SHIELD: Drones should recognise cyber attacks and recover themselves

Cyber security researchers at Florida International University (FIU) are developing SHIELD, a security system for drones that enables drones to independently recognize cyber attacks during flight and recover from them. Attempts at manipulation are recognized using artificial intelligence (AI).

Cyberattacks on drones can disrupt their missions and sometimes even destroy the drones themselves—for example, through a forced crash. To prevent this, FIU scientists have developed a system that continuously monitors the drone's entire control, drive, and sensor systems to recognize signs of a malicious attack. The system can also initiate an appropriate recovery process depending on the type of attack, as the researchers write in the study “I will always be by your side': A Side-Channel Aided PWM-based Holistic Attack Recovery for Unmanned Aerial Vehicles,” which was published in 2025 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks.

Cyberattacks on drones are not only aimed at manipulating their sensors, for example by spoofing GPS coordinates to influence the drone's position. They are also increasingly trying to directly influence the control and drive systems. For example, malware is being infiltrated into the drone's hardware so that it can be taken over and manipulated by attackers.

“For this reason, a detection and recovery system that only considers the sensors misses the bigger picture,” says Muneeba Asif, a PhD student at FIU and co-author of the study. “It will be blind to other attacks happening throughout the system and at different levels.”

Detection of hardware and sensor anomalies

SHIELD is designed to detect anomalies in the sensors and hardware. Sudden power spikes or overloaded processors, for example, indicate that a cyber attack is taking place on a drone. However, the FIU scientists say that there are many other indicators in the battery and other drone components that can point to an attack. In several hardware-in-the-loop simulations in the laboratory, the researchers discovered that every cyberattack on a drone leaves a unique signature and has different effects on the drone system.

The scientists trained AI models with hardware and sensor data so that they could then use the models to detect anomalies in the control, drive, and sensor data. Possible attacks are also classified accordingly, and an appropriate recovery process is initiated. This worked in the laboratory within one second. In most cases, the average detection time was 0.21 seconds and the recovery time 0.36 seconds.

The researchers now want to subject the system to extensive further tests and then put it into practice.

(olb)