A Quantitative Framework for Cyber Risk Management and Mission Safety in Unmanned Aerial Systems

Authors:
Preprint
Publisher website
Google Scholar
Abstract
Commercial and recreational Unmanned Aerial Systems (UAS) have gained popularity across a wide range of applications and are anticipated to expand throughout civilian airspace. UAS are a form of cyber-physical system and are therefore susceptible to cyberattacks on their hardware, software, and communication subsystems. Left unaddressed, such attacks can trigger a functional loss such as loss of command-and-control/data link or an uncontrolled fly-away that in turn opens an accident pathway capable of causing harm to people on the ground, property, and other airspace users. Cyberattack is therefore one causation pathway among several that a UAS safety case must address, not a standalone subject assessed in isolation from mission safety. Formal risk models are needed to quantify the nature and severity of these consequences so mitigation strategies can be identified, compared, implemented, and validated. This paper develops a quantitative cyber risk management framework that traces attacks through functional loss to safety consequence across pre-flight, in-flight, and post-flight UAS mission operations. Attacks are mapped to the MITRE Common Attack Pattern Enumeration and Classification (CAPEC), and a stoplight chart method for cyber risk assessment, adapted from the safety domain, translates attack likelihood and impact into acceptability categories. The framework considers attacks, their likelihood and impact, and alternative deterrent and defensive countermeasures, and formulates a countermeasure allocation problem to compare mitigation strategies under budget constraints.

This publication has 17 references indexed in Scilit: