The introduction of deep learning (DL) technology can improve the performance of cyber–physical systems (CPSs) in many ways. However, this also brings new security issues. To tackle these challenges, this article explores the vulnerabilities of DL-based unmanned aerial vehicles (UAVs), which are typical CPSs. Although many research works have been reported previously on adversarial attacks of DL models, only few of them are concerned about safety-critical CPSs, especially regression models in such systems. In this article, we analyze the problem of adversarial attacks against DL-based UAVs and propose two adversarial attack methods against regression models in UAVs. The experiments demonstrate that the proposed nontargeted and targeted attack methods both can craft imperceptible adversarial images and pose a considerable threat to the navigation and control of UAVs. To address this problem, adversarial training and defensive distillation methods are further investigated and evaluated, increasing the robustness of DL models in UAVs. To our knowledge, this is the first study on adversarial attacks and defenses against DL-based UAVs, which calls for more attention to the security and safety of such safety-critical applications.

This article studies the reliable and secure communications for a wireless-powered non-orthogonal multiple access (NOMA) system in the presence of multiple eavesdroppers. A joint artificial noise and power allocation (JAP) scheme is proposed to ensure the reliability and security for the system. Based on the JAP scheme, analytical closed-form expressions for connection outage probability (COP), secrecy outage probability (SOP) and effective secrecy throughput (EST) are derived, respectively, to evaluate the performance of the security-required user. Also, the asymptotic SOP and EST are analyzed to gain further insights. The numerical results demonstrate the correctness of the theoretic analysis and indicate that the proposed JAP scheme can achieve a better performance than the benchmark schemes.

Although state estimation using a bad data detector (BDD) is a key procedure employed in power systems, the detector is vulnerable to false data injection attacks (FDIAs). Substantial deep learning methods have been proposed to detect such attacks. However, deep neural networks are susceptible to adversarial attacks or adversarial examples, where slight changes in inputs may lead to sharp changes in the corresponding outputs in even well-trained networks. This article introduces the joint adversarial example and FDIAs (AFDIAs) to explore various attack scenarios for state estimation in power systems. Considering that perturbations added directly to measurements are likely to be detected by BDDs, our proposed method of adding perturbations to state variables can guarantee that the attack is stealthy to BDDs. Then, malicious data that are stealthy to both BDDs and deep learning-based detectors can be generated. Theoretical and experimental results show that our proposed state-perturbation-based AFDIA method (S-AFDIA) can carry out attacks stealthy to both conventional BDDs and deep learning-based detectors, while our proposed measurement-perturbation-based adversarial FDIA method (M-AFDIA) succeeds if only deep learning-based detectors are used. The comparative experiments show that our proposed methods provide better performance than state-of-the-art methods. Besides, the ultimate effect of attacks can also be optimized using the proposed joint attack methods.

Deep learning methods can not only detect false data injection attacks (FDIA) but also locate attacks of FDIA. Although adversarial false data injection attacks (AFDIA) based on deep learning vulnerabilities have been studied in the field of single-label FDIA detection, the adversarial attack and defense against multi-label FDIA locational detection are still not involved. To bridge this gap, this paper first explores the multi-label adversarial example attacks against multi-label FDIA locational detectors and proposes a general multi-label adversarial attack framework, namely muLti-labEl adverSarial falSe data injectiON attack (LESSON). The proposed LESSON attack framework includes three key designs, namely Perturbing State Variables, Tailored Loss Function Design, and Change of Variables, which can help find suitable multi-label adversarial perturbations within the physical constraints to circumvent both Bad Data Detection (BDD) and Neural Attack Location (NAL). Four typical LESSON attacks based on the proposed framework and two dimensions of attack objectives are examined, and the experimental results demonstrate the effectiveness of the proposed attack framework, posing serious and pressing security concerns in smart grids.

Nonorthogonal multiple access (NOMA) assisted semi-grant-free transmission admits grant-free users to access the channels otherwise solely occupied by grant-based users, and has been recently attracting considerable attention in terms of accommodating massive connectivity and reducing access delay in Internet of Things (IoT). In this work, we investigate the security of semi-grant-free NOMA transmission in the presence of passive and active eavesdropping attacks. In particular, for the scenario-I with strong grant-based user and weak grant-free users, the scenario-I-based maximal user scheduling (IbMUS) and scenario-I-based optimal user scheduling (IbOUS) schemes are proposed to combat the passive and active eavesdropping, respectively. For the scenario-II with weak grant-based user and strong grant-free users, two parallel schemes, namely, the scenario-II-based maximal user scheduling (IIbMUS) and scenario-II-based optimal user scheduling (IIbOUS) schemes, are proposed to combat the passive and active eavesdropping, respectively. These proposed schemes enhance the security by scheduling a grant-free user with maximal main channel capacity/maximal secrecy capacity to access the NOMA channel on the premise of ensuring the grant-based user’s Quality of Service. Based on these proposed schemes, the exact secrecy outage probability (SOP) are analyzed to evaluate the system performance. The simulation results validates the theoretic analysis and the superiority of the proposed schemes. The IbOUS and IIbOUS schemes can achieve better performance than the IbMUS and IIbMUS schemes owing to the use of active eavesdropper’s channel state information (CSI). The SOP achieved by the proposed schemes can be further improved with the increasing number of grant-free users and decreasing target rate (or target secrecy rate).

Vulnerability of various machine learning methods to adversarial examples has been recently explored in the literature. Power systems which use these vulnerable methods face a huge threat against adversarial examples. To this end, we first propose a signal-specific method and a universal signal-agnostic method to attack power systems using generated adversarial examples. Second, black-box attacks based on transferable characteristics and the above two methods are also proposed and evaluated. Third, adversarial training is adopted to defend systems against adversarial attacks. Experimental analyses demonstrate that the signal-specific attack method provides less perturbation compared to the FGSM (Fast Gradient Sign Method), and the signal-agnostic attack method can generate perturbations misclassifying most natural signals with high probability. Furthermore, the attack method based on the universal signal-agnostic algorithm has a higher transfer rate of black-box attacks than the attack method based on the signal-specific algorithm. In addition, the results show that the proposed adversarial training improves robustness of power systems to adversarial examples.