Physical Intrusion Detection for Detecting Silent Devices in MIL-STD-1553

Aerospace and defense systems extensively rely on the dependability, fault tolerance, and deterministic communication of the MIL-STD-1553 data bus protocol. However, the absence of built-in cybersecurity mechanisms leaves the protocol exposed to threats such as unauthorized access, data manipulation, and eavesdropping. Traditional intrusion detection methods, which focus on communication content or transmission patterns, are ineffective against silent devices that remain passive on the bus. To address this gap, this work proposes a physical-layer intrusion detection system capable of real-time monitoring by analyzing frequency-domain signal characteristics. By continuously observing bus voltage properties, the system identifies subtle deviations linked to unauthorized device connections without requiring changes to existing hardware or software. Controlled experiments simulating silent device scenarios confirm that variations in signal behavior can reliably expose these threats-anomalies that are often overlooked by conventional context-based or hardware fingerprinting approaches.