UC-05 · Aviation use case

Command-and-Control Link Security

Evaluating and hardening the MAVLink link between ground control stations and drones, and detecting hijacked vehicles.

TC1TC3NVCCVanderbiltGWUCollins
in a communication-constrained fleet where graph learning detects compromised membersVanderbilt
18 drones

The problem

Most small drones talk to their ground control station over MAVLink, an open protocol for telemetry, missions, and commands. In its default configuration it is neither authenticated nor encrypted, so the command uplink and telemetry downlink are exposed.

Our approach

  • Testing the link. In software-in-the-loop testbeds, NVCC research interns working at GWU evaluated the control link and measured the effect of standard mitigations. MAVLink 2 message signing blocked injected commands, but telemetry remained readable without encryption or a secure tunnel.
  • An independent check from traffic management. The 2026 interns built GridEye, a read-only UTM monitor that tracks a simulated delivery fleet and enforces flight boundaries, no-fly zones, and altitude limits, offering a second, independent view of where aircraft really are.
  • Detecting hijacked vehicles. Vanderbilt generates attack datasets from its networked UAV simulator and develops learning-based detectors, including graph methods that spot a compromised drone by comparing it with its neighbors under tight communication budgets.
  • Hardening by design. Collins Aerospace’s zero-trust patterns include public key infrastructure and secure channels for MAVLink.

Looking ahead

Year 3 integrates detection with the networked simulator and zero-trust patterns into end-to-end demonstrations.

NVCC · GWUUC-05Software

GridEye UTM monitor

A walkthrough of GridEye, the read-only traffic-management dashboard built by NVCC interns. It tracks a 12-drone delivery fleet over simulated Frisco, Texas, and flags flight-boundary, no-fly-zone, and altitude violations.

VanderbiltUC-05Simulation

Scaling to large fleets

Dozens of simulated vehicles launched in a single experiment, showing how the simulator scales for cyberattack studies.

VanderbiltUC-05Simulation

Multiple operators, separate ground stations

Simulated drones, each linked to its own operator’s ground control station, as in the multi-operator setting of the FAA UTM concept of operations.

VanderbiltUC-05Simulation

Networked UAV simulation over a city

Vanderbilt’s networked simulator flies many drones from multiple operators over a downtown map, each running its own ArduPilot autopilot. It’s the platform used to generate attack datasets and evaluate detectors.

Tools & datasets

Publications

  1. Detection of Compromised UAVs Using Graph Machine Learning

    N. W. Dahle, R. Canady, A. Coursey, A. Diaz-Gonzalez, C. Lemieux-Mack, B. Bjorkman, A. Taye, B. C. Ward, G. Biswas, X. Koutsoukos

    AIAA SciTech Forum, 2026

  2. Networked Simulation for Cybersecurity Evaluation of Small Unmanned Aircraft Systems in Dense Urban Environments

    A. Diaz-Gonzalez, A. Coursey, B. Bjorkman, D. Shatokhin, C. Lemieux-Mack, N. W. Dahle, A. Taye, R. E. Canady, X. Koutsoukos, G. Biswas, B. C. Ward

    AIAA SciTech Forum, 2026