Swardiantara Silalahi

Detecting abnormalities in a system using log records is a common approach, although such applications may vary between different deployment domains. For example, in drone forensics, existing studies generally consider anomalies as contradictory to normal events. In other words, all types of anomalies are considered equally important. However, the peculiar events experienced by a drone during a flight might contain distinct features indicating the anomalies’ importance or level of urgency. For instance, the message “Critically low power. Aircraft is landing” is more important than “Forward Obstacle Sensing not Working”. This study proposes DroneLog, an interpretable framework for detecting anomalies and the severity levels on drone flight logs, using a multitask learning approach in a unified pipeline. Complying with the multitask learning nature, two target label representations are designed to leverage the shared low-level common features of the input messages over various severity levels. An extensive experiment with a significant hyperparameter search space is performed to find the best-performing model to compare with several baselines and state-of-the-art methods from previous studies. The integrated gradient is employed to investigate the best-performing model’s trustworthiness and interpretability. We found that the model perceived the log messages’ semantics differently and were not aligned with how a human expert would. Therefore, DroneSBERT, a domain-specific embedding trained using contrastive learning, is proposed as a follow-up to the interpretability findings. From the experimental results, the proposed method achieves the highest performance with an improvement in accuracy and F1 scores of 5.128% and 4.453% on the unique-filtered dataset, respectively. Therefore, the proposed method accordingly addresses the task objective with a promising performance while being interpretable and trustworthy.

The availability of log data recorded by computer-based systems such as operating system and network logs, makes it possible for the stakeholder to look after the system for monitoring, evaluation, and improvement purposes. If an incident happens to the system, the log is the first and most important artefact to recover so that investigations may be performed to gather an understanding of why such incidents may have occurred. Log-based anomaly detection is one of the common approaches to uncovering incident scenarios and finding the root cause of such incidents. In the context of drone flight, incidents reported in logs include errors during take-off, flight range issues, and cancellations of actions. Existing studies employ sequence anomaly detection to check whether an event during a drone flight is anomalous. It needs several preceding events and includes deciding if the following event is legitimate or malicious. However, one single log record can have no relationship to other log events and be malicious at the same time. Thus, several studies explored point anomaly detection, where one log record is the only feature needed. Dividing the anomalies into two categories can be overwhelming as the number of logs generated by a system is large. At the same time, it can be helpful to separate critical anomalies from the less severe ones. Therefore, this study proposes DroLoVe, a severity-oriented multiclass anomaly detection approach for drone flight log data. In accordance with the dataset characteristics, where the samples from different severity levels share common features, this paper employs a multitask-based label vector representation to train deep neural network models. After an extensive experiment on several baselines, the proposed scenario outperforms other models from existing studies with promising results. The proposed representation of the label improves the prediction confidence score on various encoder types with 8.6% and 1.8% from focal and cross-entropy scenarios on average, respectively.

The increase in drone usage by the public brings the number of drone incident and attack up. Sophisticated preventive mechanisms, as well as post-incident procedures and frameworks, are needed. Forensic investigation is performed upon a drone incident, aiming to uncover the incident scenario, mitigate the risk and report the examination results. Generally, standard drone forensic procedure consists of three stages, i.e., evidence acquisition, evidence analysis, and reporting. Among the existing research, many attempts have been made in framework proposal and evaluation, study case, and tools proposal and evaluation. However, less research focuses on utilizing specific data artifacts from the drone forensic image, such as telemetry, dataflash, and flight log data. Therefore, this research aims to propose the use of log message data to infer incident-related information using a deep learning-based NLP technique, i.e., named entity recognition using Transformer. Cosine similarity is proposed as a substitute for dot-product in the self-attention mechanism of the Transformer encoder layer. Additionally, we propose NER architecture built from a mix of several existing methods and report the performance evaluation. We extract the DJI drone forensic image from a publicly available dataset using Autopsy and DJI Phantom Help and gather the decrypted log messages. Six entity types are defined after carefully reading the log message. These entity types are used in the manual annotation process using the IOB2 scheme as the label. The constructed dataset is used to evaluate the proposed model along with several baseline models. The proposed method outperforms the previous baseline model with a 91.348% F1 score. Finally, we conclude the experiment and mention several future directions.