Unmanned aerial vehicle cluster security test system and method based on information physical space

Abstract

An unmanned aerial vehicle cluster security test system based on an information physical space comprises a wireless penetration module, a cluster detection module, a cluster penetration module and a PX4 deception module, and the wireless penetration module comprises a wireless cracking module; the cluster detection module comprises a cluster scanning module and an ROS node request connection module; the cluster penetration module comprises ROS node cancellation attacks, port depletion attacks and wireless interference attacks; the PX4 spoofing module comprises a PX4 flight control IP determination module and a control instruction spoofing attack. And the unmanned aerial vehicles in the target unmanned aerial vehicle cluster have an unmanned aerial vehicle cluster system with wireless communication and autonomous sensing, planning and flying capabilities. The invention further provides an unmanned aerial vehicle cluster safety testing method based on the information physical space. The unmanned aerial vehicle cluster safety test system is easy to deploy and operate, and a test effect can be obtained in a short time.

Description

Technical Field

[0001] The present invention belongs to the field of system network security, and specifically relates to a drone cluster security testing system and method based on cyber-physical space. Background Art

[0002] As an ideal platform for modern cyber-physical systems (CPS), multi-robot systems, especially drone swarm systems, are becoming a research hotspot that attracts increasing attention from academia and industry. Drone swarms can achieve cross-cutting collaborative perception, path planning, and dynamic sharing of flight paths through advanced wireless network technology, providing innovative solutions for task execution in complex, dynamic, and uncertain environments. As a key infrastructure connecting various drone nodes, wireless networks not only realize real-time data transmission and information interaction, but also provide a highly flexible and scalable communication architecture for the system. This architecture enables drone swarms to maintain a high degree of collaboration and adaptability in the environment.

[0003] In drone swarms, the technical complexity of a single drone is increasing, usually integrating an onboard computer, PX4 flight control, and visual perception devices. It has complex perception, planning, and control functions. However, existing safety test systems have obvious limitations. Among them, most safety test systems still focus on the Robot Operating System (ROS) for related design, and do not fully consider the overall application services of a single drone system, and do not include drone cluster communication in the safety test system. In addition, the attack methods used by the safety test system are often subject to many restrictions and challenges in the airspace environment. Due to the unique environment in which drones fly in the airspace, attackers cannot directly attack the drone system. Attackers often have to connect to the wireless LAN for internal communication in the drone cluster before further attacks can be successful. Among the many network attack methods that can cause direct physical behavior effects on drone clusters, traditional denial of service (DOS) or port exhaustion attacks are often limited by the attacker's system resources available and the different application services configured by the attacked, making the attack effect difficult to predict or even completely ineffective. What is more serious is that the existing research on control attacks is still at the theoretical level, focusing more on the wireless network layer, and failing to deeply explore the use and deception methods of the real flight control protocol. Therefore, the present invention proposes a UAV cluster security test system based on cyber-physical space, aiming to comprehensively evaluate and enhance the network security capabilities of UAV clusters. Summary of the invention

[0004] In order to overcome the shortcomings of the prior art, the present invention provides a drone cluster security testing system and method based on cyber-physical space, which solves the shortcomings of the existing security testing platform that does not consider drone clusters and their characteristics. From the perspective of network security, the system focuses on the impact on drone cluster behavior or individual drone behavior, and designs attacks and builds a security testing system from the perspectives of ROS nodes, ports, wireless networks, and PX4.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A drone swarm safety testing system based on cyber-physical space, comprising:

[0007] Wireless penetration module, used to wirelessly crack wireless hotspots in space;

[0008] Cluster detection module, used to perform cluster scanning module and ROS node connection request on the wireless network connected to;

[0009] The cluster penetration module is used to conduct ROS node cancellation attacks, port exhaustion attacks, and wireless interference attacks on clusters and drones that have different application services;

[0010] The PX4 spoofing module is used to determine the PX4 flight control IP of the connected drone cluster wireless LAN and execute control spoofing command attacks on the determined PX4 flight control IP.

[0011] Further, the wireless penetration module includes:

[0012] The wireless cracking unit is used to crack the wireless password of the target hotspot in the wireless environment.

[0013] Furthermore, the cluster detection module includes:

[0014] Cluster scanning unit, used to scan and determine the IP survival and port services of the drone cluster;

[0015] The ROS node request connection unit is used to determine the ROS node port service attributes of the drone.

[0016] Furthermore, the cluster penetration module includes:

[0017] ROS cancel node attack unit, used to terminate the service test of drone ROS nodes;

[0018] Port exhaustion attack unit, used to perform port exhaustion attack test on drone ports;

[0019] Wireless interference attack unit, used to conduct communication interference attack tests on drone cluster communication hotspots.

[0020] The PX4 cheating module contains:

[0021] PX4 flight control IP determination unit, used to perform IP scanning and determination on the open PX4 flight control IP in the drone cluster;

[0022] The control command spoofing attack unit performs PX4 state switching and flight command spoofing attacks on the open PX4 flight control IP in the cluster.

[0023] A safety testing method for drone swarm based on cyber-physical space, comprising the following steps:

[0024] Step 1. Execute the wireless cracking unit in the wireless penetration module. Enter "airmon-ngstart wlan0" in the attacker's terminal to start the wireless network card monitoring mode; enter "airdump-ng wlan0mon" in the terminal to start detecting the surrounding wireless networks, and select the BSSID value and CH value corresponding to the row with the largest PWR value; enter "airodump-ng-c CH–-bssid BSSID-w / root / Data / wlan0mon" in the terminal, and then open a new terminal and enter "aireplay-ng-03-a BSSID wlan0mon" to monitor the handshake packet of the target wireless network; enter "aircrack-ng-w / usr / share / wordlists / 1.txt / root / Data / -01.cap" in the terminal to crack the captured handshake packet. At this point, the wireless communication password of the drone cluster will be obtained;

[0025] Step 2: Execute the cluster detection module, connect to the wireless password cracked in step 1, and further execute the cluster scanning module: input "apr-scan-l>ip_add.txt" in the terminal to discover the IP survival of the cluster LAN; if the number of IPs found is less than 2, return to step 1 and reselect the wireless target network to crack the wireless target network password. If the number of IPs found is greater than or equal to 2, enter "cat ip_addresses.txt|xargs-I{}nmap-p-{}|grep'open'>open_ports.txt" in the terminal to complete the scan of all port services under all surviving IP hosts in the cluster, and classify all open ports into non-ROS service port classes; further execute the ROS node request connection module: input the "pythonnmap_scan.py" script in the terminal to identify ROS Master node, detect XML-RPC service port and verify TCPROS port, classify such ports into ROS service port class, and delete the same ports in non-ROS service port class; at this point, the service type detection of all IPs and ports within the drone cluster will be completed, and the ports will be divided into ROS service port class and non-ROS service port class;

[0026] Step 3, execute the PX4 spoofing module. When ROS is selected to cancel the node attack, combined with any port in the ROS service port class determined in step 2 and the IP to which the port belongs, start the kill_node.py script, which will be able to cancel the actual program running of the selected ROS service port; when the selected port is a ROS service port, the actual drone corresponding to the IP will hover in the air. When the port exhaustion attack is selected, combined with any port in the non-ROS service port class determined in step 2 and the IP to which the port belongs, start the exhaust.py script, which will be able to perform a port exhaustion attack on the selected port; when the selected port is a non-ROS service port, the onboard computer of the actual drone corresponding to the IP will crash, but it will not affect the original ROS program that has been started. When the wireless interference attack is selected, combined with the BSSID determined in step 1; enter "aireplay-ng-00-aBSSID" in the terminal. wlan0mon", will be able to carry out wireless interference attacks on the selected wireless target network, making the drone cluster LAN unable to communicate. When the selected BSSID is the wireless target network, the entire wireless LAN of the drone cluster will be unable to communicate, making it impossible for the drones in the drone cluster to avoid collisions. In a limited space, it may even cause collisions between drones.

[0027] Further, in the step three, when the PX4 flight control IP determination unit is selected, combined with ip_add.txt in step two, the nmap_px4.py script is started, and the PX4 flight control IP determination of all IPs under the wireless target network will be completed; when there is an open PX4 flight control IP in the wireless target network, the port opening information under the IP can be scanned by nmap_px4.py; when the control instruction deception attack unit is selected, combined with the surviving PX4 flight control IP and open port determined in the PX4 flight control IP determination module, the command_px4.py script is started, and the control instruction deception attack can be performed on the PX4 flight control IP. When connected to the PX4 flight control IP, a drone controller will be forged and the flight control fixed-point mode switching will be executed, and the position control command will be sent, so that the connected drone is not affected by its own onboard computer trajectory planning information, and executes the relevant control instructions of the forged drone controller to fly.

[0028] The beneficial effects of the present invention are as follows: starting from the perspective of network security, attack design and security test system construction are carried out in terms of corresponding impact on drone clusters or individual behaviors; the drone cluster security test system is easy to deploy and operate, and the test effect can be obtained in a short time. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a schematic diagram of the drone cluster safety test system. DETAILED DESCRIPTION

[0030] The present invention will be further described below in conjunction with the accompanying drawings.

[0031] Reference Figure 1 , a drone swarm safety testing system based on cyber-physical space, including:

[0032] Wireless penetration module, used to perform wireless cracking on wireless hotspots in space.

[0033] The wireless penetration module includes: a wireless cracking unit for cracking the wireless password of a target hotspot in a wireless environment;

[0034] Cluster detection module, used to perform cluster scanning module and ROS node connection request on the wireless network connected to;

[0035] The cluster detection module comprises:

[0036] Cluster scanning unit, used to scan and determine the IP survival and port services of the drone cluster;

[0037] ROS node request connection unit, used to determine the ROS node port service attributes of the drone;

[0038] The cluster penetration module is used to conduct ROS node cancellation attacks, port exhaustion attacks, and wireless interference attacks on clusters that are different from the application services to which the drones belong.

[0039] The cluster penetration module includes:

[0040] ROS cancel node attack unit, used to terminate the service test of drone ROS nodes;

[0041] Port exhaustion attack unit, used to perform port exhaustion attack test on drone ports;

[0042] Wireless jamming attack unit, used to conduct communication jamming attack tests on drone cluster communication hotspots;

[0043] The PX4 spoofing module is used to determine the PX4 flight control IP of the connected drone cluster wireless LAN and execute control spoofing command attacks on the determined PX4 flight control IP;

[0044] The PX4 cheating module contains:

[0045] PX4 flight control IP determination unit, used to perform IP scanning and determination on the open PX4 flight control IP in the drone cluster;

[0046] The control command spoofing unit performs PX4 state switching and flight command spoofing attacks on the open PX4 flight control IP in the cluster.

[0047] A safety testing method for drone swarm based on cyber-physical space, comprising the following steps:

[0048] Step 1. Execute the wireless cracking unit in the wireless penetration module. Enter "airmon-ngstart wlan0" in the attacker's terminal to start the wireless network card monitoring mode; enter "airdump-ng wlan0mon" in the terminal to start detecting the surrounding wireless networks, and select the BSSID value and CH value corresponding to the row with the largest PWR value; enter "airodump-ng-c CH–-bssid BSSID-w / root / Data / wlan0mon" in the terminal, and then open a new terminal and enter "aireplay-ng-03-a BSSID wlan0mon" to monitor the handshake packet of the target wireless network; enter "aircrack-ng-w / usr / share / wordlists / 1.txt / root / Data / -01.cap" in the terminal to crack the captured handshake packet. At this point, the wireless communication password of the drone cluster will be obtained;

[0049] Step 2: Execute the cluster detection module, connect to the wireless password cracked in step 1, and further execute the cluster scanning module: input "apr-scan-l>ip_add.txt" in the terminal to discover the IP survival of the cluster LAN; if the number of IPs found is less than 2, return to step 1 and reselect the wireless target network to crack the wireless target network password. If the number of IPs found is greater than or equal to 2, enter "cat ip_addresses.txt|xargs-I{}nmap-p-{}|grep'open'>open_ports.txt" in the terminal to complete the scan of all port services under all surviving IP hosts in the cluster, and classify all open ports into non-ROS service port classes; further execute the ROS node request connection module: input the "pythonnmap_scan.py" script in the terminal to identify ROS Master node, detect XML-RPC service port and verify TCPROS port, classify such ports into ROS service port class, and delete the same ports in non-ROS service port class; at this point, the service type detection of all IPs and ports within the drone cluster will be completed, and the ports will be divided into ROS service port class and non-ROS service port class;

[0050] Step 3, execute the PX4 spoofing module. When ROS is selected to cancel the node attack, combined with any port in the ROS service port class determined in step 2 and the IP to which the port belongs, start the kill_node.py script, which will be able to cancel the actual program running of the selected ROS service port; when the selected port is a ROS service port, the actual drone corresponding to the IP will hover in the air. When the port exhaustion attack is selected, combined with any port in the non-ROS service port class determined in step 2 and the IP to which the port belongs, start the exhaust.py script, which will be able to perform a port exhaustion attack on the selected port; when the selected port is a non-ROS service port, the onboard computer of the actual drone corresponding to the IP will crash, but it will not affect the original ROS program that has been started. When the wireless interference attack is selected, combined with the BSSID determined in step 1; enter "aireplay-ng-00-aBSSID" in the terminal. wlan0mon", will be able to carry out wireless interference attacks on the selected wireless target network, making the drone cluster LAN unable to communicate. When the selected BSSID is the wireless target network, the entire wireless LAN of the drone cluster will be unable to communicate, making it impossible for the drones in the drone cluster to avoid collisions. In a limited space, it may even cause collisions between drones.

[0051] In the step three, when the PX4 flight control IP determination unit is selected, combined with ip_add.txt in step two, the nmap_px4.py script is started, and the PX4 flight control IP determination of all IPs under the wireless target network will be completed; when there is an open PX4 flight control IP in the wireless target network, the port opening information under the IP can be scanned by nmap_px4.py; when the control instruction deception attack unit is selected, combined with the surviving PX4 flight control IP and open port determined in the PX4 flight control IP determination module, the command_px4.py script is started, and the control instruction deception attack can be performed on the PX4 flight control IP. When connected to the PX4 flight control IP, a drone controller will be forged and the flight control fixed-point mode switching will be executed, and the position control command will be sent, so that the connected drone is not affected by its own onboard computer trajectory planning information, and executes the relevant control instructions of the forged drone controller to fly.

[0052] In this embodiment, from the perspective of network security, attack design and security testing system construction are carried out to affect the drone cluster or individual behavior.

[0053] The contents described in the embodiments of this specification are merely an enumeration of the implementation forms of the inventive concept and are for illustrative purposes only. The protection scope of the present invention should not be considered to be limited to the specific forms described in this embodiment, and the protection scope of the present invention also extends to equivalent technical means that can be thought of by ordinary technicians in this field based on the inventive concept.

Claims

1. A drone swarm safety testing system based on cyber-physical space, characterized in that: The system comprises: Wireless penetration module, used to wirelessly crack wireless hotspots in space; Cluster detection module, used to perform cluster scanning module and ROS node connection request on the wireless network connected to; The cluster penetration module is used to conduct ROS node cancellation attacks, port exhaustion attacks, and wireless interference attacks on clusters and drones that have different application services; The PX4 spoofing module is used to determine the PX4 flight control IP of the connected drone cluster wireless LAN and execute control spoofing command attacks on the determined PX4 flight control IP.

2. The UAV swarm safety testing system based on cyber-physical space according to claim 1 is characterized in that: The wireless penetration module includes: The wireless cracking unit is used to crack the wireless password of the target hotspot in the wireless environment.

3. The UAV swarm safety testing system based on cyber-physical space according to claim 1 or 2, characterized in that: The cluster detection module comprises: Cluster scanning unit, used to scan and determine the IP survival and port services of the drone cluster; The ROS node request connection unit is used to determine the ROS node port service attributes of the drone.

4. The UAV swarm safety testing system based on cyber-physical space according to claim 1 or 2, characterized in that: The cluster penetration module includes: ROS cancel node attack unit, used to terminate the service test of drone ROS nodes; Port exhaustion attack unit, used to perform port exhaustion attack test on drone ports; Wireless interference attack unit, used to conduct communication interference attack tests on drone cluster communication hotspots.

5. The UAV swarm safety testing system based on cyber-physical space according to claim 1 or 2, characterized in that: The PX4 cheating module contains: PX4 flight control IP determination unit, used to perform IP scanning and determination on the open PX4 flight control IP in the drone cluster; The control command spoofing attack unit performs PX4 state switching and flight command spoofing attacks on the open PX4 flight control IP in the cluster.

6. A method for implementing the cyber-physical space-based drone cluster safety test system according to claim 1, characterized in that: The method comprises the following steps: Step 1. Execute the wireless cracking unit in the wireless penetration module. Enter "airmon-ng startwlan0" in the attacker's terminal to start the wireless network card monitoring mode; enter "airdump-ng wlan0mon" in the terminal to start detecting the surrounding wireless networks, and select the BSSID value and CH value corresponding to the row with the largest PWR value; enter "airodump-ng-c CH–-bssid BSSID-w / root / Data / wlan0mon" in the terminal, and then open a new terminal and enter "aireplay-ng-0 3-aBSSID wlan0mon" to monitor the handshake packet of the target wireless network; enter "aircrack-ng-w / usr / share / wordlists / 1.txt / root / Data / -01.cap" in the terminal to crack the captured handshake packet. At this point, the wireless communication password of the drone cluster will be obtained; Step 2: Execute the cluster detection module, connect to the wireless password cracked in step 1, and further execute the cluster scanning module: input "apr-scan-l>ip_add.txt" in the terminal to discover the IP survival of the cluster LAN; if the number of IPs found is less than 2, return to step 1 and reselect the wireless target network to crack the wireless target network password. If the number of IPs found is greater than or equal to 2, input "cat ip_addresses.txt|xargs-I{}nmap-p-{}|grep'open'>open_ports.txt" in the terminal to complete the scan of all port services under all surviving IP hosts in the cluster, and classify all open ports into non-ROS service port classes; further execute the ROS node request connection module: input the "pythonnmap_scan.py" script in the terminal to identify the ROS Master node, detect XML-RPC service port and verify TCPROS port, classify such ports into ROS service port class, and delete the same ports in non-ROS service port class; at this point, the service type detection of all IPs and ports within the drone cluster will be completed, and the ports will be divided into ROS service port class and non-ROS service port class; Step 3, execute the PX4 spoofing module. When ROS is selected to cancel the node attack, combined with any port in the ROS service port class determined in step 2 and the IP to which the port belongs, start the kill_node.py script, which will be able to cancel the actual program running of the selected ROS service port; when the selected port is a ROS service port, the actual drone corresponding to the IP will hover in the air. When the port exhaustion attack is selected, combined with any port in the non-ROS service port class determined in step 2 and the IP to which the port belongs, start the exhaust.py script, which will be able to perform a port exhaustion attack on the selected port; when the selected port is a non-ROS service port, the onboard computer of the actual drone corresponding to the IP will crash, but it will not affect the original ROS program that has been started. When the wireless interference attack is selected, combined with the BSSID determined in step 1; enter "aireplay-ng-00-aBSSID in the terminal wlan0mon", will be able to carry out wireless interference attacks on the selected wireless target network, making the drone cluster LAN unable to communicate. When the selected BSSID is the wireless target network, the entire wireless LAN of the drone cluster will be unable to communicate, making it impossible for the drones in the drone cluster to avoid collisions. In a limited space, it may even cause collisions between drones.

7. The method according to claim 6, characterized in that In the step three, when the PX4 flight control IP determination unit is selected, combined with ip_add.txt in step two, the nmap_px4.py script is started, and the PX4 flight control IP determination of all IPs under the wireless target network will be completed; when there is an open PX4 flight control IP in the wireless target network, the port opening information under the IP can be scanned by nmap_px4.py; when the control instruction deception attack unit is selected, combined with the surviving PX4 flight control IP and open port determined in the PX4 flight control IP determination module, the command_px4.py script is started, and the control instruction deception attack can be performed on the PX4 flight control IP. When connected to the PX4 flight control IP, a drone controller will be forged and the flight control fixed-point mode switching will be executed, and the position control command will be sent, so that the connected drone is not affected by its own onboard computer trajectory planning information, and executes the relevant control instructions of the forged drone controller to fly.

Images