Cybersecurity Risks and Computer Protection Strategies for Data Transmission of Civil UAVs

Abstract

Civil unmanned aerial vehicles (UAVs) increasingly serve critical infrastructure monitoring, precision agriculture, urban delivery, and emergency response missions—functions that rely on continuous, high-fidelity data transmission. However, their communication channels—primarily operating over unlicensed ISM bands using Wi-Fi, LTE-M, or proprietary RF protocols—are inherently exposed to eavesdropping, message injection, GPS spoofing, command hijacking, and denial-of-service attacks. This study systematically evaluates the cybersecurity threat surface across three operational layers: radio-frequency link integrity, onboard telemetry encryption robustness, and ground station authentication resilience. Using a controlled testbed comprising DJI M300 RTK and custom-built Pixhawk 4-based UAVs, we conducted 127 adversarial trials simulating jamming, man-in-the-middle interception, firmware-side channel leakage, and beacon replay under varying signal-to-noise ratios (12–38 dB) and latency conditions (28–215 ms). Results demonstrate that unencrypted MAVLink telemetry is compromised within 1.7 seconds on average during active sniffing; TLS 1.3-secured C2 links reduce successful session takeover attempts by 94.3% but introduce median latency spikes of 42 ms; and GPS anti-spoofing via multi-constellation RAIM validation increases time-to-lock by 3.8 seconds yet prevents 100% of tested spoofing vectors below 5 m/s velocity delta. We propose a lightweight, hardware-accelerated hybrid protection framework integrating authenticated encryption with associated data (AEAD), adaptive frequency hopping, and cryptographically signed flight log attestation. Validation confirms end-to-end transmission integrity at ≤18 ms added overhead and zero false positives in signature verification across 42,000 logged packets. These findings provide actionable, empirically grounded strategies for securing civil UAV data pipelines without compromising real-time responsiveness or regulatory compliance.