Unmanned Aerial Vehicles (UAVs) rely on wireless communication with a Ground Control Station (GCS) for flight control, primarily using the Micro Air Vehicle Link (MAVLink) protocol. However, MAVLink lacks essential security mechanisms, making UAVs vulnerable to attacks. We introduce a stealthy relay-based Man-in-the-Middle (MITM) attack called Shadow-GCS, in which an unauthorized node relays MAVLink messages to maintain normal communication while injecting commands. The Shadow-GCS attack enables an adversary to monitor and control UAVs without triggering alerts at the GCS. To assess the attack’s detectability, we collected a dataset from four realistic UAV-GCS scenarios. We then evaluated two existing MAVLink intrusion detection systems (IDSs), revealing their limitations in identifying attacks that do not significantly alter normal communication flow. To overcome these limitations and develop a more generalized intrusion detection capability, we propose GALAXY, an attention-based LSTM model with a single LSTM layer, where the attention weights are jointly derived from the hidden state and local statistical features. Experimental results show that GALAXY achieves detection performance comparable to a stacked LSTM baseline while offering improved interpretability.
Download Link: Download
Please cite our dataset's page when you use this dataset as follows.
Jae Yeon Lee, Huy Kang Kim "GALAXY: Generalized Attention-based LSTM Architecture with external query for Intrusion Detection in UAV Communication" 2025 IEEE 30th Pacific Rim International Symposium on Dependable Computing (PRDC)
Huy Kang Kim (cenda at korea.ac.kr)