Cohen Shai, Levy Efrat, Shaked Avi, Cohen Tair, Elovici Yuval, Shabtai Asaf
Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Be'er Sheva 8410501, Israel.
Cyber Division, Elta Company, Ashdod 7710202, Israel.
Sensors (Basel). 2022 Jun 2;22(11):4259. doi: 10.3390/s22114259.
Radar systems are mainly used for tracking aircraft, missiles, satellites, and watercraft. In many cases, information regarding the objects detected by a radar system is sent to, and used by, a peripheral consuming system, such as a missile system or a graphical user interface used by an operator. Those systems process the data stream and make real-time operational decisions based on the data received. Given this, the reliability and availability of information provided by radar systems have grown in importance. Although the field of cyber security has been continuously evolving, no prior research has focused on anomaly detection in radar systems. In this paper, we present an unsupervised deep-learning-based method for detecting anomalies in radar system data streams; we take into consideration the fact that a data stream created by a radar system is heterogeneous, i.e., it contains both numerical and categorical features with non-linear and complex relationships. We propose a novel technique that learns the correlation between numerical features and an embedding representation of categorical features in an unsupervised manner. The proposed technique, which allows for the detection of the malicious manipulation of critical fields in a data stream, is complemented by a timing-interval anomaly-detection mechanism proposed for the detection of message-dropping attempts. Real radar system data were used to evaluate the proposed method. Our experiments demonstrated the method's high detection accuracy on a variety of data-stream manipulation attacks (an average detection rate of 88% with a false -alarm rate of 1.59%) and message-dropping attacks (an average detection rate of 92% with a false-alarm rate of 2.2%).
雷达系统主要用于跟踪飞机、导弹、卫星和船只。在许多情况下，雷达系统检测到的有关物体的信息会被发送到诸如导弹系统或操作员使用的图形用户界面等外围消费系统，并由这些系统使用。这些系统处理数据流，并根据接收到的数据做出实时操作决策。鉴于此，雷达系统提供的信息的可靠性和可用性变得越来越重要。尽管网络安全领域一直在不断发展，但之前没有研究专注于雷达系统中的异常检测。在本文中，我们提出了一种基于无监督深度学习的方法来检测雷达系统数据流中的异常；我们考虑到雷达系统创建的数据流是异构的这一事实，即它包含具有非线性和复杂关系的数值特征和分类特征。我们提出了一种新颖的技术，该技术以无监督的方式学习数值特征与分类特征的嵌入表示之间的相关性。所提出的技术允许检测数据流中关键字段的恶意操纵，并辅以用于检测消息丢弃尝试的时间间隔异常检测机制。我们使用实际雷达系统数据来评估所提出的方法。我们的实验证明了该方法在各种数据流操纵攻击（平均检测率为88%，误报率为1.59%）和消息丢弃攻击（平均检测率为92%，误报率为2.2%）上具有很高的检测准确率。
