Unmanned Aerial Vehicles (UAVs) are aerial vehicles that can go to a particular position without human control or with remote human control. It is because unmanned control mainly relies on position estimation that a lot of research has been studied on GPS spoofing attacks. Detection methods against GPS spoofing attacks mainly include monitoring RF signals or IMU sensor values inside UAVs. In this work, we analyze GPS attack and detection in an advanced autopilot system, PX4 without excluding RF detection. Recent studies have shown that GPS spoofing is unable to evade the detection using EKF sensor fusion. Therefore, this paper experiment whether the detection could be evaded by strengthening the attacker model. This paper classifies attacker models according to whether an attacker knows the true position of UAVs or the estimated position by UAV and proposed attack methods depending on each model in PX4. We inject GPS value which our attack method intends to UAV during mission flight in simulation environment. By manipulating the GPS driver code of PX4 controller, we inject GPS value the attack method wants into UAV in physical environment. Finally, we observed the innovation test ratio during GPS spoofing and demonstrate that GPS spoofing attack is possible keeping the innovation test ratio under the anomaly detection criterion. After that, we proposed our approach which scales the EKF’s Kalman gain randomly to increase the detection method’s efficiency and experiment with the attack methods. This detection method has little effect on the test ratio without the attack. But during the attack, the innovation test ratio was increased higher than the anomaly detection criterion so that the attack could be detected.

Correlation Power Analysis (CPA) uses a lot of computational resources for deploying side-channel analysis to power traces. For every guessing key, it searches all data points and all power traces to reveal the secret key implemented in the encryption module. In this work, we propose a novel technique to narrow down the target region for applying CPA to the power traces. As byte-wise operations occur in every clock period, the assumed amplitude value based on the power consumption model and the actual amplitude are most correlated at the points where the peaks are observed. We extract the calculation points of each power trace using signal processing and machine learning techniques, and select the region where the CPA will be applied to. Our proposed approach achieves an approximately 20% improvement in accuracy and requires less computational resources compared to conventional CPA.

Many automatic speech recognition (ASR) systems provide functions such as sending messages or opening garage doors. If such a system malfunctions, it could pose a significant threat. In this paper, we propose the attack scenario in which we transfer audio adversarial examples to radio system through the radio signal and the sound received through radio deceives the ASR system. In addition, we propose over-the-air technology using environmental noise so that we can attack easily and effectively. Using this method, we observed that the combined sound was much more robust to environmental noise than the non-combined sound. Finally, we experiment as our scenario on a real environment with adversarial examples created using environmental noise and show the results. Our attack succeeded against commercial ASR systems with a success rate of over 50%.

In recent years, researchers have studied various methods for transferring data in a network-separated environment, and the most representative method is the use of inaudible frequency signals like ultrasonic waves. This method has the advantage of being able to transfer data without other people noticing, but it has the disadvantage that speakers must exist. In a laboratory or company, external speakers may not be attached to each computer. Therefore, this paper presents a new covert channel attack that transfers data using internal speakers on the computer’s motherboard. The internal speaker can also produce a sound of the desired frequency, and, therefore, data can be transferred using high frequency sounds. We encode data into Morse code or binary code and transfer it. Then we record it using a smartphone. At this time, the location of the smartphone can be any distance within 1.5 m when the length per bit is longer than 50 ms, such as on the computer body or on the desk. Data are obtained by analyzing the recorded file. Our results show that data is transferred from a network-separated computer using an internal speaker with 20 bits/s in maximum.

Autonomous Vehicles (AVs) refer to systems capable of perceiving their states and moving without human intervention. Among the factors required for autonomous decision-making in mobility, positional awareness of the vehicle itself is the most critical. Accordingly, extensive research has been conducted on defense mechanisms against GPS spoofing attacks, which threaten AVs by disrupting position recognition. Among these, detection methods based on internal IMU sensors are regarded as some of the most effective. In this paper, we propose a spoofing attack system designed to neutralize IMU sensor-based detection. First, we present an attack modeling approach for bypassing such detection. Then, based on EKF sensor fusion, we experimentally analyze both the impact of GPS spoofing values on the internal target system and how our proposed methodology reduces anomaly detection within the target system. To this end, this paper proposes an attack model that performs GPS spoofing by stealing internal dynamic state information using an external IMU sensor, and the experimental results demonstrate that attack values can be injected without being detected.