Security Requirements Analysis of ADS-B Networks Thabet Kacem, Duminda Wijesekera, Paulo Costa Alexandre Barreto Center of Excellence in C4I Instituto de Controle do Espaço Aéreo George Mason University Centro Tecnológico da Aeronáutica Fairfax, Virginia São José dos Campos, SP - Brazil [tkacem, dwijesek, pcosta]@gmu.edu barretoabb@icea.gov.br Abstract— Due to their many advantages over their hardware- Francillon [4] and Schäfer et al. [5], who described the based counterparts, Software Defined Radios are becoming the possibility of eavesdropping, man-in-the-middle and denial of new paradigm for radio and radar applications. In particular, service attacks in simulated environments. Automatic Dependent Surveillance-Broadcast (ADS-B) is an emerging software defined radar technology, which has been Unfortunately, most research efforts aimed at detecting and already deployed in Europe and Australia. Deployment in the US mitigating ADS-B vulnerabilities lack a systems engineering is underway as part of the Next Generation Transportation methodology, therefore failing to address the problem from a Systems (NextGen). In spite of its several benefits, this technology holistic perspective. For instance, many lack a comprehensive has been widely criticized for being designed without security in approach to perform attack analysis and mitigation, and assess mind, making it vulnerable to numerous attacks. Most their impact on applications of ADS-B technology, which we approaches addressing this issue fail to adopt a holistic propose in this paper. Conversely, system engineering viewpoint, focusing only on part of the problem. In this paper, we techniques such as use cases and interaction diagrams have propose a methodology that uses semantic technologies to address been widely used in other domains to model the system’s the security requirements definition from a systemic perspective. behavior and its interaction with users, which is done from the More specifically, knowledge engineering focused on misuse early designing steps in the system lifecycle. scenarios is applied for building customized resilient software defined radar applications, as well as classifying cyber attack Misuse cases [6] extend the concept of use case severity according to measurable security metrics. We showcase development to model potential undesirable behaviors. The our ideas using an ADS-B-related scenario developed to evaluate technique has been gaining popularity in recent years as a our research. means to enhance system security, by modeling undesirable behaviors, ensuring these are addressed during systems design. Keywords— Ontologies, Misuse case, Cybersecurity, ADS-B Misuse cases represent the threats to a system at a high level perspective, while the step-by-step details are represented using I. INTRODUCTION mal-activity diagrams. The latter is key for devising ways of Since first proposed in 1991 by Joe Mitola [1], the concept thwarting attacks, but both are essential for designing resilient of Software Defined Radio (SDR) has received considerable systems. research interest. The idea of migrating hardware-based radio functionality to software and, among other benefits, Another important technology for designing systems is dynamically optimize the spectrum use is compelling. Not Ontology engineering. Ontologies represent knowledge within surprisingly, the concept is now applied to applications whose a specific domain by formally describing its key concepts and focus spans from cognitive radios to radar applications. the relationships among them. They allow for automated knowledge management and discovery via logical inferences In particular, Air Traffic Control (ATC) systems research and have been applied to a variety of applications, such as became a natural area for SDRs, due to a pressing need for health care and artificial intelligence. Yet, there has been a modernizing its current standards, most stemming from the surprising lack of research in the ontology community for 1970s. In this context, Automatic Dependent Surveillance- designing secure SDR applications, and only a few have been Broadcast (ADS-B) has emerged as the leading technology for proposing to leverage ontologies in this area (e.g. [7]). radar surveillance, and has been already deployed in Europe, Canada and Australia. The U. S. Federal Aviation Our work bridges this gap by proposing a new Administration plans to have it deployed by 2020 as part of methodology for building resilient SDR applications that relies NextGen [2]. Most aircraft manufacturers are already on ontologies. We leverage their reasoning capabilities to equipping their newest models with ADS-B, which is present automate the modeling of use cases, misuse cases, mal-activity in aircraft such as the Boeing 777 and the Airbus A380. diagrams, mitigation case diagrams and mitigation activity diagrams, all within the design phase of the radar application in In spite of its success, ADS-B has several critics. question. We present the approach in this paper, and Strohmeier et al. [3] point out the huge lack of security caused contextualize our ideas using an ADS-B ATC scenario. by the fact that ADS-B sends its packets in clear text, making it vulnerable to attacks that target the confidentiality, integrity, Our methodology brings three main contributions to the availability and non-repudiation properties of the data. This design of secure ADS-B systems. First, we applied semantic concern is consistent with research done by Costin and technologies in support to security and requirements modeling, 40 formalizing knowledge relevant to SDR systems for building than the incoming reflected pulses, radar circuitry is extremely resilient radar networks. To the best of our knowledge, this is complex. ADS-B also has an advantage over Secondary the first approach to do so. Other research efforts that leveraged Surveillance Radars (SSR), which relies on aircraft-borne security ontologies either focused on security in general, such transponders to transmit their positions. Unlike ADS-B, SSR as [8], or on a specific domain, such as [9]. The work in this must rely on cooperation by pilots and – mostly for that reason paper formalizes the knowledge of secure ADS-B systems in a - its operation tends to be error-prone. way that can be extended to other SDR applications. In spite of these advantages, ADS-B has its own share of The second major contribution of this paper is the limitations due to its vulnerability to cyber attacks. Several application of inferential reasoning to enhance security-related publications on ADS-B security (e.g. [4], [5] and [14]) used a design activities. Examples include automated verification of simulated environment to demonstrate various types of attacks whether the mal-activity and mitigation activity diagrams are targeting this technology, mostly using low cost equipment. consistent with misuse case and mitigation case diagrams The primary source of vulnerability is that data is sent in clear respectively, and checking whether the mitigation techniques text, without authentication or encryption. Some of the ADS-B can effectively thwart the potential attacks. In this initial work, attacks demonstrated in simulated environments are: we used Protégé [10] to develop our ontology and the Pellet reasoner [11] to support the automated verification. x Eavesdropping: performed with low cost radio devices operating at 1090 MHz combined with an open source The third major contribution of our paper is the implementation of ADS-B receiver. Basically, one can development of measurable security metrics to classify the eavesdrop on all air traffic within the range of the radio detected attacks according to a taxonomy that we also define in device. Although eavesdropping is technically not an this paper. We use the work in [12] as a reference when attack by itself, it is a prerequisite step for many others. developing the metrics we defined for ADS-B applications. x Injection Attacks: performed by an attacker that emits The rest of the paper is organized as follows. Section II ADS-B messages referencing a fake aircraft (i.e. presents background information about ADS-B and enumerates “injects”  a  fake  aircraft)  that interacts with the trajectory some of the security issues discussed in the literature. Section of a real aircraft, forcing its pilot and the ATC services III describes our methodology. Section IV illustrates the use of to adopt unintended actions to avoid collisions. These our methodology by presenting an application scenario. In attacks usually rely on a preceding eavesdropping phase Section V, we show how to classify the detected attacks using for capturing the required parameters. ontological rules and security metrics. Section VI describes related work in securing ADS-B applications, misuse cases, x Denial of Service: these are basically   a   “brute   force”   and mal-activities in security-related operations. Section VII version of injection attacks, if less elaborate. The idea is has our conclusions. to insert a large number of fake aircrafts to the  ATC’s   screen, causing a denial of service. Air traffic II. BACKGROUND controllers will not be able to distinguish fake aircraft One of the main contributions of ADS-B to ATC is its from real ones, or to prevent system crashes due to the ability to provide better coverage, flexibility, cost- heavy load. effectiveness, and simplicity than traditional radar. Further, x Man in the middle: these can be variations of the ADS-B can either extend radar coverage or provide a similar above, but with a person in the control of the attack. It is service in locations without radar coverage - such as oceanic possible for an attacker to intercept live traffic, store routes. It also reduces cockpit activity, since pilots would not ADS-B packets, modify them and retransmit the need to provide constant updates. The costs involved in tampered ones back to create confusion in air traffic deploying and operating an ADS-B station are much lower control operations. than those observed in traditional radar stations [13]. III. METHODOLOGY The ADS-B protocol has two modes of operation: ADS-B Out and ADS-B In. The first broadcasts aircraft position along The main goal of our work is to help the software architect with other data over the 1090MHz frequency band for in designing the core system components with security as a commercial flights and 948MHz band for general aviation. first class citizen, instead of an afterthought. A key concept is ADS-B packets are encapsulated in Mode S Extended Squitter our reliance on ontologies to provide the ADS-B system frames consisting of an 8 bits preamble used for designer with an automated way of testing the security features synchronization and a 56 or 112 bits data block containing the in a cohesive fashion. We adopted Protégé [10] in this research ADS-B data. It is modulated via Pulse Position Modulation due to its popularity and built-in reasoners, such as Pellet [11] (PPM) at 1 Mbit per second rate. ADS-B In receives broadcasts - which we use to verify the correctness of the attack mitigation from nearby aircraft. This feature is mostly used by ATC techniques. Figure 1 shows a high-level view of our services so its deployment is not mandatory to aircraft. methodology, and highlights the input it requires from the systems engineer. More specifically : ADS-B presents considerable advances when compared to Primary Surveillance Radar (PSR), which determines the x Use case diagrams: system functionalities. approximate aircraft position by measuring the time a reflected x Misuse case diagrams: undesired functionalities. pulse takes to reach back to its originating radar antenna. Because the emitted pulse is many orders of magnitude greater 41 evaluates pre-defined security constraints, such as separation between helicopters. x Telecommunication Sites: the scenario includes three (named T1, T2 and T3), which convey location updates to the ATC server and broadcast navigation instructions to helicopters using ADS-B stations. x ADS-B Stations: each of the five stations (s1 to s5) receives ADS-B packets from helicopters, broadcasts these to the telecommunication site it is connected to, and forwards navigation instructions to the pilots. x Communication Links: transmit data between the ATC server, ADS- B stations and telecommunication sites. Figure 1: High level view of the methodology Our scenario leverages work such as Magazu [14] shows that attacking ADS-B networks can be relatively simple and x Mal-activity diagrams: sequence of actions refining a inexpensive by purchasing a basic radio device (even a Misuse case. computer dongle) and using open source software such as x Mitigation case diagrams: counteractive functionalities GNU Radio [15] and Gr-Air-Modes [16] as an ADS-B that detect or mitigate undesired functionalities. receiver. In the scenario, the attacker can: x Mitigation activity diagrams: sequence of actions that x Tamper position: The attacker receives location refine a Mitigating use case. updates from a legitimate helicopter using an ADS-B receiver placed within the transmission range. Then, x Base ontology: Models classes, their relationships, and modifies ADS-B packets by either altering the properties of the SDR domain. hexadecimal content or by inserting GPS coordinates Figure 2 shows the main concepts we have included in the into the packet that may be inconsistent with the logical flight path. base ontology. Our methodology precisely defines the meaning   of   “security”   by   specifying   security   in   terms   of   x Create a ghost helicopter: The attacker introduces a desired and undesired system behavior. The proposed design new helicopter in the range of an ADS-B station so that process involves supporting the system designer to model the it gets propagated to the ATC center, and consequently required and undesirable system functionalities using the alters flight paths of legitimate helicopters. That is, if classes, inter-class and intra-class relationships, and properties the fake trajectory interferes with the real aircraft, this of the base ontology to produce the input listed in Figure 1. will force active interference by the flight controllers. Logical reasoning is used in the process to ensure that the x Flood an ADS-B station: The attacker overwhelms an design entails the desired and undesired system properties, ADS-B station with fake packets, affecting the control empowering the design team with an automated verification of of helicopters within range of that station. That is, a the fact that their design is compliant with the design’s   security objectives (i.e. design by contract). The process outcomes can also be used as formal, accountable artifacts that can be independently verified. IV. EVALUATION To evaluate if our ideas would result in a more secure ADS-B network, we have designed an ATC scenario and developed an ADS-B application for this scenario using the proposed methodology. Our scenario includes a network topology consisting of the following components: x Helicopters: the scenario focus on a helicopter operation that is supported by an ADS-B network. x ATC Center: one main ATC Terminal receives aircraft track information from a radar and an ADS-B server to provide navigation instructions to the helicopters. x ATC server: receives location updates from the remotely connected telecommunication sites and ADS- B stations. It stores the updates in a database and Figure 2: Base Ontology 42 Denial-of-Service attack. x Comm Link 1 lane: oval  “Transmit”  indicates how the data inside the packet is physically transmitted. This x Flood ATC/RADAR: similar to the previous attack but activity  is  part  of  “Transmit  data”  use  case.   this is done at a larger scale to overwhelm many or all ADS-B stations. If successful, this would adversely x ATC Server: oval  “Receive”  designates that the ADS-B affect regional air traffic. packets   are   received.   However,   oval   “Check   Hash”   represents a mitigation activity as part of “Check  Hash”   The following mitigations are viable against these attacks: mitigation case. It indicates that the ATC server checks x Check Hash: Embed a hash of the ADS-B payload in the received hash against the hash it computes based on the packet to preserve data integrity using pre-shared the payload of the received packet. The diamond hashing metadata. indicates a decision node. Based on the outcome of the x Rate Limiting: Rate control the packets received from computation of the above described condition, the ATC communication links of the ADS-B stations. server directs the flow of the whole scenario accordingly. If the result is a mismatch, then it connects The core functionalities of the application are represented to   the   oval   “Discard”   which   is   a   normal activity with use cases. The attacks to be prevented during the design indicating that the ATC server would just ignore the phase are represented using misuse cases, and counteraction packet before ending the scenario by connecting to the techniques are represented using mitigation cases. Taken double-edged black circle. together, these represent the high-level security objectives of the system. x ATC Center lane: if the result of the previous decision is a match, the oval   “Display   air   traffic” will be To achieve security design objectives, our methodology connected. This oval is part  of  “Display  air  traffic”  use   requires more detail from the system architect, who has to case”. Similarly, the scenario would end at this point by define diagrams conveying the activities, mal-activities, and connecting to the double-edged black circle. mitigation activities – all consistent with contemporary design activities for large-scale resilient systems. Figure 3 illustrates All the elements of Figure 3 can be mapped to the base the combined view of these diagrams. In the figure, every lane ontology classes where, each lane is an individual of the is annotated with a name of an actor and the actions. Black Swimlane class and every label has the actor’s  name. However, ovals indicate mal-activities while white ovals indicate normal this mapping depends on the characteristics of each sub-class or mitigation activities. To facilitate understanding for the of Actor. More specifically: methodology, we now provide an overview of each lane: x Helicopter and Attacker: mapped to the Helicopter x Helicopter lane: the black-filled circle designate the class. start of the “Broadcast   location”   usage   scenario. Ovals x ADS-B station 2: mapped to the ADS-B_Station class. “Get   self   location”   and   “Broadcast   location” designate the two activities that are responsible, respectively, for x The black-filled circle: mapped to an individual of the getting the location of the helicopter and sending it via Initial_Node class ADS-B Out. The black rectangle indicates a fork node. It models how location data is broadcasted to all nearby x Double-edged black circle: mapped to an individual of helicopters. the Final_Node class. x Attacker lane: the three back ovals show how the x Black rectangles: can be mapped to either the misuse   case   “Tamper   position”   works. Oval “Receive   Join_Node class or the Fork_Node class, depending on location”   indicates that the attacker received the the incoming and outgoing arrows. This is modelled by location update from the legitimate helicopter. Oval ontological restrictions linking each member of this “Tamper   location”   describes how the attacker crafts class to the number of instance of the Node class fake location inside the ADS-B  packet  while  oval  “Send   connected to it. fake  location”  broadcasts  the  altered  packet  back  to  the   x White ovals: indicate a normal activity and are nearby ADS-B stations. x ADS-B Station 2 lane: the black rectangle indicates a join node showing how the ADS-B station receives location updates from the helicopter and the attacker. The two ovals “Receive  location”  and  “Send  location”   in this lane are  two  activities  as  part  of  “Replay  Data”   use case. x Telecom Site 1 lane: the  two  ovals  “Receive   location”   and  “Send  location”  are  also  part  of  “Replay  Data”  use   case and show how the ADS-B packets are replayed through the telecom sites. Figure 3: Combined view of activity, mal-activity and mitigation activity diagrams 43 considered individuals of the Normal_Activity_Node, while those indicating a mitigation activity are considered individuals of the Mitigation_Activity_Node. x Black ovals: are individuals of the Mal-Activity_Node. Arrows connecting the elements described above are mapped to object properties that relate two instances of two different classes. In our work, this is done using (Protégé) ontology rules, previously known as Semantic Web Rule Language (SWRL) rules [17]. Each rule implies the consequent (right hand side, a.k.a. head) from the antecedent (left hand side, a.k.a. body). Let S be the statement of Theorem 1, described in Listing 1. It shows a rule that models the fact that “tamper location”   misuse  case  “threatens”  the  “monitor  air  traffic”  use  case.  The   rule is   part   of   the   “threatens”   use   case / misuse case relationship in the scenario where every helicopter sends an ADS-B packet containing the required information. Each packet has a location defined as {latitude, longitude, altitude}. When two packets sent from two different helicopters reach the ATC Server, the server compares their timestamps and their locations. If the timestamps are the same and the differences in the received longitudes, latitudes, and altitudes Listing 2 are greater than the predefined H, then the reasoner will infer the   “threatens”   object   property.   The Pellet reasoner then the names of the mal-activities associated with the attack. gathers the data and object properties of the individuals concerned by the defined rule, and tries to infer the head - in The main idea here is that if the ATC Server receives a this case the “threatens”  object  property.  If it succeeds in doing packet from a helicopter, then it computes its corresponding “threatens”   will appear as highlighted and we can get the hash based on the packet’s  payload  and  compares  it to the hash corresponding explanation. received in the packet. We assume that the ADS-B packet contains a hash in its payload. If these values match, then the Let  ψ  be  the  statement  of  Theorem 2 provided in Listing 2. ATC Server proceeds with broadcasting the packet. Otherwise, It shows the rule proving that the mitigation case succeeds in it marks the helicopter that sent the forged packet as malicious thwarting the previously detected misuse case that threatens a and   the   “mitigates”   object   property   is   proven   to   be   valid.   In   given use case of the system. It also tags the actor in question order to prove this theorem, the Pellet reasoner checks the data as malicious, and associates the attack with its swimlane (cf. and object properties of the individuals concerned by this rule Figure 3). Therefore tagging the associated object properties as and tries to infer the head of the rule. In this case, if it succeeds in doing so, the object relations in the head appear as highlighted and we can get the explanation of the proof. V. CLASSIFICATION OF ATTACKS USING METRICS In this section, we describe the taxonomy we have developed for the message injection ADS-B attacks. It is composed by three classes of attacks, classified based on the difficulty of implementation and the location of the radio device that was used by the attacker. These classes are as follows: x Medium-level attacks: in this type of attacks, the attacker generates the malicious ADS-B messages to be injected in a typically random way and he does not move the equipment used to launch the attack. For instance, the attacker can send a massive amount of ADS-B messages whose locations are within the reach of the ATC Sever with fake aircraft identifier in order to obstruct the view of the radar display and thus prevent the air traffic controller from performing his duties. Listing 1 44 x Advanced-level attacks: where an attacker uses are equal to zero. The estimated-to-real difference sophisticated flight simulator programs along with the would be within the predefined thresholds. radio device in order to send a more realistic flight path x Expert-level attacks: An attack belongs to this class if that cannot be detected as fake easily. For example, one the velocity is comparable to the one of a real aircraft. popular program that can be used to achieve this is Besides, the sender location difference cannot be equal FlightGear [18]. In this case, the location of the to zero, and the estimated-to-real difference has to be equipment used to perform the attack is fixed. within the predefined thresholds. x Expert-level attacks: similar to the advanced-level We now focus on how the proofs of the theorems are attacks, except for the fact that the equipment used to generated using ontological rules, similarly to the previous launch the attack is located in an aircraft. This kind of section of this paper. Due to space limitations, we restrict the attack is harder to test, since it requires sophisticated explanation to the ontological rules used for computing the equipment and procedures. estimated-to-real difference metric, and for classifying an attack as belonging to medium-level attacks class respectively Classifying attacks detected using the techniques described in Listings 3 and 4. in the previous section requires collecting parameters, needed for deciding if an attack belongs to a particular attack class In Listing 3, we collect GPS properties of the malicious modelled in an ontology rule. We leveraged the work in [12], a actor, after verifying that the packet he sent had reached the well-known standard that provided us with a reference for ATC Server. Then, we compute the properties of the estimated- checking under which category our metrics fell into. We to-real metric relatively to longitude, latitude and altitude. defined three security metrics, which are described as follows: In Listing 4, we collect the data provided by all the metrics x Sender Location Difference: the absolute value of the and define the conditions for deciding whether an observed difference between the triangulated  sender’s  location  at   attack belongs to the medium-level attacks class. two consecutive times ti and tj. We assumed having We had to make several assumptions regarding the metrics. appropriated means of triangulation, which is needed Firstly, we assumed that there is a mechanism to triangulate the for determining the location of the sender based on the true location of the sender of the packet, which would facilitate received ADS-B packet. This metric is broken down computing its location difference metric. Secondly, we into three sub-metrics which correspond to the assumed that it is possible to estimate the location of an aircraft differences between longitudes, latitudes, and altitudes. at all times, which is required for computing the estimated-to- x Velocity: which is the speed of the aircraft at a time t. real difference metric. x Estimated-to-Real Difference: which is the absolute For each metric used in this evaluation we have written a value of the difference between the estimated location corresponding rule that the Pellet reasoner can use against the of an aircraft and the location retrieved from the ADS-B defined individuals to determine its value. The first rule is packet at time t. We assumed the capability of related to the sender location difference metric. Basically, it estimating aircraft locations at all times. This metric is gets the triangulated sender locations at two consecutive time also composed by three sub-metrics, corresponding to steps and calculates the absolute value of the difference of difference of longitudes, latitudes and altitudes. altitude, latitude and longitude. The second rule addresses the velocity metric, and extracts its value at a certain time by using After careful consideration, we came to a conclusion that the ADSBPacket and TimedRelation entities. The third rule, these three defined metrics fell under the Cyber Intelligence Threat Analysis category. After all, these metrics collect practical data about the attacks, and allow the security analyst to classify cyber attacks based on patterns of wrong behavior. In our methodology, these metrics are used by the Pellet reasoner to automatically classify the type of attack. The relationships between the described classes of attacks and the security metrics are described as follows: x Medium-level attacks: an attack belongs to this class if the sender location difference and the velocity are equal to zero. An attacker, whose physical location does not change, is of course very likely to have such characteristics. Further, the estimated-to-real difference has to be greater than a predefined threshold for the longitude, latitude and altitude. Consequently, if the location retrieved from the ADS-B packet is not within the aircraft envelope, then such packet most likely comes from an attacker. x Advanced-level attacks: An attack belongs to this Listing 3 class if the sender location difference and the velocity 45 problem of security within the SDR domain by leveraging knowledge from semantic models and ontologies. In [9], Ekelhart et al. introduced a framework for building security ontologies that assists in providing risk analysis. The authors used an incremental approach where they start with a generic security taxonomy formalized in an ontology and they enhance it by integrating risk factors, constraints, threats and countermeasures. This work concentrates on risk management involving IT-security tasks in a company, while our goal is to create a methodology to secure ADS-B networks. In [20], Magklaras and Furnell proposed an approach to address internal IT misuse via a classification of misusers and Listing 4 their motives, as well as the implications of the misuse on the which deals with the estimated-to-real difference, gets the system. In our paper, we adopted a more flexible representation coordinates of both the estimated position and the real position of misuses, which relies on misuse case and mal-activity before calculating the absolute value of the difference in terms diagrams. Moreover, their work describes security in general of latitude, longitude and altitude. while ours focuses on security in ADS-B networks. The authors provided a mechanism of determining the threat level The knowledge derived from these rules can provide that is similar to our work, in which we classify the attacks reasonable insights into attack classification. We developed according to the taxonomy. The main difference is that we different rules to classify an attack according to its category in employ theorem proving with a semantic-web inspired rule the taxonomy. For example, an attack that belongs to the system, while their work is based on an analyzer module built medium-level category would have a null velocity, a null as part of their proposed framework. sender location difference, and its estimated-to-real metric would exceed the defined threshold. Conversely, the advanced- In [21], McCallie et al. assessed ADS-B security by level category would have its attacks with a null velocity and a detecting and classifying attacks that may target ADS-B null sender location difference, but its estimated-to real metric applications. They provide some general recommendations on would not exceed the defined threshold. This is expected, given how to thwart these attacks. In contrast, we provide a the use of flight simulator versus generating random values in methodology to be applied when analyzing the security of SDR the medium-level category. Finally, an attack would be in the applications. expert-level category if the velocity is comparable to a real Similarly, Costin and Francillon [4] demonstrated the lack aircraft, while its sender location difference would be greater of security of ADS-B by implementing attacks in a low-cost than zero and its estimated-to-real metric would not exceed the simulated environment. They did not focus on attack pre-defined threshold. mitigation. In contrast, our methodology assists the systems engineer in formulating security requirements by precisely VI. RELATED WORK defining and verifying these for SDR applications, while using In [7], Massacci et al. proposed an ontology for security automated design verification for attacks and their mitigations. requirements by extending existing ontologies with situational In [22], Whittle et al. proposed a technique for modeling and context awareness. The authors contextualize their ideas by possible attacks and mitigating them. They employ misuse an ADS-B case study. This work is similar to ours but the main cases to model undesirable system behavior. The approach difference is that they focused on GPS spoofing attacks, while models misuse cases as aspects, inserts these in the core system we address message-injection attacks that are more difficult to features before integrating mitigation techniques. Then, they realize, as stated by [3]. use the attacks as test cases to evaluate the design robustness. Oltramari et al. [19] described an approach to support cyber Although our objective is similar to theirs, but we base our operations by enhancing the situational awareness via a methodology on ontologies to support the system design from combination of cognitive modelling and ontology engineering. the ground up with security as an integral design aspect. In They plan to evaluate their approach by applying it to design a contrast, they use prior work on state machines. cyber defense application. However, their work is not specific In [23], Sindre introduced the concept of mal-activity to SDR applications, but to cyber operations in general. diagrams as an enhanced form of activity diagrams where each In [8], Obrst et al. presented a methodology for building actor of the system, normal or malicious, occupies a swimlane cyber security ontologies based on a malware ontology. This and starts normal or malicious activity nodes. Our approach methodology outlines the steps that are required for building a uses the concept of a mal-activity diagram and integrates it in cyber security ontology, and provide general guidelines for the design process with the support of ontologies. enhancing the cyber security domain with semantic models. In [24], El-Attar presented a tool to convert a textual The main difference between this work and ours is their focus description of the system to a model taking into consideration on security from a general standpoint, starting from a wide the security aspects in term of misuse case and mal-activity characterization of malware. In our paper, we tackle the diagram. This is achieved with support from two tools. One transforms the textual description to a context-free grammar, 46 which is used to build the first meta-model. The other creates [9] A.   Ekelhart,   S.   Fenz,   M.   Klemen,   and   E.   Weippl,   “Security   the meta-model that captures the mal-activity diagrams. This Ontologies:   Improving   Quantitative   Risk   Analysis,”   presented   at   the   40th Annual Hawaii International Conference on System Sciences, work appears similar to ours, but El-Attar’s   main   goal   is   to   2007. HICSS 2007, 2007, p. 156a–156a. create meta-models from textual description. In contrast, we [10] H.  Knublauch,  R.  W.  Fergerson,  N.  F.  Noy,  and  M.  A.  Musen,  “The   formally capture the diagrams using ontological rules and Protégé OWL Plugin: An Open Development Environment for verify that the stated relationships between them exist using a Semantic  Web  Applications,”  in  The Semantic Web – ISWC 2004, S. theorem prover. A. McIlraith, D. Plexousakis, and F. van Harmelen, Eds. Springer Berlin Heidelberg, 2004, pp. 229–243. VII. CONCLUSION [11] E.  Sirin,  B.  Parsia,  B.  C.  Grau,  A.  Kalyanpur,  and  Y.  Katz,  “Pellet:  A   practical OWL-DL   reasoner,”   Web Semantics: Science, Services and ADS-B has emerged as a promising technology for Agents on the World Wide Web, vol. 5, no. 2, pp. 51–53, Jun. 2007. optimizing the use of the air space while lowering costs and [12] “MITRE’s   Making   Security   Measurable,”   MITRE’s   Making   Security   increasing the security of air traffic operations. Hindering this Measurable. Available: http://makingsecuritymeasurable.mitre.org/. [13] “ADS-B  Frequently  Asked  Questions  (FAQs),”  07-Apr-2014. progress, many security vulnerabilities in the protocol have Available at: been discovered, generating a pressing need for a holistic, http://www.faa.gov/nextgen/implementation/programs/adsb/faq/#3. systems-oriented approach to properly address the problem. [14] D.   Magazu   III,   “Exploiting   the   Automatic   Dependent   Surveillance- Within this context, in this paper we present a methodology Broadcast  System  via  False  Target  Injection,”  2012. that relies on time-tested, traditional requirements engineering [15] GNU Radio. Available at www.gnuradio.org. [16] N.   Foster,   “Gr-air-modes,”   Available:   while leveraging advanced semantic technology concepts to https://github.com/bistromath/gr-air-modes. automate the process of requirement verification. We have [17] I. Horrocks, P. Patel-Schneider, H. Boley, S. Tabet, B. Grosof, and M. tested the methodology in an ADS-B scenario, and were able to Dean,   “SWRL:   A   Semantic   Web   Rule   Language   Combining   OWL   support the system design by translating security requirements and  RuleML,”  May  2004. into formally verifiable claims. Finally, we used logical [18] “FlightGear.”  Available:  www.flightGear.com. [19] A. Oltramari,  C.  Lebiere,  W.  Zhu,  L.  Vizenor,  and  R.  Dipert,  “owards   reasoning to ascertain the validity of the mitigating solutions a   Cognitive   System   for   Decision   Support   in   Cyber   Operations,”   and classify the attacks using security metrics. presented at the International Conference on Semantic Technologies for Intelligence, Defense, and Security (STIDS), 2013. We plan to further evaluate the methodology in complex [20] G.   B.   Magklaras   and   S.  M.   Furnell,   “Insider   Threat   Prediction   Tool:   simulation environments that will provide a better Evaluating  the  probability  of  IT  misuse,”  Computers & Security, vol. understanding of its broader impact in designing resilient SDR 21, no. 1, pp. 62–73, Jan. 2001. applications. Future work on the methodology also involves [21] D.  McCallie,  J.  Butts,  and  R.  Mills,  “Security  analysis  of  the  ADS-B standardizing its procedures, so they would be applicable to the implementation   in   the   next   generation   air   transportation   system,”   field of SDR applications in a consistent fashion. In this paper International Journal of Critical Infrastructure Protection, vol. 4, no. 2, pp. 78–87, Aug. 2011. we have focused on the initial phases of the system engineering [22] J.  Whittle,  D.  Wijesekera,  and  M.  Hartong,  “Executable  misuse  cases   life-cycle, but the methodology can be easily expanded to for modeling security concerns,”   presented   at   the   ACM/IEEE   30th   formalize and automate other parts of the systems engineering International   Conference   on   Software   Engineering,   2008.   ICSE     ’08,   life cycle. Examples of the latter include supporting trade-off 2008, pp. 121–130. analysis of adding security features against their associated [23] G.  Sindre,  “Mal-Activity Diagrams for Capturing Attacks on Business Processes,”   in   Requirements Engineering: Foundation for Software cost, validation and verification of the actual system based on Quality, P. Sawyer, B. Paech, and P. Heymans, Eds. Springer Berlin stakeholder requirements (e.g. FAA specs for different types of Heidelberg, 2007, pp. 355–366. systems), and others that would benefit from the formalization [24] M. El-Attar,   “From   misuse   cases   to   mal-activity diagrams: bridging of the design process with a focus on its security requirements. the   gap   between   functional   security   analysis   and   design,”   Software Systems Modelling, vol. 13, no. 1, pp. 173–190, Feb. 2014. REFERENCES [1] J.   Mitola,   “The   software   radio   architecture,”   IEEE Communications Magazine, vol. 33, no. 5, pp. 26–38, May 1995. [2] “NASA  - NextGen,”  24-Oct-2014. Available at: http://www.hq.nasa.gov/office/aero/asp/airspace/index.htm. [3] M.  Strohmeier,  V.  Lenders,  and  I.  Martinovic,  “On  the  Security  of  the   Automatic Dependent Surveillance-Broadcast   Protocol,”   arXiv:1307.3664 [cs], Jul. 2013. [4] A.  Costin  and  A.  Francillon,  “Ghost  in the Air(Traffic): On insecurity of ADS-B protocol and practical attacks on ADS-B  devices,”  2012. [5] M.  Schäfer,  V.  Lenders,  and  I.  Martinovic,  “Experimental  Analysis  of   Attacks  on  Next  Generation  Air  Traffic  Communication,”  in   Applied Cryptography and Network Security, Springer Berlin Heidelberg, 2013, pp. 253–271. [6] G.   Sindre   and   A.   L.   Opdahl,   “Eliciting   security   requirements   with   misuse  cases,”  Requirements Eng, vol. 10, no. 1, pp. 34–44, Jan. 2005. [7] F. Massacci, J. Mylopoulos, F. Paci, T. T. Tun, and   Y.   Yu,   “An   Extended   Ontology   for   Security   Requirements,”   in   Advanced Information Systems Engineering Workshops, C. Salinesi and O. Pastor, Eds. Springer Berlin Heidelberg, 2011, pp. 622–636. [8] L. Obrst, P. Chase, and R. Markeloff, Developing an Ontology of the Cyber Security Domain. . 47