# A Survey on Security and Privacy Issues of UAVs

Yassine Mekdad, Ahmet Aris, Leonardo Babun, Abdeslam EL Fergougui, Mauro
Conti, Riccardo Lazzeretti, and A. Selcuk Uluagac  Y. Mekdad and A. El
Fergougui are with the Laboratory of Computer Networks and Systems, Moulay
Ismail University of Meknes, 11201, Zitoune, Meknes, Morocco (e-mail:
<EMAIL_ADDRESS>a.elfergougui@umi.ac.ma). A. Aris, L. Babun, and A.
Selcuk Uluagac are with the Cyber-Physical Systems Security Lab, Department of
Electrical and Computer Engineering, Florida International University, Miami,
FL 33174 USA (e-mail<EMAIL_ADDRESS><EMAIL_ADDRESS>suluagac@fiu.edu). M.
Conti is with the Department of Mathematics, University of Padua, 35121,
Padua, Italy (e-mail: conti@math.unipd.it). Riccardo Lazzeretti is with the
Department of Computer, Control, and Management Engineering "Antonio Ruberti",
Sapienza University of Rome, 00185 Rome, Italy (e-mail:
lazzeretti@diag.uniroma1.it).

###### Abstract

In the 21st century, the industry of drones, also known as Unmanned Aerial
Vehicles (UAVs), has witnessed a rapid increase with its large number of
airspace users. The tremendous benefits of this technology in civilian
applications such as hostage rescue and parcel delivery will integrate smart
cities in the future. Nowadays, the affordability of commercial drones expands
its usage at a large scale. However, the development of drone technology is
associated with vulnerabilities and threats due to the lack of efficient
security implementations. Moreover, the complexity of UAVs in software and
hardware triggers potential security and privacy issues. Thus, posing
significant challenges for the industry, academia, and governments.

In this paper, we extensively survey the security and privacy issues of UAVs
by providing a systematic classification at four levels: Hardware-level,
Software-level, Communication-level, and Sensor-level. In particular, for each
level, we thoroughly investigate (1) common vulnerabilities affecting UAVs for
potential attacks from malicious actors, (2) existing threats that are
jeopardizing the civilian application of UAVs, (3) active and passive attacks
performed by the adversaries to compromise the security and privacy of UAVs,
(4) possible countermeasures and mitigation techniques to protect UAVs from
such malicious activities. In addition, we summarize the takeaways that
highlight lessons learned about UAVs’ security and privacy issues. Finally, we
conclude our survey by presenting the critical pitfalls and suggesting
promising future research directions for security and privacy of UAVs.

###### Index Terms:

Unmanned Aerial Vehicles, UAVs, security, privacy, drones.

##  I Introduction

In the past decades, the Unmanned Aerial Vehicles (UAVs) global market has
meaningfully increased and gained more attention from governments and
commercial industries due to its wide civilian and military applications such
as traffic monitoring, search-and-rescue operations, surveillance, and
biochemical sensing [1, 2, 3]. Currently, there is a socio-technical debate
about the use of UAVs for passenger transportation, so-called "air taxis" that
will replace commercial helicopters because of their electric Vertical Takeoff
and Landing (eVTOL) capabilities [4]. A recent report shows that the
commercial drone market revenue forecast will reach 129.33 billion dollars by
2025 [5]. According to the Federal Aviation Administration (FAA), the size of
the commercial drone market could triple by 2023 [6]. Thus, the introduction
of UAVs into the civilian market will increase the demand for their commercial
use in different sectors. Nowadays, with the rise of drone technology, the
industrial players have their interest investing in UAVs [7]. Therefore, the
UAVs will represent an essential part of our technological society as their
civilian popularity is significantly increasing.

Although the worldwide development of the drone business model and the
benefits offered by commercial UAVs, a considerable number of drones incidents
are reported every week [8]. Thus, highlighting the need to counter the UAV
threats efficiently. To that end, one line of argument suggests detecting and
identifying the UAV threats at their early phases [9]. This approach would
provide the operator a reasonable amount of time to deploy the required tools
to neutralize such threats. It is of utmost importance to consider the
malicious use of such technology and its potential threats for civilian users.
Its exponential growth triggers different vulnerabilities to their cyber and
physical components [10]. The security and privacy aspects of their deployment
into the national airspace have become a significant concern for governments,
as the UAVs threat landscape becomes wide. In addition, most of the existing
commercial UAVs are not equipped with security mechanisms such as intrusion
detection systems (IDS). Therefore, they present perfect targets for
adversaries.

Recently, the world has witnessed a series of successful cyber attacks on UAVs
[11]. Performing real-world cyber attacks against civilian UAVs has become a
matter of national security. Upon integrating UAVs in the national airspace,
their security issues have created a substantial discussion among governments
and agencies in the public and private sectors. From a security point of view,
the variety of existing cyber attacks demonstrate that UAVs are vulnerable at
different levels. Indeed, malicious actors benefit from the ubiquity of drone
usage in civilian applications. They exploit different vulnerabilities across
commercial drones creating an active threat to the safety of people.
Furthermore, drones manufacturers lack considering security and privacy
concerns in the early phases of their production.

It is worth mentioning that the active use of civilian UAVs in many
applications can pose new security and privacy challenges [12]. With this in
mind, existing countermeasures to detect compromised drones and secure drone
systems are weak. To that end, cyber attacks against UAVs are feasible due to
the lack of implementing appropriate security measures that guarantee the
classical CIA triad (Confidentiality, Integrity, and Availability) [13].
Hence, we need to investigate Unmanned Aerial Vehicles from a security and
privacy perspective. On the other hand, the integration of UAVs in the
national airspace can also violate public users’ privacy and sensitive
facilities such as chemical industries and nuclear power plants. Indeed, most
UAVs are equipped with onboard camera capabilities, which might potentially
disclose sensitive details of human activities [14].

In general, we consider UAVs as complex aerial vehicles. A flying UAV operates
under a set of onboard sensors (e.g., GPS, accelerometer, etc.) that provide
sensor readings to the Flight Controller, which sends data through a
communication channel to the operator. According to the received data, the
operator sends the control signal to the Flight Controller. In this scenario,
four fundamental components of the UAV system need to correlate and operate to
maintain the desired state. Namely, the sensors, the hardware, the software,
and the communication link. Moreover, the potential failure of any components
might result in grounding and crashing the UAV system. Motivated by this
vision and from an adversarial perspective, we consider the abovementioned
elements as critical attack points of the UAV system. Hence, we aim to
investigate the security and privacy issues of UAVs according to these
components that are organized into four levels: the Sensor-level, the
Hardware-level, the Software-level, and the Communication-level.

###  I-A Contributions

In this paper, we aim to provide a comprehensive survey targeting the security
and privacy issues of Unmanned Aerial Vehicles and their related concepts. We
summarize our main contributions as follows:

  * •

We shed light on the background of UAVs, emphasizing the main components
characterizing the UAV system such as the hardware and software architecture,
the communication principles, and the sensing technology;

  * •

We provide the first comprehensive categorization of the security issues of
UAVs into four different levels: the Sensor-level, the Hardware-level, the
Software-level, and the Communication-level. For each level, we investigate
common vulnerabilities, threats, attacks, and existing countermeasures. We
believe that this categorization can provide a reference for future
researchers to start investigating the UAV security;

  * •

We systematically consider how commercial drones can affect people’s privacy
by discussing the primary privacy invasion attacks and possible
countermeasures;

  * •

Finally, we discuss the lessons learned, pitfalls and promising directions for
future research in the field of security and privacy of UAVs.

###  I-B Roadmap

The remainder of the article is structured as follows. Firstly, we provide an
overview of related work in Section II. Section III provides background on
UAVs describing their general architecture, communication principles, and
security requirements. In Section IV, we discuss the main security issues
targeting UAVs. In particular, we classify these issues into four different
levels: Sensor-level, the Hardware-level, the Software-level, and the
Communication-level. For each level, we list the vulnerabilities and threats.
Then, we discuss the potential attacks and existing countermeasures. In
Section V, we focus on the privacy issues of commercial UAVs, including
existing defense mechanisms against privacy-invasion attacks. Section VI
discusses the lessons learned, pitfalls and future research directions.
Finally, Section VII concludes the survey.

##  II Related Work

Unmanned Aerial Vehicles are considered as a new emerging type of "flying IoT"
devices [15]. They incorporate several applications. For example, drones can
provide immediate assistance for patients, such as delivering blood and
medical supplies. However, security and privacy challenges might occur when
integrating UAVs in modern healthcare systems [16]. With the introduction of
synchronized IT components in the Enterprise Architecture (EA) domain,
commercial UAVs are extensively used for business development (e.g., safe
inspection of critical infrastructures, aerial data collection, etc.). In
contrast, the security implications on the use of UAVs within companies and
organizations need to be properly considered [17]. In the past decade, the
evolution of UAV technology has faced security and privacy issues. In this
context, prior works have been published to cover different aspects of UAVs’
security and privacy issues.

Table I: Comparison of our survey and existing surveys on Security and privacy
issues of UAVs

Year | Work | Security issues | Privacy issues
---|---|---|---
Software-level | Hardware-level | Communication-level | Sensor-level
V | T | A | C | V | T | A | C | V | T | A | C | V | T | A | C | A | C
2016 | Hayat et al. [1] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2017 | Altawy et al. [18] | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$
2017 | Krishna el al. [19] | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\blacksquare$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2017 | Maxa et al. [20] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2018 | Choudhary et al. [21] | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\blacksquare$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$
2018 | Lin et al. [22] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$
2019 | Shakhatreh et al. [23] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\blacksquare$ | $\blacksquare$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$
2019 | Nassi et al. [24] | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$
2019 | Fotouhi el al. [25] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2019 | Chriki et al. [26] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2020 | Yaacoub el al. [12] | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\blacksquare$ | $\blacksquare$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$
2020 | Boccadoro et al. [27] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$
2020 | Wang et al. [28] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\square$
2020 | Hentati et al. [29] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$
2020 | Zhi el al. [30] | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\square$
2020 | Sharma el al. [31] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2020 | Noor et al. [32] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2020 | Mishra et al. [33] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$
2020 | Syed et al. [34] | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$
2021 | Yahuza et al. [35] | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\blacksquare$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$
2021 | Nassi et al. [36] | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$
2021 | Shafique et al. [37] | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\squarelrblack$ | $\square$ | $\squarelrblack$
2021 | Hassija et al. [38] | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\squarelrblack$ | $\square$ | $\square$ | $\square$ | $\square$ | $\squarelrblack$ | $\squarelrblack$
2021 | This work | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$ | $\blacksquare$

$\blacksquare$ = Survey the category, $\square$ = Does not survey the
category, $\squarelrblack$ = Partially survey the category
V = Vulnerabilities, T = Threats, A = Attacks, C = Countermeasures

Security and Privacy Challenges of UAVs. Wang et al. [28] discussed the
security and privacy challenges of UAV networks from a cyber-physical system
(CPS) perspective. The authors considered the significant components of UAVs
that are vulnerable to several cyber attacks either from the cyber or the
physical domain. A similar work presented the security challenges of UAV’s
communication networks and proposed their essential security requirements
[29]. Shakhatreh et al. [23] reviewed UAV’s civil applications and their major
key challenges. Krishna et al. [19] conducted a review on cybersecurity
vulnerabilities of UAVs. The authors proposed a taxonomy to classify different
types of UAVs cyber attacks. Recently, a work by Shafique et al. [37] surveyed
the security protocols and their vulnerabilities in UAVs. Syed et al. [34]
surveyed the emerging technologies used in the literature to overcome the
security and privacy challenges in UAVs. Their work primarily covers the
application of Blockchain, Machine Learning (ML), and watermarking
technologies.

Security and Privacy Issues of Commercial UAVs. In [18], the authors surveyed
the security, privacy, and safety aspects of commercial drones. In particular,
they identified the major vulnerabilities, cyber and physical threats, as well
as potential attacks that can result in crashing the drone during a flight
mission. Similarly, in [12], the authors investigated the emerging cyber
attacks and challenges facing commercial drones. In [24], the authors reviewed
the current threats and malicious use of drones in civilian applications. In
their recent work, Nassi et al. [36] carried out a systematic literature
review of security and privacy issues of commercial drones. In [30], the
researchers analyzed the potential threats of wireless communications in
commercial UAVs such as Wi-Fi-based UAVs communications. Further, they
highlighted the privacy disclosure caused by UAVs through aerial photos.

Security and Privacy Issues of UAV Communications. Fotouhi et al. [25]
surveyed the important security issues of UAV-assisted cellular
communications. Mishra et al. [33] pointed that the integration of UAVs to
cellular networks such as 5G triggers security challenges that need to be
thoroughly investigated by the research community. Hayat et al. [1] addressed
the safety, security, and privacy issues of UAV networks from a communication
viewpoint. Then, provided the general communication requirements of UAV
networks for a safe, secure, and privacy-preserving deployment of UAVs. The
authors in [31] provided a comprehensive review of the latest UAV
communication technologies and the need to secure the collected and
transmitted data to the Ground Control Station (GCS). Hassija et al. [38]
presented a survey covering the major security issues in UAV communications
and their potential vulnerabilities.

Security and Privacy Issues of UAV networks. Boccadoro et al. [27] provided a
survey on the Internet of Drones (IoD). They discussed the security and
privacy issues of the drone-2-drone communications and their existing
solutions. They also considered the security aspects in specific application
scenarios involved in the IoD architecture, such as public safety and smart
farming. In another work, Noor et al. [32] considered the security and privacy
challenges associated with the design of UAV networks. One of the main
challenges is the communication among multiple UAVs in an Ad hoc fashion. This
type of communication is known as Flying Ad hoc Network (FANET). FANETs
security issues are also surveyed by Chriki et al. [26]. The authors discussed
the need to develop robust security schemes before deploying FANET networks in
realistic scenarios. Additionally, Maxa et al. [20] surveyed the main security
challenges of UAV routing protocols. Additionally, the work proposed by Sharma
et al. [31] outlined the security mechanisms for communication and networking
technologies of UAVs. In this context, the authors discussed the underlying
security vulnerabilities and threats of UAVs communication protocols.
Differences from existing surveys. Differently from prior works, our work aims
to extensively survey the security and privacy issues of UAVs by categorizing
them into different levels. Most existing surveys and tutorials in this line
of research categorize UAVs’ security and privacy issues in terms of attack
vectors or according to the fundamental principles of information security.
However, such categorization cannot fully explain the vulnerabilities,
threats, attacks, and countermeasures of UAVs. Moreover, prior works consider
analyzing specific components of the UAV system, such as communications and
networking. Instead, our survey is focused on the security and privacy aspects
of the complete drone system, covering the end-to-end components, including
sensors, hardware, software, and communication. In our work, we survey the
security and privacy issues of commercial UAVs. In particular, we dissect from
a security perspective the vulnerabilities, threats, attacks, and existing
countermeasures of commercial UAVs into four different levels: (i) Sensor-
level, (ii) Hardware-level, (iii) Software-level, and (iv) Communication-
level. These levels are the most important levels of the functionality of a
UAV system. Moreover, we discuss the attacks targeting the privacy aspect of
UAVs and their existing mitigation techniques. Throughout our survey, we offer
readers a good understanding and visibility of UAVs’ most current security and
privacy issues at each level. To demonstrate the differences between existing
surveys and our work, we perform a comparison of our survey and existing
surveys in the literature as shown in Table I.

##  III Background

In this section, we provide background information for Unmanned Aerial
Vehicles. In our survey, our focus is only on commercial drones. Military
drones are out of the scope of our work. In addition, for the rest of our
paper, we use drones and Unmanned Aerial Vehicles interchangeably. In this
section, we start by systematically introducing the hardware and software
architecture of UAVs. Then, we highlight existing UAV communication
capabilities and protocols. Afterward, we present the onboard sensing elements
of UAVs that are part of the payload. Finally, we list the security and
privacy requirements of the UAVs for mission-driven civilian applications.

###  III-A General Architecture of UAVs

The development of UAV technology has created various types of drones with
different shapes and weights. To the best of our knowledge, there is no
existing standard to classify UAVs. A UAV system generally consists of the
Unmanned Aircraft, the Ground Control Station (GCS), and the Communication
Link (CL). The Unmanned Aircraft, also known as UAV, constitutes the core of
an Unmanned Aerial Vehicle system [18], and is monitored by the operator
either through the GCS or using a Remote Controller (RC).

Hardware Architecture. The inner hardware architecture of an Unmanned Aircraft
device includes: a Flight Controller (FC), rechargeable batteries, actuators,
a set of sensors such as GPS and accelerometer, and a wireless communication
module. A high-level architecture of an Unmanned Aerial Vehicle is depicted in
Figure 1.

  * •

The Flight Controller: It serves as the central processing unit of the UAV
that interfaces between the software and the onboard devices. It is a
microcontroller board equipped with a computing and control unit and storage
(e.g., Raspberry Pi [39], BeagleBoard [40], etc.).

  * •

The rechargeable batteries: Lithium polymer-based batteries that provide the
power supply for the whole UAV.

  * •

The actuators: They consist of the brushless motors and the propellers.
Moreover, they produce the appropriate actuation needed for the UAV during the
flight mission, thus ensuring high stability.

  * •

The sensors: They are crucial parts of the UAV. They enable sensing
functionalities by providing physical measurements of the surrounding
environment, such as height, speed, and geospatial references. These
measurements are translated into data that the Flight Controller processes and
transmitted to the operator.

  * •

The wireless communication module: It is directly connected to the circuit
board of the Flight Controller and includes a transmitter and a receiver. It
is designed to send and receive signals from other devices such as the Remote
Controller, the Ground Control Station, and nearby unmanned aircrafts.

Figure 1: General architecture of an Unmanned Aerial Vehicle.

The Ground Control Station (GCS) is a fundamental component of any UAV system.
It allows controlling and monitoring the UAV remotely during the flight
mission using wireless communication. The GCS hardware is a ground-based
computer processing unit used to control and administer the flight mission
[41]. It is equipped with a wireless data link module that: (1) generates and
transmits control commands to the UAVs, and (2) receives real-time data from
UAVs.

Software Architecture. The software architeture of the Unmanned Aircraft
operates in a layered system. The integration between these layers constitutes
the flight stack, and consists of three main layers: the Firmware, the
Middleware, and the Operating System. Examples of open source flight stack
are: Arducopter [42], Crazyflie 2.1 [43], and KKMultiCopter [44]. The firmware
and the middleware are subject to real-time constraints.

  * •

The Firmware; It is the lower layer of the flight stack and provides
instructions from machine code to the Flight Controller’s processor.

  * •

The Middleware: It constitutes the layer responsible for proper control of the
flight by managing the communication between the services such as guidance,
navigation, and telecommunication. Thus, operating the UAV system as a
distributed embedded system.

  * •

The Operating System: It is the highest layer of the flight stack and most of
the time labeled as a Real-Time Operating System (RTOS). A Real-Time Operating
System handles real-time data processing and enables the autopilot software to
manage different processes such as flight operations, video recording, and
path planning.

According to the recent FAA regulations, and with the integration of UAVs into
the national airspace; all UAVs are required to have a Remote ID (or a System
ID), which can be defined as the ability of a flying drone to provide its
identification and location information to third parties such as law
enforcement, and federal agencies [45].

The Ground Control Station software is also known as a mission planner. It
includes a human-machine interface that displays the flight parameters and
typically runs on laptops, tablets, or any devices in the field.

Communication Link. The communication link represents the wireless
communication between the GCS and the UAV. It enables data transmission during
the flight mission. However, due to the weather conditions and limited power
supply, transmission frequencies and flight range may pose several challenges.
We identify two types of communication streams: data communication and control
communication. In data communication, the UAV sends data signals such as
telemetry and status information to the GCS. While in control communication,
the GCS sends commands and control signals to the UAV [46]. In what follows,
we highlight the UAV communication principles.

###  III-B Communication Principles

UAV communications can take place between a UAV and another end point, which
can be referred to as UAV-2-X communication. In this subsection, we first
explain the UAV-2-X communications. Afterwards, we explain the UAV
communication architectures, networks of UAVs, as well as their routing
protocols. Following that, we shed light on the well-known communication
protocols.

####  III-B1 UAV-2-X Communication Types

During a flight mission, a UAV communicates with several entities. As depicted
in Figure 2, we categorize four endpoints of UAV-2-X communications:

Figure 2: UAV-2-X communication types.

  1. (i)

UAV-2-GCS communication: It is the fundamental type of communication for UAVs.
The GCS exchanges data with UAVs through uplinks and downlinks, enabling
monitoring traffic and controlling the flight mission. We consider three
classes of transmitted traffic in UAV-2-GCS communications: The control
traffic, the coordination traffic, and the sensing traffic [47]. The control
traffic encompasses controlling and monitoring commands. In particular,
mission-specific commands and the real-time status of UAVs (e.g., telemetry
data, battery level, etc.). The coordination traffic handles the collaboration
between multiple UAVs during the flight mission and tasks performed
independently from the GCS, such as collision avoidance processes. The sensing
traffic encloses onboard sensor readings that are transmitted to the GCS. We
mention that all different types of traffic in the UAV-2-GCS communications
are based on wireless technologies with limited range such as Bluetooth or Wi-
Fi 802.11, and most of the time not secure [48]; thus making them vulnerable
to passive and active attacks.

  2. (ii)

UAV-2-Satellite communication: In the Beyond Line-of-Sight (BLOS) missions,
the operator needs to locate UAV’s position for safe navigation. Therefore,
UAVs can establish a satellite communication link to gather their real-time
GPS location, then transmit it back to the GCS through the satellite.
Furthermore, satellite communications are useful at long distances without
fixed infrastructure and provide reliable communication with high transmission
bandwidth. Moreover, we can leverage commercial satellite communications to
control UAVs [49]. However, they are energy-consuming and expensive in terms
of maintenance costs and they can introduce high latency issues.

  3. (iii)

UAV-2-Cellular communication: At high altitude whether in urban or rural
environments, UAVs guarantee a wide coverage area and incorporate cellular
networks with the coexistence of ground users to provide a reliable wireless
communication [25]. In this integration, the UAVs operate either as aerial
User Equipments (UEs) or as aerial Base Stations (BSs) [29]. When they act as
User Equipments, also known as cellular-connected UAVs, they establish a
UAV-2-Cellular communication with the terrestrial base station, and the ground
pilot can directly control UAVs through cellular networks. Differently, UAVs
as aerial Base Stations are complementary to ground base stations. They
provide reliable and cost-effective wireless cellular networks to cover areas
where ground base stations are not reachable. Although given the advantages of
using UAVs in cellular networks in both scenarios, their real-world
deployments face several challenges such as limited performance and energy-
efficiency [50].

  4. (iv)

UAV-2-UAV communication: Referred as Air-to-Air communications, and takes
place during flight missions that require multiple UAVs. In such scenarios,
UAVs collaborate and coordinate over wireless technologies with low-power
consumption (e.g., Bluetooth, Zigbee, etc.) to exchange information directly
or through multi-hop wireless links. In this case, a single UAV operates
within a network of UAVs to share data and accomplish the desired flight
mission. However, UAV-2-UAV communications have a very low throughput and
transmission bandwidth.

####  III-B2 UAV-2-X Communication Architecture

UAV-2-X communications operate under a layered architecture and include the
physical & MAC layer, the network layer, and the transport layer.
Unfortunately, implementing security solutions for these layers is challenging
due to UAV’s characteristics, such as battery life, insufficiency of
resources, real-time computation, and autonomous control. This problem
triggers various vulnerabilities at the communication level.

Physical & MAC Layer. The physical & MAC layer defines the communication
between the UAV and the transmission medium. In the Physical & MAC layer of
UAV-2-X communications, the UAVs utilize different wireless communication
technologies such as Wi-Fi, Zigbee, and Bluetooth.

Network Layer. In multi-UAV systems, UAV communication networks are aerial and
they are notably different from the mobile ad hoc, and vehicular ad hoc
networks in terms of node mobility and topology change [2]. The unique
properties and challenges of these networks create a new category of ad hoc
networks, namely flying ad hoc networks (FANETs) [51]. In Multi-UAV
operations, the features and the nature of FANETs make them vulnerable to
various cyber attacks [26]. Indeed, challenging issues arise in multi-UAVs
systems due to their very low node density, topology change, and architectural
design [2]. As shown in Figure 3, we distinguish two broad categories of UAV
communication network architectures: centralized architecture and
decentralized architecture [52].

In the centralized architecture, the UAVs transmit to and receive data and
control commands from a single GCS that serves as a central station. The
centralized architecture is applicable in small and straightforward missions.
An example of this type of communication is in crowd surveillance applications
in urban areas [53]. In such a network architecture, any UAV-2-UAV
communication must go through the GCS. This routing results in a delay in data
transmission. Therefore, the centralized architecture is not suitable for
long-distance communications, especially for resource-constrained UAVs.

In contrast, the decentralized architecture enables UAV-2-UAV communications
without routing information to the GCS. We consider two sub-types of
decentralized UAV network architectures: single backbone UAVs and multiple
backbone UAVs. For both scenarios, a single UAV or multiple UAVs operate as a
gateway node and transmit exchanged data to the GCS either directly or through
another networking infrastructure such as cellular-based or satellite-based
systems. In a single backbone UAV ad hoc network, UAVs form a connection
group, and only one backbone UAV serves as a gateway between the GCS and the
other UAVs. However, the single backbone UAV architecture may not be practical
for flight missions that require a significant number of UAVs. In this case,
we rely on two types of multiple backbone UAV architecture. In the first type,
multiple groups of UAVs in a collective behavior form a swarm, such that each
group consists of a single backbone UAV architecture. The latter one consists
of grouping all single backbone UAVs of all groups. Each group can transmit
data to the other group without being routed through the GCS, and only one
backbone UAV exchanges data with the GCS.

Figure 3: UAV communication network architectures.

We note that all the abovementioned UAV network architectures have their
strengths and limitations regarding communication needs, autonomy, and
scalability. Therefore, the appropriate type of architecture to deploy depends
on the flight mission requirements. For example, in Search And Rescue (SAR)
missions where time is crucial, the decentralized architecture is more
efficient than centralized ones due to the collaboration and coordination
between multiple UAVs.

In multi-UAVs networks, routing protocols are essential to provide a reliable
end-to-end data transmission between UAV nodes [54]. Several routing protocols
have been proposed in the literature with different classifications [55, 54,
56]. One approach classifies these protocols either on the network
architecture or data forwarding [57]. Another approach suggests classifying
UAV routing protocols according to their design constraints such as dynamic
topology, energy consumption, scalability, security, and allocated bandwidth
[55]. However, given UAV’s unique characteristics, all these protocols cannot
fulfill UAV’s security requirements.

Transport Layer. The transport layer provides reliable data transfer between
end-to-end components. Two well known examples of UAV communication protocols
at the transport layer include the MAVLink protocol and the UranusLink
protocol.

MAVLink Protocol. The Micro Air Vehicle Link (MAVLink) protocol is a
lightweight point-to-point networking protocol primarily used in UAV-2-GCS
communications to exchange control and telemetry data [58]. It uses
bidirectional communication between UAVs and GCS over wireless channels for
real-time applications. Its transmissions can be performed through different
wireless mediums such as Wi-Fi and Bluetooth, with sub-GHz frequencies.
MAVLink protocol comes in two versions: v1.0 and v2.0. MAVLink v2.0 is
currently the recommended one. It is a backward-compatible and improved
version compared to MAVLink v1.0. MAVLink v2.0 protocol header contains new
features and adds new fields to the existing structure of MAVLink messages,
such as message extensions and packet-signing. Commercial UAVs extensively use
MAVLink v2.0 since it provides reliable communication and packet-signing.
However, only a few studies addressed security implementations of the MAVLink
communication protocol. Therefore, MAVLink protocol is prone to several
attacks such as flooding and packet injection [59].

UranusLink Protocol. UranusLink is a packet-oriented protocol for wireless
UAV-2-GCS communications [60]. Its design satisfies radio communication
requirements such as data throughput and low latency, making it useful for
aerospace and robotic applications. UranusLink operates in a half-duplex mode
under 2.4 GHz frequency and with a maximal throughput of 250 kbps. It is
suitable for UAVs with small overhead. Although UranusLink employs an
integrity protection scheme, it does not encrypt message payloads that can
result in replay attacks [61].

###  III-C Sensing Technology

UAVs possess a wide range of sensors to accomplish their flight missions.
These sensors represent critical components for the functionality of the UAV
system, and they are designed to measure physical quantities of the
surrounding environment such as altitude, speed, and GPS location. The outputs
of these quantities are then directly transferred to the Flight Controller to
decide the appropriate actuation/action. In Table II, we present the well-
known sensors of most of the commercial UAVs. We mention that for each type of
UAV application, there exists a corresponding set of onboard sensors. It is
worth mentioning that the Flight Controller cannot distinguish between
legitimate or malicious sensor inputs, even with the robust design of UAV
sensors.

Table II: Sensors of Unmanned Aerial Vehicles  Components |  Functionality
---|---
GPS |  Many UAVs use Global Positioning System in outdoor applications to determine geospatial references from the satellite within its range.
3D
Accelerometers |  Three accelerometer sensors used to provide the non-gravitational acceleration of UAVs for each axis X, Y, and Z. They rely on the piezoelectric effect and handle the hover capability of UAVs.
3D gyroscopes |  3D Gyroscopes can measure or maintain orientation and angular velocity in pitch, roll, and yaw. They are essential for navigation and provides orientation stability of UAVs. Moreover, they collaborate with 3D accelerometers to handle rotational and linear movements.
Magnetometers |  Magnetometers provide additional geographical direction of UAVs using the magnetic field. However, these sensors might be defective when placed together with motors and electrical devices.
Infrared
cameras |  Also known as thermographic cameras, they provide detailed images using infrared energy of objects even in the darkness. Mainly used in military UAV applications. This type of a camera could potentially spy on people in challenging environments (e.g., forest, private houses).
Gas sensors |  Gas sensors can detect different gasses such as toxic or explosive gasses and measure their concentrations. They have many industrial and military applications.
Radiation sensors |  Very useful in nuclear industries. UAVs can be equipped with radiation sensors to determine radiation levels and provide gamma radiation readings for large areas.
Cameras |  Crucial device of UAVs. A wide range of cameras for UAVs exists with different types and sizes. With many civilian and military applications, they can capture images and record videos. Moreover, they help the pilot to navigate in indoor missions. However, the zoom function of these cameras triggers privacy challenges.
Microphones |  Practical for search and rescue operations or spying missions, microphones can record audio and gather information remotely. However, using microphones can violate personal privacy.
Biosensors |  Biosensors are electrochemical sensing technologies mainly used to detect airborne biological hazards.
Pressure
sensors |  Pressure sensors aim to detect the atmospheric pressure and convert it into altitude. They provide UAVs altitude stabilization.
LiDAR
sensors |  Light detection, and ranging sensors provide a high-resolution map with laser light. They have several applications such as archeology, agriculture, and landscaping.

###  III-D Security and Privacy Requirements

The wide use of UAVs in civilian applications raise a large amount of
vulnerabilities [19]. To that end, different features are essential to protect
UAVs from disclosure, disruption, modification, and destruction [18]. To
guarantee the these properties, we identify the following major security and
privacy requirements needed to establish a secure UAV flight mission.

  * •

Confidentiality. It is crucial to protect private information and data
exchange between UAVs and the GCS from unauthorized access, as it could be a
source of sensitive information leakage of the flight mission such as
telemetry data and control commands. To prevent the adversary from obtaining
such information, we need to consider implementing robust cryptographic
solutions.

  * •

Integrity. Preserving data integrity is of utmost importance. It is a
requirement for the success of a flight mission and it prevents adversaries
from forging the network traffic. Compromising the integrity could change the
behavior of the UAV system and lead to a mission failure. Hence, any
communication has to be protected and verified. We can guarantee this
requirement through authenticated encryption algorithms [18].

  * •

Availability. UAVs must be operational without intentional or unintentional
interruptions. All the resources needed for a flight mission have to be
available for authorized users. Moreover, it is required from the UAV system
to resist classical Denial of Service (DoS) attacks, which are compromising
its availability. Such attacks can be mitigated using IDS [62].

  * •

Authenticity. The authentication process is a fundamental step towards
establishing secure communication between different components of the UAV
system. It allows verifying the authenticity and identity of UAVs
participating in the flight mission. We ensure the trustworthiness of each UAV
through authentication, and only authenticated UAVs can participate in the
flight mission. Moreover, the authentication protects the UAV network from
adversaries that are spoofing the legitimate nodes.

  * •

Non-Repudiation. The users cannot deny their actions (e.g., transmitting or
receiving data) within UAV networks. Otherwise, we may deal with
accountability issues in case of a mission failure. This property prevents the
denial of the user’s operations. Furthermore, the UAV system has to develop
proper mechanisms ensuring non-repudiation, such as the digital signature of
the exchanged messages.

  * •

Authorization. Data exchange in the UAV system has to be shared only with
authorized users. We note that unauthorized users are not allowed to perform
any action in the UAV network. Besides, the UAV system has to specify what
resources an authorized user can access. Granting access to such resources has
to be monitored through access control policies.

  * •

Non-disclosure. In addition to the abovementioned security requirements, we
consider the non-disclosure property in the privacy requirements for UAV
systems. Indeed, sensitive information exchanged between the GCS and the UAV,
such as captured images and video footage, should not be disclosed to a third
party [58].

##  IV Security Issues of UAVs

Security issues associated with UAVs in the national airspace greatly increase
the likelihood of performing passive and active attacks. In this section, we
categorize the security issues of UAVs into four different levels: Sensor-
level, Hardware-level, Software-level, and Communication-level. As shown in
Figure 4, we provide a detailed overview about the threats and vulnerabilities
targeting UAVs for each level. Then, we review the attacks and their existing
countermeasures.

Figure 4: Taxonomy of UAV security issues.

###  IV-A Sensor-Level Issues

UAVs rely on sensors to gather data about the surrounding environment. These
data are sensitive and need to be protected from malicious actors. Under
adversarial conditions, compromising UAV sensors might cause the UAV system to
fail. In what follows, we provide different sensor-level vulnerabilities,
threats, and potential attacks against UAVs. Afterward, we highlight existing
countermeasures against sensor-based attacks on UAVs.

####  IV-A1 Sensor Vulnerabilities and Threats

UAVs are extremely sensor-driven devices. They are equipped with a variety of
sensors such as cameras, GPS, and accelerometers. Therefore, they rely on
sensor readings to operate efficiently. However, these sensors handle
sensitive information and could be used by a malicious operator to compromise
the flight mission. For example, civil GPS signals are unencrypted and
unauthenticated. Therefore, an adversary can exploit this vulnerability by
simulating a GPS signal to delude the operator. From an attacker’s
perspective, exploiting the onboard sensors’ real-time data may cause the UAV
system to malfunction. This exploit could happen because the Flight Controller
does not evaluate the authenticity of sensor readings. The introduction of
sensor vulnerabilities into the UAV system can also be performed through
malicious software. Due to the practicality of sensory-channel attacks in
real-world scenarios, this class of vulnerabilities exposes a new attack
vector for the adversary to fully control commercial UAVs [63, 64].

####  IV-A2 Sensor-based Attacks

Sensor-based attacks include GPS data jamming, false sensor data injection,
and sensory-channel attacks.

GPS data jamming. During a flight mission, the onboard GPS receiver gathers
its GPS location from the satellite and sends it to the GCS. GPS data jamming
attack occurs when the adversary blocks the navigation feed of the GPS
signals, forcing the UAV into a disoriented mode [65]. Performing such attacks
results in losing control of the UAV, and therefore possible hijacking of the
drones.

False sensor data injection. Injecting false sensor data readings in the
Flight Controller can compromise external sensors such as electro-optical and
infrared sensors [66]. This attack leads to thwart the UAV’s stabilization. An
attacker can inject false sensor data into UAVs by accessing the onboard
Flight Controller system or by altering the sensor readings through system
calls. Otherwise, he can directly transmit fake signals to the sensors, and
therefore compromising the flying UAV. A well-known example of false sensor
data injection attacks is GPS spoofing. Since GPS signal broadcasts are most
of the time unencrypted and unauthenticated, the attacker performs a spoofing
attack on the GPS by faking the generated signal, which can eventually alter
the UAV’s GPS receiver [67]. Consequently, the attacker gains control over the
UAV. In [68, 69], the authors demonstrate a GPS spoofing attack on UAVs. The
GPS spoofing attack forces the drone to reply to fake signals, consequently
affecting its navigation system.

Table III: Summary of sensor-level security issues, existing countermeasures and their limitations  Sensor-based attacks/threats |  Countermeasures |  Limitations
---|---|---
Sensory channel attacks [63] |  -Physical isolation for acoustic sensory channels to shield the sound noise [70]. -Building robust optical flow algorithms for optical flow sensors [71]. |  -A large number of sensory channels to consider.
GPS data spoofing [68, 69] |  -Implementing anti-GPS-spoofing methods into the Flight Controller [72, 73, 74]. -The use of collaborative data attestation approach that verifies the correctness of GPS coordinates [75]. -The adoption of authenticated schemes for GPS signals. -Detection of unusual signal power changes that indicate the beginning of a spoofing attack. |  -Authenticated GPS signals require additional changes in the infrastructure of the satellite.
GPS data jamming [65] |  -Enabling the autonomous navigation without GPS signal [76]. -The use of additional sensors for alternative navigation [77]. -Adopting machine learning-based IDS to detect sensor-based attacks [78] [79]. |  -Limited energy and computation costs for realistic implementations.
False sensor data injection [66] |  -Modeling UAV’s physical properties [80]. -Securing sensor readings in the presence of physical invariants [81]. -Cross-verification of data by gathering sensor readings from an alternative set of sensors. |  -Adopting the existing solutions to other types of on-board sensors is still unknown.
MEMS gyroscopes attacks [82] |  -Physical isolation for acoustic sensory channels to shield the sound noise [70]. |  -The physical isolation could increase the temperature and cause a malfunctioning of the UAVs.
Optical flow camera sensor attack [83] |  -Building robust optical flow algorithms for optical flow sensors [71]. |  -Practical limits of the optical flow estimation due to its inherent noisy nature.

Sensory-channel attacks. UAVs use a set of sensors in which their sensory
channels (e.g., infrared, acoustic, light, etc.) serve as a vector for
attacks. In [82], the authors demonstrate that UAVs equipped with Micro-
Electro-Mechanical Systems (MEMS) gyroscopes can fail using intentional sound
noise. The study shows that MEMS gyroscopes resonate at audible frequencies.
Another study has shown that optical flow camera sensors which are used to
stabilize UAVs can be compromised by influencing the surrounding environment
[83].

####  IV-A3 Countermeasures for Sensor-based Attacks

To mitigate GPS jamming attacks, the authors in [76] provided a solution
enabling autonomous navigation when the Flight Controller does not receive GPS
signals. Other approaches rely on ML-based IDS to detect known and unknown
sensor-based attacks [78] [79]. These solutions collect training datasets from
onboard components of the UAVs, such as flight logs and sensors readings.
However, real-world implementation is challenging due to the limited energy
and computation resources of the UAVs. In another work, Wu et al. [77]
proposed the use of additional sensors as an alternative navigation solution
when GPS signals are not available. The authors used a monocular camera visual
sensor combined with an Inertial Measurement Unit (IMU) sensor to enable the
autonomous flight of UAVs in a loss-of-GPS scenario.

To prevent injecting falsified Flight Controller sensors data, we can cross-
verify the data by gathering readings from an alternative set of sensors.
Another solution to detect external sensor attacks is by modeling UAV’s
physical properties through a control invariant approach [80]. The control
invariant approach checks the consistency of the UAV’s physical state with its
expected state, which is identified by its control model. Similarly, in [81],
the authors presented an architecture to secure sensor readings in the
presence of physical invariants. Physical invariants of the UAVs are unique
features that can be modeled to predict sensor measurements according to their
behavior. These features consist of nonlinear differential equations that
model UAVs’ speed, angles, position, and angular speed. The study shows that
the use of well-known physical invariants provides learning of their
parameters and enables the detection of sensor-based stealthy attacks.

Preventing the adversary from performing a GPS spoofing attack could be
achieved by detecting unusual signal power changes, which indicates the
beginning of a spoofing attack. In Multi-UAVs scenarios, the authors in [75]
proposed a collaborative data attestation approach that verifies the
correctness of shared information such as GPS coordinates, thus the detection
of GPS spoofing attacks. Another countermeasure against GPS spoofing attacks
is by adopting GPS signal authentication schemes with classical cryptographic
approaches. However, the implementation of such solutions requires additional
changes in the infrastructure of the satellite [18]. We also note that some
anti-GPS-spoofing methods are suitable to be implemented into the Flight
Controller, enabling an efficient hijacking detection solution [72, 73, 74].

A set of countermeasures have been proposed in the literature to mitigate each
type of sensory-channel attack. Acoustic sensory channels are protected by the
physical isolation that can shield the sound noise [82]. Optical flow sensors
rely on optical flow algorithms, which are utilized to measure visual motion.
Building robust optical flow algorithms such as the RANSAC algorithm [71]
constitutes a defense-in-depth mechanism for spoofing optical flow sensors.

The attacker’s capabilities to compromise UAV sensors are outlined in Table
III. The reported sensor-based attacks aim to compromise the sensory channel,
GPS signals, and also inject false sensor data. The solutions proposed in the
existing literature are specific for each type of sensor. For example,
implementing anti-GPS-spoofing methods or using a collaborative data
attestation approach to verify the correctness of GPS coordinates helps
prevent GPS data spoofing. The cross-verification of data by gathering sensor
readings from different sensors protects the UAVs from gathering false sensor
data. However, we also need to consider that the proposed countermeasures for
sensor-based attacks have primary shortcomings. For instance, realistic
implementations to prevent GPS jamming attacks will increase the computation
costs. Moreover, given many sensory channels, providing a set of alternative
sensors for each sensory channel is not efficient.

###  IV-B Hardware-Level Issues

The adversaries consider UAVs as a potential means to conduct physical attacks
in the national airspace. The hardware components of a UAV system consist of
the onboard Flight Controller (FC) and the Ground Control Station (GCS). Both
hardware devices are subject to security issues that can potentially lead to
cyber or physical attacks. We devote this subsection to present the
vulnerabilities that an adversary can exploit to compromise the Hardware-level
of a UAV system. Then, we provide existing defense mechanisms to mitigate
hardware-based attacks.

####  IV-B1 Hardware Vulnerabilities and Threats

Hardware-level vulnerabilities and threats include hardware trojans, physical
UAV collision, hardware failures, and flying skills issues.

Hardware trojans. Hardware trojans involve the modifications of the electronic
hardware (e.g., tampering with the hardware circuit, resizing the logic gate,
etc.) [84]. In particular, hardware trojans target the Flight Controller,
making the UAV system vulnerable to several attacks. The hardware trojans are
maliciously embedded by a non-trusted third party in the semiconductor supply
chain of the Flight Controller [85]. The adversary leverages these
modifications to compromise the functionalities and security features of the
FC’s Integrated Circuit (IC) (e.g., decreasing the rotation speed of the
propellers, leaking the cryptographic keys of the Flight Controller, etc.). An
example of a trojan was found in the Actel ProASIC chip of the Boeing 787 jet
[86]. The backdoor allowed the attacker to monitor the avionics system and
control the aircraft, therefore jeopardizing the safety of onboard passengers.

Physical UAV collision. During a flight mission that requires the cooperation
and collaboration between multiple UAVs, physical collisions could happen,
resulting in crashing the drones. To prevent such collisions in the civilian
airspace, the UAVs rely heavily on Collision Avoidance Systems (CAS) [87].
However, these systems do not encompass built-in security features and cannot
satisfy the collision avoidance threat caused by malicious actors [88].

Hardware failures. UAVs can go through malfunctioning of their hardware
components, such as battery life or motor issues. These technical failures
constitute a threat to the flight mission and could lead to an unsafe landing
of the UAVs in an unexpected location [89]. In this case, if the UAVs store
unencrypted data, the adversary can disclose sensitive mission-related
information and violate the flight mission’s confidentiality.

Flying skills issues. These issues occur when human operators remotely control
non-autonomous or semi-autonomous UAVs, especially those that are very
sensitive under wind disturbance due to their complex dynamics and size [90].
They require flying skills such as remote control of the speed, height, and
orientation of the UAV. In such scenarios, the operator’s lack of these
technical skills might crash the drone and cause an operational failure.
Consequently, the UAVs can be easily exposed to physical theft.

####  IV-B2 Hardware-based Attacks

Hardware-based attacks include hijacking, supply chain attacks, battery
attacks, and radio frequency module attacks.

Hijacking. Due to the nature of UAVs, they are visible at a low altitude,
making them the perfect targets for hijacking. The adversary hijacks a flying
drone either directly or remotely through malicious software. The
straightforward technique to disable and hijack UAVs is by using the anti-
drone rifles [91]. They are usually in possession by law enforcement to
protect malicious UAVs hovering in restricted flight areas. Nevertheless, the
attacker can also use the same rifle to ground the drones and hijack them.

Supply chain attacks. With the drone industry’s growth, the adversaries have a
wider window compromising the UAVs through supply chain attacks. This type of
attack consists of exploiting the vulnerabilities in the supply chain process
of an organization by targeting the less-secure and sensitive components such
as the propellers, airframes, and actuators. Consequently, the end product
that is delivered to the customer is already compromised. A practical supply
chain attack against UAVs is demonstrated by Belikovetsky et al. [92]. The
researchers carried out a physical supply chain attack for UAVs with Additive
Manufacturing (AM). The attack consists of sabotaging a given UAV by remotely
manipulating the design files of the propellers. The adversary reduces the 3D
printed propeller’s fatigue life and creates delayed damage during a flight
mission. This study shows that sabotage attack detection for additive
manufacturing systems remains a challenging research problem.

Battery attacks. Prevalent UAVs are powered with Lithium-Ion rechargeable
batteries. These batteries are supported by the Battery Management System
(BMS) to provide reliable energy to different components of the UAV system.
However, an adversary can exhaust the battery’s energy by performing potential
battery depletion attacks [93], which results in a malfunctioning of the UAV
system, and consequently compromising the availability, integrity, and
confidentiality of the batteries [94]. The attacker compromises the
availability of UAV batteries by physically tampering or swapping legitimate
batteries with faulty ones to fail the UAV system. Another possible attack may
occur when the adversary generates a deep discharging of the batteries. This
type of attack could happen by compromising other components of UAVs, such as
spoofing the sensors or injecting malicious software, leading to exhausting
the UAV batteries [94]. Attacking the integrity of UAV batteries includes
modifying real battery information to the operator through the UAV-2-GCS data
transmission. Furthermore, the confidentiality of UAV batteries can be
compromised by leaking sensitive battery-related data such as the State-of-
Charge (SoC), which represents the ratio of available charge to the UAV
battery capacity.

Radio Frequency modules attacks. Radio Frequency modules (RF) are used to
transmit and receive radio signals from two different devices. In the context
of UAVs, an operator might use a typical remote controller or the GCS to send
control signals to the flying drones. In this case, the adversary can jam the
control signals and disable the UAV-2-GCS communication, resulting in the
drones’ lost-link state. In [95], the authors demonstrated a replay attack on
the XBee 868LP protocol, a low power radio frequency module used for UAV-2-GCS
communications. In this attack, the adversary alters the UAV-2-GCS
communication using a third XBee chip. In particular, the attacker compromises
the security of the communication channel of the main XBee by combining
existing features of the chip to access the address of the XBee communication
channel.

####  IV-B3 Countermeasures for Hardware-based Attacks

Given physical vulnerabilities and threats of UAVs, physical protection
approaches should be considered and enhanced to address those threats. To
guarantee a trojan-free drone, possible mitigation of hardware trojans
consists of building ML-based IDSs to detect such hardware attacks [85].
Detecting the presence of tampered data or commands using IDS solutions is
achieved by: (1) learning the model based on the average data generated by the
Pulse Width Modulation (PWM) signals. These signals are commonly used in the
IC of UAVs. (2) training the model with malicious data. These data are
generated by compromising the firmware or injecting hardware trojans. Thus,
affecting the PWM signals. Another mitigation technique consists of performing
a fine-grained circuit analysis to enable the detection of hardware trojans
[96].

Securing both the GCS and UAVs from illegal access using authenticated
encryption, and keeping them malware-free will significantly prevent malicious
actors from taking over and hijacking the flying UAV. Further, changing the
flight paths could prevent the adversary from identifying the flight pattern,
thus making the target more difficult for physical theft. In [97], the authors
proposed a hijacking detection method for UAVs based on a statistical analysis
of standard flight patterns. The simulation of different hijacking scenarios
shows the effectiveness of their detection algorithm. However, their algorithm
fails when simulation parameters such as control instability are changed,
which motivates further testing and improvement of the quality of the
simulation data.

Supply chain attacks can be mitigated by managing the supply chain’s security
during the manufacturing process to avoid using compromised UAV components
[98, 18]. Besides, tamper-proofing solutions (e.g., tamper-proof
microprocessors, Anti-tamper software, etc.) will disable unauthorized
physical or logical modifications that could sabotage the authenticity of the
UAV’s critical components.

Existing countermeasures to mitigate battery depletion attacks include the use
of safety circuits in the Battery Management System that ensures physical
battery protection for UAVs [94]. Moreover, a pre-flight diagnosis of the UAV
batteries would be an equitable procedure to guarantee a safe flight mission.
Another solution could also detect depletion attacks during the flight
mission, which consists of monitoring the battery discharging process in real-
time [93]. However, if the UAV-2-GCS data transmission is unauthenticated, the
adversary may counterfeit the transmission and display an incorrect battery
level to the operator. Therefore, we need to adopt cryptographic solutions to
secure the UAV-2-GCS data transmission. Further, we can leverage the use of ML
techniques to detect UAV battery depletion attacks automatically. This can be
achieved using the features extracted from simulated battery depletion attacks
[93].

To mitigate the radio frequency modules attacks, the manufacturer can adopt
the onboard encryption of the chip. However, this solution remains limited
because it decreases the bandwidth and increases the latency of the chip. In
this case, the authors in [95] suggested possible outsourcing of the
encryption to a second separate chip. Although this remediation guarantees the
confidentiality of the data sent over the radio channel, it would not prevent
the adversary from executing remote commands since they are sent directly to
the chip. Therefore, the adversary can perform a DoS attack by setting random
values to destination addresses. Another approach considers encrypting the
Radio Control (RC) link. In [99], the author implemented an encrypted RC link
based on Galois Embedded Crypto (GEC) library [100], which is compatible with
resource-constrained devices. The proposed design enables secure communication
between the UAV and the RC transmitter.

Table IV: Summary of hardware-level security issues, existing countermeasures and their limitations  Hardware-based attacks/threats |  Countermeasures |  Limitations
---|---|---
Hardware trojans [84] |  -Building ML-based IDSs to detect hardware trojans [85].
-Performing a fine-grained circuit analysis [96]. |  -Hardware obfuscation techniques can bypass the existing detection methods.
Physical collisions [101] |  -The development of Collision Avoidance Systems [87]. |  -Collision Avoidance Systems do not implement security features.
Hardware failures [89] |  -Adopting encryption techniques on the flying UAVs prevent the adversary from capturing the stored data in the case of hardware failures [37]. |  -Data encryption might prevent forensics analysts from recovering evidence about the hardware failures.
Hijacking [91] |  -Secure the GCS and UAVs from unauthorized access using authenticated encryption [102]. -Consistent change of the flight path to avoid the adversary from identifying the flight pattern [97]. |  -The use of counter-drone technology from malicious users to hijack legitimate UAVs.
Supply chain attacks [92] |  -Managing the supply chain’s security during the manufacturing process [98]. -Adopting tamper-protected devices [103]. |  -Internal attacks during the manufacturing process.
Battery depletion attacks [93] |  -The use of safety circuits in the Battery Management System [94]. -Pre-flight diagnosis of the UAV batteries. -Monitoring the real-time battery discharging process [93]. |  -For unauthenticated communications, the adversary can display incorrect battery levels to the operator.
Attacks on Radio Frequency Modules [95] |  -Encryption of the Radio Control (RC) link [99]. -Onboard encryption of the Flight Controller. |  -Onboard encryption decreases the bandwidth and increases the latency of the chip.

Hardware-level security issues, their countermeasures, and limitations are
summarized in Table IV. As outlined in Table IV, the existing attacks against
UAVs on the Hardware-level include the supply chain attacks, the battery
depletion attacks, the use of hijacking techniques, and attacks on Radio
Frequency Modules. The security measures proposed by the research community
consist of developing defense mechanisms at the Hardware-level. For instance,
managing the supply chain’s security during the manufacturing process,
performing a fine-grained circuit analysis, and using safety circuits in the
Battery Management System. Although the existing countermeasures aim to
protect UAVs from hardware-based attacks, there are still limitations that
need to be considered. For example, the hardware obfuscation techniques can
hinder the fine-grained circuit analysis; the onboard encryption on the Radio
Frequency Modules decreases the bandwidth and increases the latency of the
chip. Furthermore, the development of Collision Avoidance Systems does not
consider security implementations.

###  IV-C Software-Level Issues

Having discussed the Hardware-level issues, we introduce the Software-level
issues by presenting the vulnerabilities, threats, and attacks targeting the
software layer of UAVs. Afterward, we provide existing defense mechanisms to
protect against such attacks.

####  IV-C1 Software Vulnerabilities and Threats

Software-level vulnerabilities and threats on UAVs consists of malicious
software and zero-day vulnerabilities.

Malicious software. The Ground Control Station and the Flight Controller are
prone to malicious software. The threats posed by UAV malware can lead to the
loss of sensitive data and control of the operated UAV system. The
accessibility of an attacker to the UAV’s flight stack could potentially lead
him to shutdown the UAV system, which results in a denial-of-service and
consequently disrupts the flight mission. Embedding such malware into UAVs can
significantly compromise their security and privacy. For instance, Maldrone is
a virus infecting the Flight Controller, enabling the attacker to control the
UAV [104]. It behaves as a proxy for the drone’s Flight Controller and sensor
communications, thus making the compromised drone land at any chosen location.
SkyJack is a hijacking malware that can be implanted on a malicious drone
[105]. It can wirelessly take over other legitimate drones through the Wi-Fi
de-authentication attack and compromise the whole system. Snoopy is a spyware
that can be equipped on a drone with the ability to steal personal information
from public users [106]. It uses impersonation techniques to trick the users
into joining a fake Wi-Fi network. Afterward, Snoopy tracks its users and
harvests their personal information. Recently, there has been an emerging type
of malware that consists of encrypting a user’s data or locking the system,
and holding it encrypted or locked until the user pays a ransom for the
adversary. This type of malware is known as ransomware [107]. To the best of
our knowledge, ransomware attacks have not targeted UAVs yet. However, it is
essential to consider that future ransomware might target UAVs, given their
popularity and civilian applications.

Zero-day vulnerabilities. Unknown vulnerabilities may exist in the UAV’s
flight stack or the GCS software (e.g., buffer overflow, DoS, etc.). These
vulnerabilities are unknown to the UAV’s manufacturers and can present
critical threats to the operators. The adversaries can continuously exploit
zero-day vulnerabilities until the UAV’s manufacturers release appropriate
patches. However, the operators need to update their UAV systems for every
patch released.

####  IV-C2 Software-based Attacks

Software-based attacks to UAVs include operating system attacks, tampering
captured videos, and system ID spoofing.

Operating systems attacks. Potential attacks against civilian or military
missions could happen through the Flight Controller’s system software. As a
result, the compromised system software will lead to the loss of the UAVs and
their payloads. Parcel-copters of the Prime Air service developed by Amazon is
an example of the civilian applications that can be subject to operating
system attacks [108]. Attacking the delivery system can potentially bring down
the delivery package for the recipient and consequently crash the drone.
Attacking UAV operating systems consists of remotely injecting malicious
software to UAVs such as Maldrone [104], then hijacking the drone by taking
control of the system. To that end, the adversary can extract the FC’s
cryptographic key and steal the stored unencrypted data.

Table V: Summary of Software-level security issues, existing countermeasures and their limitations  Software-based attacks/threats |  Countermeasures |  Limitations
---|---|---
Malicious software [104, 105, 106] |  -Firewall implementations. -The use of antivirus and IDS solutions. |  -Real-time detection of malware increases the computation costs.
Zero days vulnerabilities [48] |  -Periodic system update. |  -Some manufacturers can release the patches weeks after the zero-day disclosures.
Operating systems attacks [104] |  -Adopting the authorization mechanisms for UAV system resources. -Software-based attestation approaches [109] [110]. |  -In a multi-UAVs network, managing authorizations for a swarm of UAVs is challenging.
Tampering captured videos [66] |  -Firewall implementations. -Software-based attestation approaches [109] [110]. |  -Even with proper security measures, a legitimate user who joins the UAV network can still tamper the captured videos.
System ID spoofing [21] |  -Periodic system update. -Firewall implementations. |  -The use of social engineering techniques can reveal the System ID of UAVs since their manufacturers provide them.

Tampering captured videos. To guarantee safe navigation and avoid collisions
during a flight mission, the operating system uses system calls that enable
capturing the videos from the onboard camera [66]. However, a knowledgeable
adversary with the system parameters can intercept the issued system calls to
hijack UAVs. The adversary might also combine the tampering attack with a GPS
spoofing attack to control the flying drone. Unlike the operating system
attacks, the adversary’s primary goal is to compromise the navigation’s safety
and produce collisions.

System ID spoofing. According to the FAA’s regulations [45], UAVs should
provide their System ID and location to third parties such as federal agencies
and law enforcement when required. However, since most existing UAVs do not
implement encryption mechanisms, the attacker can impersonate a third-party
and execute an identity spoofing attack to compromise the communication link
and get the System ID of a UAV [21].

####  IV-C3 Countermeasures for Software-based Attacks

A regular operating system update can prevent compromising the UAVs and their
payloads. In addition, firewall implementations on the GCS can block sending
malicious traffic to the UAVs. Also, software-based solutions such as
antivirus and IDSs can monitor the network traffic and secure UAVs against
malicious activities. However, implementing onboard IDS is challenging due to
the computation and energy constraints. Further, enabling the authorization
mechanisms for UAV system resources can help to protect malicious code from
execution. A promising solution against software-based attacks is the use of
software-based attestation approaches. They ensure the integrity of software
running on the flight stack [109, 110]. Remote attestation solutions are low-
cost and they provide a strong legitimacy of the software stack.

At the Software-level, the adversary leverages malicious software and zero-
days to infect the flight stack. Moreover, the adversary can tamper the
captured videos to mislead the operator. These software-based attacks are
mitigated by adopting antivirus and IDS solutions. Furthermore, the operator
should keep his operating system updated and should implement software-based
attestation solutions to verify the legitimacy of the code running on the
operating system. However, It is worth mentioning that the provided defense
mechanisms against software-based attacks cannot fully protect the flight
stack from malicious activities. The patching process can take several weeks
for disclosed zero-day vulnerabilities. Thus, making the UAVs vulnerable to
adversaries. Furthermore, using IDS solutions or firewall implementations on
the GCS can increase the computation costs and cause latency issues. Table V
summarizes the the software security issues of UAVs, their existing
countermeasures, and limitations.

###  IV-D Communication-Level Issues

Communication is the critical component of the UAV system for flight control
and data transmission. Majority of the UAVs use wireless communication for
data and command exchange with the GCS. In this subsection, we provide the
communication-level vulnerabilities, threats, and attacks against UAVs that
compromise confidentiality, integrity, authenticity, and availability.

####  IV-D1 Communication Vulnerabilities and Threats

Communication-level vulnerabilities and threats can be categorized based on
the layers of communication as follows.

Physical & MAC Layer Vulnerabilities and Threats. The complexity of the
UAV-2-GCS wireless communication network opens potential vulnerabilities. For
example, in [48] the authors demonstrated three different attacks affecting
commercial Wi-Fi-based UAVs. These attacks are (1) Buffer overflow attack, (2)
DoS attack, and (3) ARP cache poisoning attack. Their experimental results
reveal massive security issues in UAV-2-GCS wireless communications. Choosing
the correct type of wireless communication technology depends on the
specification of the mission requirements (e.g., transmission range, operating
frequency, category, etc.). However, this choice does not guarantee the
flight’s success since we have to consider the security issues of each type of
wireless communication technology. Therefore, the fundamental question that
remains unanswered is which type of wireless communication technology achieves
a high level of security for UAVs for each application domain.

(a) Centralized architecture.

(b) Single backbone in a decentralized architecture.

(c) Swarm of UAVs in a decentralized architecture.

(d) Mixed UAVs in a decentralized architecture.

Figure 5: Threats for UAV communication networks in different architectures.

Network Layer Vulnerabilities and Threats. The UAV network operates in an ad
hoc fashion, commonly called FANETs. These networks have a dynamic topology
and they present critical threats. A prior work presented general security
threats of drone-assisted public safety networks [111]. It shows that the
increase in UAV network’s complexity results in more vulnerabilities to
attacks. These attacks target mainly sensor inputs and communication modules.
UAV communication threats such as intercepting or blocking the communication
link between the Flight Controller and the GCS might cause a potential DoS
attack. Furthermore, given FANETs unique characteristics that include the
latency and computational power to route data, there is a need to build
cryptographic algorithms for FANETs that takes these characteristics into
consideration [26]. An attacker can disrupt the UAV network by sending
malicious traffic directly through the GCS or indirectly through the UAVs.
Whether in a centralized or decentralized architecture, the GCS is constantly
threatened by adversaries. In both architectures, the GCS represents a single
point of failure, and the security of the whole UAV network depends on the
security of the GCS. However, even though the security mechanisms are
implemented for the GCS, the attacker can still interrupt the flight mission
by compromising the flying UAVs. It should be emphasized that in some
scenarios, the flight mission can still be considered successful even though
if one or multiple UAVs are compromised. In this case, and depending on the
civilian application, the operator requires a minimum amount of legitimate
(uncompromised) UAVs to accomplish the mission.

In a centralized architecture, as illustrated in Figure 5a, the adversary
needs to target and send malicious traffic to a specific number of UAVs, such
that the minimum number of legitimate UAVs required for the flight mission to
succeed cannot be satisfied. Consequently, the adversary causes the flight
mission to fail by disrupting the entire UAV network.

Alternatively, for a decentralized UAV network architecture, the adversary
needs only to compromise a particular UAV or UAVs to cause the flight mission
to fail. In fact, for a single backbone UAV network, as depicted in Figure 5b,
the adversary needs to send malicious traffic only to the backbone UAV since
it serves as a gateway between the other UAVs and the GCS. When the attacker
compromises the single backbone UAV, the group of UAVs or the whole network is
disrupted. Therefore, the single backbone UAV constitutes the weakest link in
the UAV network. For a single backbone UAV architecture, the UAV network’s
security depends on the security of the GCS, the single backbone UAV, and
their communication link. However, if the UAVs are similar in terms of shape,
size, and color, it is challenging for the adversary to determine the backbone
UAV. In multiple backbone UAVs architectures, the GCS and the backbone UAVs of
each swarm are particularly critical for the success of the flight mission.
However, even if a backbone UAV is compromised, the flight mission could be
completed. From Figure 5c, we notice that the adversary needs to compromise
four backbone UAVs or the GCS to disrupt the entire UAV network. Moving
forward to more advanced UAV network architectures in mixed UAVs, Figure 5d
shows that securing the network of backbone UAVs is as crucial as securing the
whole network. It is worth mentioning that the threats increase at the same
level as the network complexity and the number of UAVs increase. In Table VI,
we summarize the different attack points described for each UAV network
architecture that, if compromised by the adversary, the flight mission will
fail.

UAV routing protocols are vulnerable due to the inherent characteristics posed
by UAV networks such as dynamic topology, limited resources, and lack of
encryption in their wireless links [20]. In this context, the adversary
leverages these constraints to perform different routing attacks in the
network layer. The adversary can disclose critical information in UAV networks
which do not implement security mechanisms. With eavesdropping techniques, the
adversary can leak routing information, topology information, and UAV
positions [20]. Furthermore, without authentication and integrity
considerations, UAVs routing protocols are prone to additional attacks such as
DoS attacks or route-cache poisoning attack [112], where the adversary inserts
incorrect routing information into the caches of legitimate UAVs.

Table VI: Attack points of different UAV network architectures  Network Architecture |  Attack Points
---|---
Centralized Architecture |  -The Ground Control Station. -Specific number of UAVs.
Single Backbone UAV |  -The Ground Control Station. -The backbone UAV. -The GCS-2-UAV communication link.
Swarm of UAVs |  -The Ground Control Station. -The backbone UAVs of each swarm. -The GCS-2-UAV communication link of backbone UAVs. -The network of backbone UAVs.
Mixed UAVs |  -The Ground Control Station. -The backbone UAVs. -The network of backbone UAVs. -The GCS-2-UAV communication link of backbone UAV.

Transport Layer Vulnerabilities and Threats. UAV communication protocols
suffer from vulnerabilities leading to various attacks if not properly
secured. Despite their communication features, they must ensure basic security
requirements such as confidentiality, integrity, availability, and
authenticity. Recent studies show that MAVLink protocol, one of the most well-
known UAV communication protocols, is vulnerable to ICMP flooding and packet
injection attacks [59]. In addition, another transport layer protocol, the
UranusLink, checks only the integrity of the message. Consequently, the
adversary gathers the exchanged packets and discloses its content [61].

####  IV-D2 Communication-based Attacks

In what follows, we present the common attacks exploiting UAV communications
on the physical & MAC layer, the network layer, and the transport layer.

Attacks on the Physical & MAC Layer. Given the significant difference between
aerial networks and traditional wireless networks, there is a need to choose
the most suitable wireless technology for UAVs [1]. In this context, we
categorize for each wireless communication technology in the physical & MAC
layer, its unique features, and specific security issues. Although it is
possible to find surveys on the security of each wireless communication
technology on its own, we briefly list the major characteristics and security
issues of wireless communication technologies in UAV systems in Table VII.

Table VII: Security Issues of the Wireless Communication Technologies used in physical & MAC layer of UAV communications  Communication Technology |  Category |  Frequency |  Range |  Security Issues
---|---|---|---|---
Wi-Fi |  WLAN |  2.4-5 Ghz |  20-120 m |  -Commercial Wi-Fi-based UAVs are vulnerable to basic security attacks, such as Wi-Fi de-authentication attack [48]. -Unencrypted Wi-Fi networks allow the adversary to perform spoofing or jamming attacks [113]. -Popular attacks against the IEEE 802.11 standard exist in the literature (e.g., flooding attacks, Key Retrieving Attacks, ARP injection attacks, etc.) [114].
Bluetooth |  WPAN |  2.4 GHz |  10-200 m |  -The sequence extraction of Frequency Hopping Spread Spectrum (FHSS)-type controllers using a Software Defined Radio (SDR) enables the likelihood of performing Bluetooth sniffing [115]. -A family of different vulnerabilities of Bluetooth communication known as BRAKTOOTH can be applied in UAVs scenarios [116].
Zigbee |  WPAN |  2.4 GHz |  10-100 m |  -Threat analysis of autonomous UAVs shows that multiple vulnerabilities allow the adversary to locate the Zigbee transmitter, perform DoS and replay attacks [117]. -KillerBee is an example of an open-source exploitation framework designed to perform reconnaissance and exploit Zigbee vulnerabilities [118].
Long Range (Lora) |  LPWAN |  868 MHz 915 MHz |  05-15 km |  -The LoRa Alliance does not consider security implementations and lacks security controls on the network servers [119]. -End-to-end security between the application server and the end device is not covered. Therefore, no protection of data transmission exists in terms of confidentiality and integrity [120]. -Prone to various security attacks: jamming attacks, replay attacks, and wormhole attacks [121].
Sigfox |  LPWAN |  868 MHz 902 MHz |  03-30 km |  -Lack of data confidentiality and authentication [121]. -Sigfox does not support encryption [122].
Narrowband-Internet of Things (NB-IoT) |  LPWAN |  200 KHz |  10-35 km |  -Several layerwise passive and active attacks exist: Malicious code injection, Man-in-the-Middle attack, and jamming attack [121, 123].
Worldwide Interoperability for Microwave Access (WiMAX) |  WMAN |  2.3-5.8 GHz |  01-48 km |  -Considering UAVs as a collection of mobile nodes communicating within a WiMAX network, when compromised, they create a byzantine failure and disrupt the whole network [124]. -DoS attacks can target different resources: storage and processing resources (e.g., memory, storage, CPU), energy resources (e.g., battery), and bandwidth [125].
Cellular Technology (GPRS, EDGE, UMTS/WCDMA, UMTS/HSPA, LTE, LTE Advanced - 4G, 5G) |  WWAN |  Sub-6 Ghz |  World wide |  -Prone to jamming, spoofing, eavesdropping, hijacking, and DoS attacks [25].

Attacks on the Network Layer. The attacks on the network layer of UAV
communications include eavesdropping, DoS, man-in-the-middle, forgery, replay,
and other attacks on the FANETs.

a) Eavesdropping attacks. An attacker can perform an eavesdropping attack
through the UAV-2-GCS communication link by gathering data such as live video
feeds, sensor readings, and GPS data sent by the UAVs to the GCS. Since most
UAVs avoid encrypting the wireless communication for the sake of improving
communication performance [66], the attacker can eavesdrop on exchanged
information, including telemetry feeds and GCS commands. Therefore, he can
violate confidentiality of the communication and the data by gathering
sensitive information such as sensor readings and GPS data.

b) DoS attacks. An adversary can compromise a UAV system by launching a DoS
attack. In this case, the attacker can flood the flying UAV’s network card
with random traffic by sending multiple requests, causing an overload of its
resources and disrupting its availability. The impact of performing such
attacks on UAVs can result in a substantial increase in the network latency
and a decrease in the quality of video streaming applications for the user
[126]. Another way to perform a DoS attack is by sending large packets to the
GCS within a specific range to disable the control signal. Once the signal is
disabled, the drone goes into a lost link-state, which results in a
malfunctioning of the data link. Consequently, the operator can no longer send
or receive data signals to the Flight Controller, which results in disrupting
the communication link and losing control of the UAV. In [127], the authors
simulated a Distributed DoS (DDoS) attack on UAVs using botnets. The DDoS
attack was simulated by flooding the network traffic using User Datagram
Protocol (UDP) packets. This type of simulation demonstrates the possibility
of performing real-world DDoS attacks on UAVs. Besides, performing de-
authentication attacks can also disable the operator from controlling the UAV.
The de-authentication attack is a DoS attack that consists of sending de-
authentication packets to the UAVs to disrupt the UAV-2-GCS communication. As
a result, the adversary blocks the UAV-2-GCS communication, and eventually,
the UAVs are disconnected from the network. An example of such attacks is
demonstrated by Skyjack [105].

c) Man-in-the-Middle attacks. In this one of the most well known attack [128],
the adversary controls the UAV-2-GCS wireless channel and alters the benign
packets with malicious content [129]. Thus, the adversary can act as a bridge
between the UAV and the GCS, and compromise the bidirectional UAV-2-GCS
communication. A video replay attack is an example of a Man-in-the-Middle
attack, where the adversary fools the operator by transmitting malicious live
feed data. VideoJak [130] is an example of such attacks.

d) Forgery attacks. The adversary can compromise UAVs communication integrity
by transmitting a forged request to unauthenticated UAVs [111]. In this
attack, the adversary generates the malicious request by impersonating a
legitimate request and disrupts the UAV-2-GCS communication.

e) Replay attacks. In UAV networks, the adversary can perform an eavesdropping
attack to intercept several requests, then replay valid data to the UAVs. In
this case, the UAVs might receive repeated data, and if no replay protection
is implemented, the UAVs cannot distinguish the legitimate requests from the
malicious ones [111].

f) Attacks on FANETs routing. Different passive and active attacks can occur
in Mobile Ad hoc Networks (MANETs) routing protocols which consist of
injecting malicious nodes, controlling the network traffic, or disrupting the
routing functionality [20]. Most existing attacks targeting routing protocols
on MANETs are transferable to routing protocols on FANETs since FANETs is a
subcategory of MANETs. To illustrate these attacks, we classify them on three
categories based on their routing functionality [131]: i) the route discovery
attacks: they target the traffic control and include the blackhole [132],
sleep deprivation [133], sybil [134], and wormhole [135] attacks.  ii) The
route maintenance attacks: they aim to corrupt the routing control packets.
Examples of such attacks are flooding [136] and Byzantine [137] attacks. iii)
The data forwarding attacks: they include the type of attacks that impact the
payload traffic, such as real-time video traffic [138].

Attacks on the Transport Layer. Attacks on the transport layer of UAV
communication can be grouped based on the UAV transport layer protocols.

a) UranusLink Protocol Attacks. To the best of our knowledge, there is no
existing attack against the UranusLink protocol. According to the design and
implementation of UranusLink for real-world applications [60], UranusLink
provides only integrity protection via the checksum field in the messages.
However, an adversary with the ability to capture the exchanged packets can
benefit from this vulnerability and disclose mission-related information [61].

b) MAVLink Protocol Attacks. Authors in [58] classify MAVLink attacks into
four classes depending on how data is compromised: interception, modification,
interruption, and fabrication attacks. Since the MAVLink protocol does not
provide authentication and encryption, the adversary can capture communication
traffic through eavesdropping and thus collect exchanged data between the GCS
and the UAVs. Moreover, he can perform system ID spoofing attacks. Authors in
[139] presented a realistic scenario of compromising different UAVs operating
under MAVLink protocol. The considered specimen attack scenario demonstrates
an attacker’s ability to perform a stealthy attack by capturing a flight
mission’s system-ID and spoofing MAVLink packets.

####  IV-D3 Countermeasures for Communication-based Attacks

Different security approaches have been proposed in the literature to ensure
confidentiality, authentication, availability, and data integrity in UAV
communications. In what follows, we present existing countermeasures against
UAV communication-based attacks at the physical & MAC layer, network layer,
and transport layer.

Countermeasures for the Physical & MAC Layer Attacks. Securing the physical
properties of the communication channel (e.g., transmission medium, physical
topology, etc.) is one of the mitigations against the physical & MAC layer
attacks of UAVs. Given the wide use of UAVs across different wireless
communication technologies, it is important to consider that securing wireless
communications at the physical & MAC layer is challenging due to the
characteristics of each communication technology (e.g., category, frequency,
range, etc.). In addition, encryption algorithms such as AES can be employed
at the physical & MAC layer communications. Moreover, artificial noise
techniques that transmit generated noise to illegitimate users can also be
used [140]. In addition to these, one of the best practice for secure
communication in this layer is to keep the device firmware and and the related
software up to date using the released security patches. We would like to note
that, the attacks and the countermeasures for the wireless communication
technologies outlined in Table VII are vast and it is possible to find a
survey on the attacks and mitigations for each communication technology in the
list. For this reason, we do not go into much details with the countermeasures
against the attacks on these well-known and widely used communication
technologies in this survey.

Countermeasures for the Network Layer Attacks. To mitigate eavesdropping
attacks on UAV networks, the operator can adopt authenticated encryption
[141]. It consists of protecting the UAV-2-GCS communications by ensuring the
confidentiality and authenticity of the exchanged data. In [142], the authors
proposed an anti-eavesdropping power control algorithm in UAV communication
systems. Power control algorithms present an efficient approach for building a
UAV network topology that ensures the Quality of Service (QoS), and they are
also used to prevent eavesdropping attacks. In the presence of an
eavesdropper, the algorithm proposed by Zhang et al. [142] demonstrates that
by optimizing the trajectory and transmit power control between the UAV and
the GCS, we maximize the secrecy rate (the difference between the rate of the
UAV-2-GCS communication channel and the maximum rate of the eavesdropper
[143]). Moreover, adopting a continuous authentication against eavesdropping
attacks can identify a pilot’s unique profile during the flight mission [36].
Another solution aims to use fingerprinting techniques to authenticate UAVs
[144].

The use of cryptographic primitives such as public-key cryptography guarantees
the integrity and confidentiality of UAV communications. In [145], the authors
proposed a secure communication scheme for UAVs network using hierarchical
identity-based broadcast encryption (HIBBE) technique. The proposed approach
guarantees message confidentiality and authentication through identity-based
signcryption. Their performance analysis results showed that the proposed
scheme is resistant to DoS attacks. Another work presented a secure
communication protocol based on an efficient certificateless Signcryption Tag
KeyEncapsulation mechanism (eCLSC-TKEM) [146]. Furthermore, the protocol is
energy-efficient and meets security and efficiency requirements for UAV
communications. To secure commercial WiFi-based UAVs, the authors in [48]
presented a comprehensive multi-layer security framework. Their proposed
framework is efficient against basic security attacks such as ARP cache
poisoning attacks and DoS attacks. In [147], the authors presented a
lightweight FPGA hardware solution to secure UAV-2-GCS communication of
commercial Wi-Fi-based UAVs. It contains a cryptographic engine responsible
for encrypting the communication control data. Thus, ensuring confidentiality
and authentication. However, enabling cryptography-based approaches will
require additional computation in both GCS and UAVs and increase energy
consumption. Hence, these solutions may reduce the performance of the
UAV-2-GCS communication.

IDSs aim to detect malicious intrusion activities such as DoS attacks. They
can be deployed on the flying UAV or in the GCS. We distinguish three
intrusion detection approaches [62]: i) Rule-based intrusion detection, where
specific rules for UAVs are applied in which rules follow the expected
behavior of the UAV system [148]. ii) Signature-based intrusion detection,
which relies on attack signatures [149], and iii) Anomaly-based detection that
detects known and unknown attacks based on learning or filtering mechanisms.
However, these three approaches mentioned above cannot fully detect UAV
intrusions. For example, the signature-based detection approach is weak
against attacks that frequently change their patterns, which results in
changing their signature. Additionally, the anomaly-based approach may suffer
from false positives and false negatives. A recent work uses a hybrid
detection approach that combines two or more approaches for accurate detection
of unknown attacks [150]. Other intrusion detection solutions rely on using
packet analysis techniques to ensure data integrity and network availability
in UAVs [9].

In the literature, different security solutions have been proposed to secure
MANETs routing protocols from malicious actors [20, 55]. These approaches can
also be used in FANETs and include cryptographic schemes such as message
authentication, digital signatures, and hashing. Hence, enabling the
confidentiality and integrity of the UAV network. We distinguish the use of
secure-based routing protocols for FANETs to guarantee the routing process and
reliability in the presence of malicious nodes. This category includes the use
of security mechanisms in the routing protocols [55]. Examples of secure-based
routing protocols for UAVs networks are: SUANET (Secure UAV Ad hoc NETwork)
[151], PASER (Position-Aware, Secure, and Efficient mesh Routing) [152], SUAP
(Secure UAV Ad hoc routing Protocol) [131], AODV-SEC (Ad hoc On-demand
Distance Vector-Secure) [153], and SRPU (Secure Routing Protocol for UAVs)
[154]. Each of these protocols uses a specific strategy to satisfy the
security and privacy of the routing path. For instance, the SUANET protocol
uses a key management strategy between UAVs to enable confidentiality and
authentication services [151]. In contrast, PASER protocol utilizes
cryptographic functions to secure the routing packets in the UAV network
[152]. SUAP routing protocol prevents the flooding attack [131]. AODV-SEC
routing protocol ensures a secure route discovery process [153]. However, the
implementation of secure-based routing protocols in realistic scenarios is
challenging due to their complexity and high density.

Table VIII: Summary of UAV Network and Transport Layer security issues, existing countermeasures and their limitations  Layer |  Attacks/threats |  Countermeasures |  Limitations
---|---|---|---
Network
Layer |  Eavesdropping attacks [66] |  -The use of anti-eavesdropping power control algorithm in UAV communications [142]. -Adopting authenticated encryption [141]. |  -Cryptography-based approaches require additional computation and might increase energy consumption.
Network
Layer |  DoS attacks [126, 127] |  -Building IDS solutions [148, 149]. |  -Impact on the performance of the GCS-2-UAV communication. -The signature-based IDS fails against attacks that change their patterns. -The anomaly-based IDS can suffer from false positives and false negatives.
Network
Layer |  Man-in-the-Middle attacks [129] |  -Encrypting the communication control data [147]. -Implementing fingerprinting techniques to authenticate UAVs [144]. |  -Latency issues for time-critical UAVs applications.
Network
Layer |  Forgery attacks [111] |  -Enabling a multi-layer security framework [48]. |  -The complexity of the network increases in multi-UAVs scenarios.
Network
Layer |  Replay attacks [111] |  -Establishing a secure communication scheme (e.g., identity-based encryption) [145]. -The use of authentication mechanisms [37, 66]. |  -Repeated requests can flood the network and cause a possible DoS.
Network
Layer |  Blackhole [132], Flooding [136], Sybil [134], Wormhole [135], Sleep deprivation [133], Byzantine [137], and Forwarding [138] attacks |  -The use of secure-based routing protocols [55]. |  -High computation overheads and delay.
-The security features are supported only by few routing protocols.
Transport
Layer |  Attacks on communication protocols [61, 58] |  -Building a high-level architecture for resiliency and trustworthiness capable of repairing the flight mission despite the attack [139]. -Embedding security services into hardware modules. -The use of classical security approaches such as encryption techniques and IDS approaches. -Exploiting the features of emerging technologies such as blockchain [155]. |  -The introduction of trade-offs between performance and security.

Countermeasures for the Transport Layer Attacks. To prevent the adversary from
disclosing sensitive information in the transport layer, it is important to
implement security mechanisms enabling the confidentiality and integrity of
the exchanged data (e.g., cryptographic protocols, secure key exchange, etc.).
To mitigate MAVLink attacks, one approach proposes an architecture that
consists of repairing and completing the mid-flight mission despite the cyber
attack [139]. Other approaches also exist to secure the MAVLink communication
protocol. In [58], the researchers divided existing MAVLink security solutions
into hardware-based solutions and software-based solutions. Hardware-based
solutions rely on embedding security services into hardware modules, while
software-based solutions include classical security approaches like encryption
techniques and IDSs. Other solutions that aim to secure MAVLink communication
protocol might benefit from the features of emerging technologies such as
Blockchain and Software-Defined Networking (SDN) [38].

Table VIII summarizes the UAV network and transport layer communication
security issues, their existing countermeasures, and limitations. The
communication-based attacks on UAVs at different layers enable the adversary
to disrupt the communication link and jeopardize the flight mission. In the
literature, specific countermeasures have been developed to guarantee the
exchanged data’s confidentiality, integrity, and availability. These
countermeasures consist of building IDS solutions, adopting authenticated
encryption to prevent eavesdropping attacks, enabling a multi-layer security
framework, and using secure-based routing protocols. However, it is worth
noting that the countermeasures mentioned above for UAV’s communication-based
attacks have some limitations and shortcomings. For example, building IDS
solutions to prevent DoS attacks impact the performance of the UAV-2-GCS
communication. Besides, latency issues occur when encrypting the communication
control data. Moreover, the use of secure-based routing protocols
significantly increases the computation overheads and introduces delays.

##  V Privacy Issues of UAVs

The development of UAV technologies has raised a broad range of privacy issues
at high risk. In this section, we categorize the privacy issues according to
the entity being in risk and also the type of sensitive data that is leaked to
unauthorized users. The categorization we apply and follow in this section is
given in Figure 6.

###  V-A Privacy Risks

The privacy risks exposure of UAVs can be grouped into three categories: risks
for individuals, risks for organizations, and risks for UAVs. The privacy
risks for individuals are related to personal information obtained through a
flying drone, while the risks for organizations are associated with
organizational data that UAVs can collect. Risks for UAVs category concerns
sensitive data disclosed to third parties. Compromising data privacy refers to
compromising the secrecy of data that should not be revealed to third parties.

####  V-A1 Risks For Individuals

A recent study presented the privacy concerns posed by the use of UAVs in
airborne photography [156]. In [12], the authors divided the privacy leakage
into three classes: physical privacy, location privacy, and behavior privacy.

In physical privacy, the attacker captures images and videos of people inside
their houses for malicious purposes [157]. Spying activity on people through
UAVs is one of the significant physical privacy issues. Hence, the need to
establish regulations governing the use of UAVs in civilian airspace. UAVs can
also be equipped with directional microphones to eavesdrop on private
conversations.

Location privacy targets people’s physical locations and their movements
without their knowledge of being under surveillance [158]. Third-parties could
use it for business purposes (e.g., targeted advertising by location).
Nowadays, the use of UAVs switched from aerial surveillance to tracking
individuals [159]. Indeed, one of the most challenging issues is to tell
whether a flying drone is used for aerial surveillance or for tracking people
[24]. Detecting such privacy invasion attacks is still an open research
problem.

In behavior privacy, the attacker monitors the people’s lifestyle and
interests in public space [160]. Surveillance of individuals through
systematic monitoring of their behaviors constitutes a major threat to
behavioral privacy and may negatively impact people’s psychological level
[160].

####  V-A2 Risks For Organizations

Information and resources that an adversary maliciously harvests from UAVs may
not necessarily be personal [161]. In particular, UAVs can spy on
organizations through video streaming such as industrial espionage, and the
attacker can disclose the private information of government agencies and
corporations to unauthorized parties. For example, in a farming business that
uses a swarm of UAVs to optimize its operations and improve the corp
production, an adversary can spy on this organization by using the same UAV
model. In this case, we cannot distinguish between the friendly UAV and the
malicious one. It is known as the identification problem and exploited to
perform malicious activities such as terrorism and smuggling [24].

####  V-A3 Risks For UAVs

This category consists of leaking sensitive information monitored by the UAVs
to unauthorized third parties, such as video footage, photos, and physical
measurements. In addition, other types of sensitive data related to the flying
UAVs, including the real-time GPS location, speed, height, and battery status,
have to be preserved only for the operator. Preserving data privacy of the
flying UAVs is a fundamental requirement for the safety of the flight mission
[22]. In unencrypted communications, the adversary can perform a traffic
analysis attack by listening to the traffic and extracting sensitive flight
mission information. This type of passive attack compromises the
confidentiality and privacy of the UAV. Even in encrypted communications,
forensics techniques, including data extraction and analysis, can recover
digital data [162]. Another type of privacy attack targeting UAVs occurs when
the adversary has an unauthorized access to the critical components of the UAV
system such as the sensors and the storage (e.g., hijacking attack, injecting
hardware trojans, etc.). In this case, the adversary discloses flight data to
the public and jeopardizes the flight mission.

###  V-B Defense Mechanisms Against Privacy Risks

Several studies have suggested privacy-preserving mechanisms to prevent
leaking secret information to unauthorized parties. These mechanisms include
encryption techniques and the design of tamper-proof hardware so that even in
scenarios where the drones are hijacked, they cannot reveal sensitive
information. In [163], the authors suggested an approach to detect privacy
invasion attacks based on UAVs flight behavior. However, it fails to identify
a UAV’s purpose (whether it is legitimate or malicious). The researchers in
[164] presented a privacy-preserving authentication scheme for UAV control
systems. The proposed architecture has a mutual authentication to secure
communication between entities and integrates cryptography mechanisms such as
elliptic curve cryptography (ECC), digital signature, and hash functions.
Moreover, the suggested privacy protection protocol guarantees location
privacy and proves its applicability in sensitive control areas. Similarly, A
privacy-preserving authentication approach for UAVs was proposed in [165]. It
is a predictive authentication framework considering identity, location, and
flying routes as sensitive information. Other solutions can overcome privacy
issues, such as implementing access policies and lightweight cryptography
approaches. Some manufacturers include a list of no-fly GPS coordinates
covering sensitive areas in the firmware of their product. Moreover, regular
users can register their home location in the NoFlyZone Database [18].

Figure 6: Privacy issues of Unmanned Aerial Vehicles.

##  VI Pitfalls and Future Research Directions

As it appears and develops, the UAV technology brings certain advantages and
benefits to our society. However, it can also create new potential threats and
tools for malicious attacks for civilian users. Although the existing
countermeasures aim to protect the operators from malicious activities,
several open issues need to be addressed by the research community. In this
section, we firstly present the lessons learned; then, identify open issues
and discuss future research directions, which we believe will provide useful
guidance for future UAV security research and practice.

###  VI-A Lessons Learned and Pitfalls

The rise of UAV technology created a plethora of cyber attacks, such as
intercepting unencrypted data links from UAVs or spoofing the UAV network.
Protecting the flight mission requires a comprehensive defense-in-depth
approach.

UAV Manufacturer Issues. Our findings in this survey demonstrate that UAVs
lack protection from various attacks at different levels. A possible reason
for this shortcoming could be explained by manufacturers’ interests in
increasing the performance of their commercial products over security. Another
reason is the additional cost needed from manufacturers to implement security
mechanisms. Existing UAVs manufacturers should consider the security and
privacy aspects while developing their products in all the supply chain
phases.

Sensor-level Issues. At the Sensor-level, the diversity and complexity of
onboard sensors (e.g., chemical, physical, mechanical, etc.) makes them
targeted components for adversaries. Moreover, existing countermeasures
against spoofing, sniffing, or jamming onboard sensors are limited due to the
unique characteristics of UAVs. Although the existing security research covers
sensor-based threats and attacks [64], in the context of UAVs, we need to
consider additional parameters for UAVs such as the authenticity of sensor
readings, the energy and computation costs when securing sensed data against
malicious actors.

Hardware-level Issues. At the Hardware-level, despite the type and
characteristics of different commercial UAVs such as the firmware and hardware
type, UAV hardware could be targeted in the manufacturing process, or before
or during the flight mission. These scenarios are possible due to the
vulnerabilities that can occur in UAV firmware and also due to the lack of
encryption in custom chipsets. Given the popularity and diversity of existing
UAVs, it is important to build a unified hardware security strategy that
consists of protecting UAVs from hardware-based attacks.

Software-level Issues. At the Software-level, the adversaries can leverage the
zero-day and existing software vulnerabilities in the flight stack as well as
the GCS software to compromise the flight mission. The prevalence of software-
based attacks demonstrates the need to develop robust defense solutions for
UAV software security. However, existing UAV manufacturers avoid integrating
software security implementations in their products for performance reasons.
Therefore, the adversaries can take advantage of this gap to build malicious
software (e.g., Maldrone [104], Snoopy [106], SkyJack [105]).

Communication-level Issues. At the Communication-level, designing a Multi-UAV
network has to consider potential security issues according to the chosen
network topology. Many UAV protocols are not properly secured and pose serious
threats. Given that communication is a crucial part of the UAV system, we
argue that standardized UAV protocols enabling reliable and secure
communication have to be developed. Most of the existing communication
protocols in UAVs are unencrypted or have limited cryptographic capabilities,
thus enabling adversaries to compromise the communication channels. Moreover,
existing security measures to protect civilian UAVs from malicious users are
limited to single UAV systems [23]. Therefore, there is a need to develop
countermeasures for multiple UAV scenarios.

Security - Performance Tradeoff. At any level of the UAV, when implementing
security solutions, we need to assess the performance of the UAV system. In
particular, the communication costs, the computation costs, the storage
overheads, and the energy. However, adding an extra security layer for each
level without considering the abovementioned parameters might significantly
decrease the performance of the flight mission. Towards this point, we can
derive possible tradeoffs between the performance and security considerations
of UAVs.

Privacy Concerns. Besides security considerations, UAVs can also violate
personal privacy, from spying on people’s lifestyles to gathering sensitive
data about organizations. The deployment of UAVs in the civilian airspace
without specific regulations poses serious privacy concerns for individuals.
Moreover, sensitive information collected by UAVs and transmitted to the GCS
has to be protected from unauthorized parties. Therefore, privacy leakage has
to be considered during the design of UAV systems. Two significant scientific
gaps allow privacy invasion attacks: The purpose detection problem and the
identification problem [24]. The purpose detection problem consists of
distinguishing between a legitimate and a malicious nearby UAV that violates
an individual’s privacy. Existing approaches to solving the purpose detection
problem are minimal since they cannot detect spying actions on a specific
Point of Interest (POI) [163, 166, 167]. A recent study demonstrated using a
cryptanalysis approach, by applying a periodical physical stimulus (LED
flicker) on the spying UAV cameras, it causes a watermark on the encrypted
UAV-2-GCS communication traffic [168]. The detection of such a watermark
determines the legitimate or illegitimate purpose of the drone. However, this
approach is limited to the Wi-Fi First-Person-View (FPV) transmission in the
UAV-2-GCS communication channel. In the identification problem, given a multi-
UAVs scenario, it is likely impossible to identify a foe UAV among legitimate
ones. Although Identification Friend or Foe (IFF) methods [169] exist, they
fail to distinguish a foe UAV that is nearby to a legitimate one with the same
altitude and GPS location (less than 4.9 m [170]). Therefore, the malicious
entities leverage the existing scientific gaps to violate individuals’
privacy.

###  VI-B Future Research Directions

In this subsection, we present promising security and privacy research
directions of UAVs that could be investigated in future works.

UAV Forensics. When security incidents occur during a flight mission,
forensics analysts are required to analyze the compromised UAVs. However, it
is likely impossible to gather evidence from the drones that do not implement
logging capabilities [18]. More specifically, important data such as flight
trajectories and onboard-flight data are stored in the Flight Controller’s
volatile Random Access Memory (RAM), thus making the recovery process a
challenging task. Therefore, building models is highly required to provide
deep drone forensic analysis [171]. However, even with strong forensics
models, the existing anti-forensics techniques could potentially thwart the
digital investigation process [172]. A possible mitigation strategy considers
the adoption of a forensic-by-design approach, which integrates the forensics
requirements into the design of the UAV system [173]. Forensics investigation
of UAVs is an unexplored topic of research in UAV security. Existing digital
forensics models lack proper unification and standardization to enclose a
wider window of commercial UAVs. This is a major issue in UAV forensics, where
an adversary could potentially compromise specific UAVs where their forensic
models have not been covered yet.

UAV Intrusion Detection Systems. Detecting intrusions against UAVs during a
flight mission requires real-time analysis of the network traffic. To that
end, implementing an IDS for UAVs enables the detection of different classes
of intrusions such as signals modification, malware, routing attacks, and
message forgery attacks [148]. In addition, the development of anomaly
detection frameworks to monitor malicious behaviors plays an important role in
detecting attack patterns [174]. Besides, the adoption of honeypot and
honeynets along with the IDS can help to protect the flight mission from
malicious entities [175]. Since UAV networks constitute a complex cyber-
physical system that incorporates multiple components [10], the intrusion
detection approaches should consider different information gathering sources
to increase the performance. However, more information sources can also
increase the communication cost and also result in high computation overhead.
Developing such solutions is challenging due to the existing tradeoffs between
security and performance. Therefore, there is a need to implement lightweight
IDSs to monitor UAV communications and detect attacks. In this respect, some
solutions utilize the behavioral profiling of the flight to detect abnormal
behavior and malicious intrusions [176]. However, cyber attacks that
compromise UAVs while ensuring that the flight pattern is consistent cannot be
detected by such approaches.

Secure UAV Communications. The outcomes of our study at the UAV Communication-
level demonstrates the need to develop proper UAV communication protocols and
thus to provide reliable and secure communication between different components
of the UAV system. However, securing UAV communication channels while
achieving a maximum network throughput is still a challenge for the research
community. Additionally, authentication of UAVs can secure the communication
link and prevent impersonation and replay attacks [177]. Developing access
policies for UAVs such as authorization and authentication schemes is still a
challenging research topic [12]. Indeed, any unauthenticated UAV should not be
part of the flight mission or gather exchanged data from other UAVs in the
network. On the other hand, in multi-UAV scenarios, the use of specific
networking models for UAVs such as FANETs [51] enables the multi-UAV
operations. However, FANETs are vulnerable to different attacks [26], and
establishing secure communication in Multi-UAVs network remains an open
research topic. Although several FANETs routing protocols were proposed in the
literature [54], they cannot fully meet the security and privacy requirements,
and further research in this category is needed [20].

Realistic Implementations. Practical development and deployment of UAVs
requires an emphasis on the tradeoffs between security and performance. From a
security point of view, we have to consider the security and privacy
requirements of the UAV system. Moreover, we need to consider the energy,
computation costs, and storage overheads from a performance perspective. For
example, implementing authentication mechanisms or developing lightweight
cryptographic protocols for energy-constrained UAVs incorporates the use of
cryptographic primitives. However, such implementations might consume too much
energy and increase the computational cost. Therefore, finding a strategic
solution and balancing both sides is considered a major open research topic.
Existing security countermeasures operate under specific hardware or software
settings. Therefore, when proposing real-world implementations, we must
consider the possible deployment challenges among different UAV systems. A
possible solution consists of unifying a deployment interface for various
types of UAV systems. Also, it should be emphasized that simulating cyber
attack scenarios of UAVs in advance could demonstrate the resilience of
existing security measures against cyber attacks before their deployments.
Besides, existing simulation environments for UAV security analysis are
limited [178], and this topic deserves further research efforts.

Privacy Preservation. The integration of UAVs in the national airspace has
raised privacy preservation issues. These implications lead to the leakage of
sensitive data collected by UAVs. The collected data might be uploaded to
third-party organizations such as cloud servers for storage or processing
purposes. In this context, there is a need to protect the privacy of
outsourced data. Different privacy-preserving approaches have been proposed in
the literature. Examples of mitigating privacy invasion attacks include using
privacy-enhancing technologies to preserve consumers’ data and guarantee
privacy protection with third-party organizations. Namely, the secure
computation or differential privacy mechanisms support the privacy of
individual users and permit the data coordination between UAVs while
guaranteeing privacy. Other examples include the use of homomorphic encryption
to perform computational operations over encrypted data [179] and the Zero
Knowledge Proof (ZPF) to validate data without disclosing it.

Secure Data Aggregation. The extensive use of UAVs in different application
domains increased the amount of collected and shared data. The collected data
is usually aggregated to use the resources efficiently. However, the data
aggregation process needs to be protected against malicious actors. The
deployment of aggregation schemes should consider encryption techniques to
provide confidentiality, thus enabling a secure transfer of information
between the GCS and UAVs. In addition, providing efficient and secure data
aggregation approaches for UAVs will reduce the energy and communication costs
while ensuring confidentiality. However, developing such schemes remains an
ongoing challenge.

Emerging Technologies. Recently, there has been an extensive use of emerging
technologies to secure UAVs: Artificial Intelligence, Blockchain technology,
SDN, and Fog Computing [38] [34]. These technologies are applied in various
civilian applications. The distributed architecture of Blockchain technology
adds an extra layer of security at the communication level [180]. With Smart
Contracts, cryptographic hash functions to store data as a chain of blocks,
and the consensus mechanisms, it becomes challenging for the adversary to
tamper with UAVs communication. However, the major applications of Blockchain
for UAV communication security suffer from real-time deployment for highly
mobile UAVs [181]. Moreover, the real-world implementation of Blockchain
technology to secure UAV networks is still an ongoing research topic. The
evolution of Artificial Intelligence technology such as ML algorithms has
demonstrated tremendous benefits for security-oriented applications, such as
protecting UAV networks from attacks and privacy leakage. Different ML-based
security frameworks have been proposed in the literature to address various
security issues, including malicious drone detection and DoS attacks [182].
Recently, federated learning techniques are reported to show better results
compared to traditional ML algorithms. For example, the use of drone
authentication models based on drone’s Radio Frequency features in IoT