arXiv subjects

Cihan Tunc

Publications and source records attributed to Cihan Tunc.

5 recordsLinked to original sources

arXiv2026

Federated Lightweight Intrusion Detection in Drone Swarms with Knowledge Distillation

Drone swarms are increasingly deployed in critical applications such as surveillance, disaster response, and infrastructure monitoring. However, their reliance on open communication channels and their limited computational resources make them vulnerable to a wide range of cyber-threats. There is a growing interest in intrusion detection systems (IDS) specifically designed for drone environments and operations. However, the conventional solutions including Machine Learning (ML)-based approaches require collecting all data from heterogeneous drones in the swarm and processing on a central server may not be always feasible. Federated Learning (FL) has emerged as a promising distributed solution with an additional privacy-preserving feature. Even though potential studies exist, conventional FL-based IDS frameworks still face communication and computational overhead challenges, while achieving a balance between efficiency and effective detection under practical resource constraints remains a challenge. Therefore, we propose a lightweight FL-based IDS tailored for drone swarm networks using deep neural networks (DNN) enhanced with knowledge distillation (KD) to reduce model complexity and communication costs without sacrificing detection performance. We evaluate our framework using Raspberry Pi 4 devices and a real-world drone network dataset. Our approach demonstrates a detection accuracy of approximately 98.6% while reducing overall communication cost by around 70% and computational overhead by 29%. These results show that FL combined with KD is a practical and suitable solution for secure and efficient deployment in resource-constrained drone networks.

cs.CR↗

arXiv2026

Federated Learning and LLM-Driven Threat Intelligence for Zero Trust IoT Architecture

While the Internet of Things (IoT) has become essential, they introduced serious security and privacy challenges, especially for mission-critical environments. Legacy devices are vulnerable to viruses, data breaches, and unauthorized access, and updating these devices would be infeasibly costly. As a solution, this paper presents a Federated Learning and LLM-Driven Threat Intelligence for Zero Trust IoT Architecture, with FL for anomaly detection integrating privacy-preserving distributed learning, continuous identity verification, and LLM-driven autonomous threat response into a unified pipeline. Unlike existing solutions, our framework enforces Zero Trust at every communication layer via mutual TLS (mTLS) over MQTT, ensuring no device or message is implicitly trusted. Our experiments with Raspberry Pis and various sensors achieve an F1 score of 0.9091 and an ROC-AUC of 1.0, highlighting the effectiveness of the proposed framework in enabling privacy-preserving anomaly detection for resource-constrained IoT devices.

cs.CR↗

arXiv2026

Control-Aware Manipulation of ArduPilot via Legitimate MAVLink Commands: Simulation and Hardware Validation

This paper investigates control-aware attacks against ArduPilot-based Unmanned Aerial Vehicles (UAVs), inwhich an adversary exploits the sensitivity of flight-controller dynamics to parameter changes to cause loss of control and crashes. It describes six attacks that exploit interactions among multi-layer controllers by modifying Proportional-Integral-Derivative (PID) gains, altering Extended Kalman Filter (EKF) estimation configuration, and violating failsafe assumptions, thereby forcing ArduPilot into unsafe operating conditions. We evaluate the attacks in Software-in-the-Loop (SITL) simulation and validate them on a Pixhawk 2.4.8 hardware platform. The results show that short sequences of well-formed MAVLink messages can exploit controller sensitivity to parameter values and updates frequency, affecting controller states and degrading attitude stability, angular-rate behavior, trajectory tracking, and estimator health. We demonstrate that when multiple effects are combined, the vehicle can enter an unsafe state and crashes. These findings show that security gaps in input-parameter handling, command trust, and controller-state validation can be exploited to cause loss of control and crashes in UAVs.

cs.CR↗

arXiv2025

Reverse Engineering and Control-Aware Security Analysis of the ArduPilot UAV Framework

Unmanned Aerial Vehicle (UAV) technologies are gaining high interest for many domains, which makes UAV security of utmost importance. ArduPilot is among the most widely used open-source autopilot UAV frameworks; yet, many studies demonstrate the vulnerabilities affecting such systems. Vulnerabilities within its communication subsystems (including WiFi, telemetry, or GPS) expose critical entry points, and vulnerabilities in Ardupilot can affect the control procedure. In this paper, we reconstruct the software architecture and the control models implemented by ArduPilot and then examine how these control models could potentially misused to induce malicious behaviors while relying on legitimate inputs.

cs.CR↗

arXiv2020

Video Anomaly Detection Using Pre-Trained Deep Convolutional Neural Nets and Context Mining

Anomaly detection is critically important for intelligent surveillance systems to detect in a timely manner any malicious activities. Many video anomaly detection approaches using deep learning methods focus on a single camera video stream with a fixed scenario. These deep learning methods use large-scale training data with large complexity. As a solution, in this paper, we show how to use pre-trained convolutional neural net models to perform feature extraction and context mining, and then use denoising autoencoder with relatively low model complexity to provide efficient and accurate surveillance anomaly detection, which can be useful for the resource-constrained devices such as edge devices of the Internet of Things (IoT). Our anomaly detection model makes decisions based on the high-level features derived from the selected embedded computer vision models such as object classification and object detection. Additionally, we derive contextual properties from the high-level features to further improve the performance of our video anomaly detection method. We use two UCSD datasets to demonstrate that our approach with relatively low model complexity can achieve comparable performance compared to the state-of-the-art approaches.

cs.CV↗