The introduction of deep learning (DL) technology can improve the performance of cyber–physical systems (CPSs) in many ways. However, this also brings new security issues. To tackle these challenges, this article explores the vulnerabilities of DL-based unmanned aerial vehicles (UAVs), which are typical CPSs. Although many research works have been reported previously on adversarial attacks of DL models, only few of them are concerned about safety-critical CPSs, especially regression models in such systems. In this article, we analyze the problem of adversarial attacks against DL-based UAVs and propose two adversarial attack methods against regression models in UAVs. The experiments demonstrate that the proposed nontargeted and targeted attack methods both can craft imperceptible adversarial images and pose a considerable threat to the navigation and control of UAVs. To address this problem, adversarial training and defensive distillation methods are further investigated and evaluated, increasing the robustness of DL models in UAVs. To our knowledge, this is the first study on adversarial attacks and defenses against DL-based UAVs, which calls for more attention to the security and safety of such safety-critical applications.

Aircraft detection in synthetic aperture radar (SAR) images plays an essential role in satellite observation and military decisions. Due to discrete scattering properties, speckle noise interference, and various aircraft types, many existing methods struggle to achieve the desired detection performance. In this article, we propose an innovative semantic condition constraint guided feature aware network (SCFNet) for detecting different aircraft categories in SAR images. First, considering the discrete scattering properties of aircraft, we design a local-global feature aware module (LGA-M) and morphological-semantic feature aware module (MSF-M), which can effectively extract the fine-grained feature information contained in SAR images. Second, to effectively fuse different feature information, we construct a feature fusion pyramid (FFP), which uses different branches and paths to reasonably merge multiple feature information types and suppresses background information interference. Third, according to the structure characteristics of aircraft, the global coordinate attention mechanism (G-CAT) is presented to highlight foreground target features and suppress speckle noise interference. Finally, we construct semantic condition constraints, including constraint condition setting, semantic information calculation, and template matching, to improve aircraft localization and recognition accuracy. Extensive experiments demonstrate that the proposed SCFNet can obtain state-of-the-art performance on the SAR aircraft detection dataset, which achieves AP and F1 Score of 94.83% and 95.58%, respectively. The related implementation codes will be made publicly available at https://github.com/darkseid-arch/AirDetection.

Although state estimation using a bad data detector (BDD) is a key procedure employed in power systems, the detector is vulnerable to false data injection attacks (FDIAs). Substantial deep learning methods have been proposed to detect such attacks. However, deep neural networks are susceptible to adversarial attacks or adversarial examples, where slight changes in inputs may lead to sharp changes in the corresponding outputs in even well-trained networks. This article introduces the joint adversarial example and FDIAs (AFDIAs) to explore various attack scenarios for state estimation in power systems. Considering that perturbations added directly to measurements are likely to be detected by BDDs, our proposed method of adding perturbations to state variables can guarantee that the attack is stealthy to BDDs. Then, malicious data that are stealthy to both BDDs and deep learning-based detectors can be generated. Theoretical and experimental results show that our proposed state-perturbation-based AFDIA method (S-AFDIA) can carry out attacks stealthy to both conventional BDDs and deep learning-based detectors, while our proposed measurement-perturbation-based adversarial FDIA method (M-AFDIA) succeeds if only deep learning-based detectors are used. The comparative experiments show that our proposed methods provide better performance than state-of-the-art methods. Besides, the ultimate effect of attacks can also be optimized using the proposed joint attack methods.

Vulnerability of various machine learning methods to adversarial examples has been recently explored in the literature. Power systems which use these vulnerable methods face a huge threat against adversarial examples. To this end, we first propose a signal-specific method and a universal signal-agnostic method to attack power systems using generated adversarial examples. Second, black-box attacks based on transferable characteristics and the above two methods are also proposed and evaluated. Third, adversarial training is adopted to defend systems against adversarial attacks. Experimental analyses demonstrate that the signal-specific attack method provides less perturbation compared to the FGSM (Fast Gradient Sign Method), and the signal-agnostic attack method can generate perturbations misclassifying most natural signals with high probability. Furthermore, the attack method based on the universal signal-agnostic algorithm has a higher transfer rate of black-box attacks than the attack method based on the signal-specific algorithm. In addition, the results show that the proposed adversarial training improves robustness of power systems to adversarial examples.

State estimation methods used in cyber–physical systems (CPSs), such as smart grid, are vulnerable to false data injection attacks (FDIAs). Although substantial deep learning methods have been proposed to detect such attacks, deep neural networks (DNNs) are highly susceptible to adversarial attacks, which modify input of DNNs with unnoticeable but malicious perturbations. This article proposes a method to explore targeted and stealthy FDIAs via adversarial machine learning. We pose FDIAs as sparse optimization problems to achieve initial attack objectives and remain stealthy during attacks. We propose a parallel optimization algorithm to efficiently solve the problems and explore additional sparse-state attacks. The experimental results show that for IEEE 14-bus and 118-bus systems, the success rate of two-state sparse attacks with small-scale targets is as high as 80%. In addition, the attack success rate can continue to increase as the number of attack states increases. The proposed attacks demonstrate that attackers can implement attacks that can bypass both bad data detectors and neural network detectors while keeping the initial attack objectives unchanged, which is a critical and urgent security threat in CPS.

Automatic underwater target detection plays a vital role in sonar image processing and analysis, and its core task is to discriminate target categories and achieve precise positioning. However, the sonar image is interfered by the seafloor reverberation noise and complex background, which brings more significant challenges to the accurate detection of sonar target. To achieve accurate detection of different categories targets in sonar image, we proposed an adaptive global feature enhancement network (AGFE-Net), which uses multi-scale convolution and attention mechanisms with global receptive field to obtain sonar image multi-scale semantic feature and enhance the correlation between features. Specifically, we use the multi-scale receptive field feature extraction block (MSFF-Block) and the self-attention mechanism block (SAM-Block) to enhance model feature extraction ability; the bidirectional feature pyramid network (Bi-FPN) and the global pyramid pooling block (GPP-Block) are used to obtain the deep semantic feature and suppress background noise interference; the adaptive feature fusion block (AFF-Block) is used to effectively fuse features of different scales. Experimental results on the presented sonar target detection dataset WH-Dataset and QD-Dataset validate the advantage of AGFE-Net over other state-of-the-art target detection methods.