Counter-UAS Virtual Red Team

Anyone following recent and ongoing conflicts is probably aware of the effects of small unmanned aircraft systems (UAS) (aka drones) on warfare. If not, here's the TL;DR:  Drones are setting 20 years of conventional military thinking on its ear.

How does that affect critical infrastructure owner/operators, personal security, and other domestic security situations though? Every conflict employing drones has effectively been a live laboratory where participants iterate drone technology, tactics, techniques and procedures. The Ukraine-Russia conflict brought these laboratories to new levels due to desperation, more funding, and a better infrastructure. There was no drone stigma like that encountered in western militaries, particularly the U.S., so drone technologists have been free to innovate. That innovation does not have the typical barriers to entry of military technology and it is leaking out of the conflict zones fast. And, bad actors around the world are watching, adopting and potentially improving drone technology for their needs.

The domestic drone threat is here now.

The domestic drone threat is here now. We honestly cannot say who might be a potential user of this technology or when or where. It could be anyone from a state-supported actor to a disgruntled employee, tomorrow or never. The problem is drone technology is a force multiplier. The era of the one-man air force is upon us.

To compound the problem, drone defense, or counter-UAS, is riddled with issues: 

• Counter-UAS technology focuses almost exclusively on right of launch, that is, the time period after a drone takes off
• Uncooperative drones are difficult to detect and track
• The airspace can be saturated with legitimate airspace users, including drones
• Active effectors (i.e. radio jamming) are restricted due to regulations and safety concerns
• Live exercises are restricted due to safety

And let's be honest. There are many fly-by-night counter-UAS technology companies out there with little experience in drones or air defense. Many do not even have on-staff threat analysts. So, anyone wanting to mitigate the drone threat faces the real possibility of being mislead on capabilities only to find out the truth when that one in a million scenario finds them.

In the absence of threat intelligence, any domestic counter-UAS effort is left to focus on the drones commonly found in recreation and commercial applications. While probably an 80% solution, it usually leads to a small number of drone types, makes and models being considered. This creates a large gap which could be exploited by a bad actor.

Being a modeling & simulation (modsim) professional with a couple decades of experience in working with aerospace threats, I recognized a modsim solution may be possible to address this problem. That solution could then be used for test & evaluation, training, red teaming, etc. to simulate various types of actors and drone technologies at various levels of fidelity.  The model is called the Adversary Drone Application Model (ADAM).

If the drone gets in the air, mitigation becomes very complex

 

Like conventional security, the counter-UAS mantra is defense in depth. A good counter-UAS solution will contain multiple types of sensors to account for shortcomings in each. Where possible, it will also have several types of active and passive defenses. Again though, the problem is most counter-UAS solutions are almost exclusively right of launch, where mitigation becomes very complex. Left of launch is a much more attractive solution space since it could employ conventional law enforcement and security approaches. But how to we do that?

The key is launch and recovery sites (LRS). If we can predict the best LRS,  we can deny their use to a bad actor. Thus forcing the actor to use less favorable LRS or even selecting a different target all together. We can also extend the reach of our security system by deploying sensors to these locations.

Casual analysts would probably question its practicality. A bad actor could theoretically launch from anywhere within a 1, 2, 5, 10+ mile radius of the target these days. This is true, but a sophisticated actor will know how to filter all of those possible LRS to a handful of the best LRS. This is where ADAM comes into play. As a part of its end-to-end model, ADAM has LRS selection techniques and procedures models. When the model is applied in a constructive simulation, it becomes a powerful tool for predicting possible LRS, how an actor could get to them, and how an actor could fly a drone from the LRS to a target.

While the details cannot be shared publicly, the general process is

• Modeling: Generate models of protected asset(s), applicable Counter-UAS T-TTPs*, environment as well as tuning ADAM
• Bespoke Simulation Dev (if needed): Design, implementation, verification and validation of the simulation.

• Monte Carlo Simulation: 1000s of end-to-end mission simulations, varying key parameters

• Analysis: Post processing of simulation data and analyzing results.

• Reporting: Generation of information products for LRS, air avenues of approach, ground ingress routes as well as custom products.

* Technology, tactics, techniques and procedures

For most protected assets, I will be able to predict a set of the best

• LRS
• Ground ingress routes to the LRS
• Air avenues of approach from the LRS to the protected asset.

Using this information, you can employ conventional law enforcement and security approaches to deny LRS access to a bad actor.

The simulation can also be used to

• Find and mitigate vulnerabilities to aerial attack
• Extend the reach of counter-UAS security
• Optimize counter-UAS installations
• Explore various scenarios including black swans

• Train personnel without creating hazards for protected assets, personnel and third parties

• Produce objective data for regulators, insurers and acquisition.