier, a total of 23,565 signal samples were collected following the attack scenario reported in [26, Fig. 2]. Of these samples, 10,071 were obtained under no jamming, whereas 3,392, 3,367, 3,378, and 3,357 were obtained in the presence of barrage, single-tone, successive-pulse, and protocolaware jamming, respectively. The complete dataset with the 23,565 samples is provided in [29]. While developing the classifier, 10-fold cross-validation was used and grid search is utilized for finding the optimal hyper-parameters.

The jamming classifcation block receives all features from the feature extraction block and writes classification parameter C, C = 0, 1 … 4, to a file according to the jamming type as depicted in Table 1. The resulting C values are utilized in evaluating the classification accuracy (i.e., DR) by comparing the predictions of the module with the actual launched jamming type. Fig. 2 illustrates the pseudo code for the receiver module. Also, Fig. 3 shows a sample output file with prediction results for C = 0 (i.e., No Jamming), which results in 100% DR. This DR is calculated and updated for every set of extracted features. The Prediction together with the Jamming Type are printed to validate the functionality of the developed receiver module. The receiver module in Fig. 1(b) is also tested by calculating the DR while a jammer is in proximity to a receiver terminal (i.e., computer). To collect experimental data, two computers are utilized. The first computer uses an SDR to function as a receiver running the developed module. This computer has a 64-bit Windows 10 machine with Intel ® Core TM i7-7700HQ CPU @ 2.8 GHz processor and 32 GB of memory. The second computer is for launching each of the jamming attacks via another SDR. Fig. 4 presents sample outputs of 15 predictions for each attack type. The receiver module demonstrates a DR of 100% for barrage and successive-pulse types. Moreover, the resulting DR for single-tone and protocol-aware are 93.33% and 40%, respectively. The high misprediction in protocol-aware is attributed to its spectral similarities to barrage jamming and is expected to improve with the increase of samples. It is to be stressed that the DR is updated as samples are added. For instance, Fig. 4(b) shows that sample 1 is mispredicted. Hence, DR assumes one misprediction out of a single attempt, i.e., 0%. After correctly predicting sample 2, the DR is updated with one correct prediction out of two attempts, i.e., 50%. Finally, after receiving all samples, the overall DR is found to be 14 correct predictions of 15 predictions, i.e., 93.33%. Accordingly, the DR can be expressed as follows:

III. MODULE IMPLEMENTATION

The receiver module depicted in Fig. 1(b) is adopted in a Clover 4.2 open-source drone from COEX, as featured in Fig. 5. This drone is equipped with Raspberry Pi 4 that facilitates 64-bit ARM Cortex-A72 quad-core CPU @ 1.5 GHz processor and 1 GB of memory [30]. This processor is interfaced with HackRF One SDR via micro-USB cable for receiving the radio frequency transmissions at 2.4 GHz (i.e., drone operating frequency). Once these transmissions are captured, two Python-based subroutines are executed: Feature_Extraction.py for extracting the eight above-mentioned features and Jamming_Classification.py for exploiting these features for running, in real-time, a five-class ML classifier for detecting jamming presence and specifying its type.

Prior implementing the module, the training and validation of the RF classifier are repeated using the Raspberry processor to calculate the detection/classification time and to establish a comparison between the computer and Raspberry processors considering DR, F-score (FS), and false-alarm rate (FAR). The calculations of these evaluation metrics are performed as follows:

False Positive Samples FAR False Positive+True Negative Samples In (2), the "Precision" is defined as the number of positive samples predicted as positive (i.e., true positive) divided by the sum of true positive and negative samples predicted as positive (i.e., false positive). Also, the "Recall" is the number of true positive samples divided by the sum of true positive and positive samples predicted as negative (i.e., false negative). F-score is computed from the Precision and Recall to represent their harmonic mean. Finally, the FAR is the number of false positive samples divided by the sum of false positive and true negative samples predicted by the classifier. Table II illustrates that the validation accuracy (VA) and DR of the developed classifier are higher than 92% for both processors. In addition, the testing time with the use of the Raspberry processor is 10.64 seconds. Since this testing time results from classifying nearly 7,070 samples (i.e., 30% of the overall dataset), the average processing time of the five-class RF model to classify a sample is 1.5 ms, enabling real-time jamming detection/classification. Fig. 6 illustrates the resulting confusion matrices of the classifier after completing the training/testing with the computer and Raspberry Pi processors. Such matrices indicate that none of the jamming attacks are misclassified as No Jamming. Misclassification, however, occurs mostly among barrage and protocol-aware jamming types mainly due to their similar spectral properties. The weighted FARs are computed from these matrices to be 1.33% and 1.10% for the computer and raspberry Pi processors, respectively. Furthermore, it can be inferred from the confusion matrix in Fig. 6(b) that, of the 7,070 testing samples, the resulting DRs of the classifier for C = 0, 1, 2, 3, and 4 are 100%, 83.7%, 95.1%, 99.9%, and 77%, respectively. After validating the classifier using Raspberry, the Python code obtained from the overall GNURadio receiver module is built in the drone as described in Fig. 5. All five scenarios (i.e., no jamming, barrage, single-tone, successive-pulse, protocolaware) are tested while the drone is idling. In these tests, an SDR is used to launch each jamming type considering a 1.5-meter jammer-drone separation to enable the receiver module for capturing and classifying 100 samples per scenario. The DR for all scenarios is calculated and updated as elaborated in Section II and is summarized in Table III. The developed module showed 100% accuracy in detecting jamming presence. Also, no misclassification occurs when there is no jamming or when either single-tone or successive-pulse is launched. On the other hand, barrage is misclassified 31% of the time (18% as single-tone, 13% as protocol-aware); whereas protocol-aware is misclassified 40% of the time (33% as barrage, 5% as single-tone, 2% as successivepulse). Such results suggest that the proposed receiver module provides a viable solution for jamming detection and classification.

V. CONCLUSION

Real-time jamming detection and classification configuration with applications to UAVs is proposed via the integration of an SDR with on-board Raspberry Pi processor. The SDR is utilized for capturing and forwarding the radio frequency signals to a receiver module hosted in the processor. This module extracts OFDM, energy, and SNR signal features and exploits an ML algorithm for detecting and classifying four jamming types: barrage, single-tone, successive-pulse, and protocol-aware. The resulting configuration yielded in an overall DR and FAR of 93% and 1.10%, respectively. These values are in proximity to their counterparts obtained during the validation of the receiver module. Future work entails testing the developed module while the drone is in operation and implementing jamming mitigation protocols such as path rescheduling and beamforming front-end circuitry.