Artificial Intelligence Methods for Unmanned Aerial Vehicles Cybersecurity: A Comprehensive Survey

1. Introduction

In recent years, UAVs [1] have continued to evolve as indispensable assets not only for the military, but across a wide range of civilian, commercial, and industrial applications. With possible usage [2] ranging from aerial surveillance, disaster response, and monitoring to urban mobility, logistics, and agriculture, UAVs are quickly integrating themselves into multiple facets of society. The significance of making sure that they operate securely and reliably is highlighted by their increasing autonomy, communication capabilities, and deployment in crucial operations. However, the widespread adoption of UAVs creates an extensive and expanding attack surface [3]. Since UAVs depend on satellite-based GPS navigation, wireless communication, and frequently centralized or swarm-based communication, they are vulnerable to a variety of cyber-physical threats. Notable examples of cyber attacks include Distributed Denial-of-Service (DDoS) attacks, data injection, GPS spoofing, and manipulation of the Automatic Dependent Surveillance–Broadcast (ADS-B) [4]. Such attacks can have substantial grave consequences for security and privacy.

Traditional cybersecurity measures, while essential, are increasingly unable to deal with the dynamic and adaptive nature of emerging threats. As a result, researchers are employing AI to complement UAV systems with cybersecurity [5], which would make them more robust and flexible. AI methods, particularly those based on machine learning and deep learning, have the ability to identify abnormalities, categorize threats, forecast hostile behavior, and even react to attacks on their own in real time. Conversely, emerging AI paradigms including RL, FL, GNN, and GAI, have been emerging as solutions that address different and sometimes novel UAV security threats.

Several surveys have examined security, privacy, and operational challenges in UAV systems across civilian, military, and commercial domains as outlined in Table 1. However, these contributions remained fragmented as they did not cover all the spectrum of AI methods. In particular, several surveys focus only on the threats and traditional security measures, without a dedicated AI Model Taxonomy (AIMT) while others stop short at exploring the usage of ML and/or DL in UAV security. However, there is a pressing need of exploring how emerging sub-fields of AI, such as FL, RL, GNN and GAI, relate to UAV security. Also, no survey covered the Tools, Datasets and Metrics (TDM) used as part of the evaluation of AI models used in UAV security.

Cordill et al. [6] provided a systematic analysis of UAV vulnerabilities, classifying them into hardware, software, and communication attacks while emphasizing privacy concerns, including ethical UAV surveillance and compliance with frameworks such as General Data Protection Regulation (GDPR). The authors review state-of-the-art technical solutions such as lightweight encryption, blockchain-based security, and privacy-preserving machine learning, highlighting the integration of both technical and policy perspectives for holistic UAV network security. Tsao et al. [7] focused on security within flying ad-hoc networks (FANETs) and the Internet of Drones (IoD), categorizing threats based on UAV connections with ground control stations and pilot devices. The survey evaluates conventional and novel UAV routing protocols from a cybersecurity perspective and assesses defense mechanisms against key requirements such as availability, authentication, authorization, confidentiality, integrity, privacy, and non-repudiation. Similarly, Rahman et al. [8] and Al-Syouf et al. [9] provided detailed overviews of FANETs and IDS frameworks, emphasizing high-accuracy detection, feature selection methods, datasets, and performance metrics for UAV network security.

Bithas et al. [10] and Syed et al. [11] reviewed the application of ML, blockchain, and digital watermarking for UAV security. ML techniques enhance threat detection and resource management in UAV networks, while blockchain ensures decentralized trust and watermarking secures transmitted media. Sarikaya and Bahtiyar [12] extended this discussion to deep reinforcement learning (DRL), highlighting adaptive, intelligent countermeasures that complement conventional defense strategies. Wang et al. [13] focused on UAV swarm networks, discussing attacks such as DoS, Man-in-The-Middle (MiTM), and threats against ML models, emphasizing AI-driven and adaptive security mechanisms. Adil et al. [14] examined UAV-assisted IoT applications, categorizing primary threats, reviewing countermeasures, and identifying open research challenges in dynamic, wireless network deployments. Tlili et al. [15] complemented these surveys by presenting a taxonomy of AI-based UAV security approaches, analyzing prevention and detection techniques, and highlighting open research challenges. Yang et al. [16] further explored traditional ML and deep learning (DL) methods for UAV threat mitigation, while introducing large language models (LLMs) as emerging tools for adaptive decision-making.

Abro et al. [17] provided a broader overview of UAV detection, classification, and tracking technologies, identifying vulnerabilities such as control signal jamming, while highlighting relevant legislation and communication standards. Autonomous multi-UAV systems are addressed by work employing the STRIDE model to prioritize cybersecurity threats and propose security design recommendations for safe multi-UAV deployment [18]. Pandey et al. [19] surveyed UAV-assisted networks, detailing intrusion taxonomies, performance metrics, and proactive mitigation strategies integrating mmWave, NOMA, massive MIMO, cognitive radio, software-defined networks, edge/fog computing, blockchain, and ML for secure UAV communications. Similarly, UAV integration into cellular networks is reviewed by [20], highlighting UAV-mounted base stations, interference management, connectivity optimization, regulatory compliance, and cyber-physical security challenges.

Alzubaidi [21] focused on UAV malware detection using ML and DL, providing taxonomies and identifying research gaps and future directions. Mohsan et al. [22] provided a foundational survey on UAV types, swarms, classifications, charging methods, regulations, applications, operational challenges, and security concerns, providing context for the increasing deployment of UAVs across domains. The Internet of Drones (IoD) is highlighted by Ogab et al. [23], emphasizing dynamic UAV networks leveraging IoT for autonomous, collaborative tasks. Despite offering adaptability and scalability, IoD introduces unique security challenges, including resource-constrained IDS deployment, high false positive rates, and limited adaptability to evolving attacks. Systematic reviews consolidate research on ML-based IDSs, datasets, attack classifications, and software environments, providing structured insights into current trends, limitations, and future research directions.

In this survey, we present a thorough analysis of the ways in which artificial intelligence is being used to improve UAV system security. By using a novel taxonomy, we classify and examine the most advanced artificial intelligence techniques available today, encompassing both supervised and unsupervised learning as well as cutting-edge approaches like graph neural networks, reinforcement learning, privacy-preserving federated learning, and generative AI. We also list the commonly used tools and datasets in the research intersecting AI and UAV security. By using this lens, we hope to map the field of AI-driven UAV security research, pinpoint important trends, evaluate present issues, and point out exciting new avenues for future study.

The main contributions of this survey are as follows:

• We developed a novel taxonomy to classify the AI research used for securing UAVs, which goes beyond classical machine learning and deep learning to cover emerging fields such as federated & reinforcement learning along with GNN and generative AI.
• We proposed a refined taxonomy of UAV threats according to its layered stack.
• We described the tools, datasets and evaluation metrics used as part of the AI research for securing UAV operations.
• We highlighted the key insights from our survey by discussing the statistics of coverage of security properties by AI method type versus overall.
• We discussed open challenges and future directions in UAV security using AI.

The remainder of this paper is organized as follows as seen in Figure 1. Section 2 provides a background overview of UAV architecture and threat model. Section 3 describes the proposed taxonomy. Section 4 describes the machine learning methods while Section 5 describes deep learning methods. Section 6 discusses the federated learning methods, Section 8 describes GNN methods, and Section 9 describes generative AI methods. Section 10 presents the tools, datasets and evaluation metrics. Section 11 summarizes and discusses the findings. Section 12 summarizes the key insights from this survey. Section 13 discusses open challenges while Section 14 describes a glimpse on future directions. Finally, Section 15 concludes the paper.

2. UAV Architecture & Threat Model

2.1. UAV Architecture

As illustrated in Figure 2, the architecture of UAV systems is made up of a number of closely related subsystems, particularly those utilized in autonomous or remotely piloted missions. In general, a UAV system consists of the following parts:

• Airborne Unit: The physical drone platform includes flight control systems, sensors (GPS, IMU, cameras, and LiDAR), actuators, and mission-specific payloads.
• Ground Control Station (GCS): Interfaces that allow human operators to monitor and control UAVs, send commands, and receive telemetry data.
• Communication Links: Wireless channels (usually radio frequency) are utilized for control, telemetry, video transmission, and swarm coordination among UAVs.
• Cloud or Edge Infrastructure: Some modern unmanned aerial vehicles use cloud-based platforms or adjacent edge servers for computing offloading, data analysis, or fleet coordination.

The UAV system layer stack is rich and diverse, covering a wide range of functions required for remote operations. Actually, there is no widely agreed upon layer stack despite strong contenders such as [24,25]. At the bottom of this system layer stack sits is the physical layer, which collects sensor data along with other functions related to interact with the actuators and radio frequency hardware. The communication layer collects and transmits sensor data, system status updates, and provides command & control links in addition to data links. The navigation layer relies on GPS or GNSS to offer precise localization and route planning. Above this, the control layer transmit flight instructions from the Ground Control Station (GCS) to the UAV via radio frequency (RF) channels, frequently utilizing standardized protocols like MAVLink. Finally, the application layer manages mission-specific functions such as object tracking, delivery scheduling, and environmental monitoring, depending on the UAV’s intended use case. These communication channels are vital to mission success, but they are also great targets for cyber-attacks since they are wireless and frequently un-encrypted.

2.2. Threat Taxonomy in UAV Systems

UAVs face a distinct and diverse set of cyber-physical threats due to their mobility, reliance on wireless communication, and increasing autonomy. Threats range from attacks on navigation and communication systems to software vulnerabilities and physical tampering. The classification of cyber attacks highlights the most serious attacks clustered according to their respective layers where they take place as follows:

• Physical Layer:

  –

  RF Jamming: overwhelms any radio-based communication between the UAV and the GCS by sending high power noise signal on the same frequency.

  –

  Sensor Manipulation: is done by tampering with the inertial and perception sensors used by UAVs to force erroneous state estimations.

  –

  Actuator Manipulation: can be done via various techniques such as signal injection, interference, power disruption and physical tampering.

• Communication Layer:

  –

  DoS/DDoS: DoS and DDoS attacks aim to overwhelm the UAV’s communication or computing capabilities. This could result in high latency, diminished mission performance, or even a total loss of control.

  –

  MiTM: In MitM scenarios, attackers intercept and manipulate communication between the UAV and the GCS. This facilitate the occurrence of other attacks such as command hijacking, telemetry injection, and illegal access to control channels.

  –

  Message Injection: include leveraging vulnerabilities in widely used protocols in UAV communication to inject malicious data. This includes but is not limited to ADS-B and MAVLink.

• Navigation Layer

  –

  GPS Spoofing: GPS spoofing [26] entails sending deceptive signals to confuse the UAV’s navigation system, potentially resulting in route diversion or collisions.

  –

  Sensor Fusion Attacks: represents a stealthier version of sensor manipulation as it can evade sensor fusion algorithms such as Kalman Filter.

• Control Layer:

  –

  Command Injection: leverages vulnerabilities in drone software or communication links in order to take partial or full control of the UAV

  –

  Command Suppression: happens when the attacks injects higher priority or conflicting commands thus overriding the legitimate one sent from GCS.

• Application Layer:

  –

  Malware: represents any malicious code deployed within the UAV ecosystem to perform malicious actions affecting mostly UAV applications such as mission planning and AI modules.

  –

  Data Poisoning: occurs during training by injecting malicious entries to corrupt the UAV learning mechanism. It occurs during offline or federated training.

  –

  Model Evasion: occurs during runtime inference by injecting adversarial inputs by leveraging lack of robustness that leads to misleading the AI models.

  –

  Software Exploitation: Vulnerabilities in UAV operating systems, firmware, or onboard apps can be used to acquire persistent access, elevate privileges, or disable security features. Once compromised, attackers may maintain covert control over the UAV.

These cyber-attacks can be highly dynamic and context-dependent. As a result, intelligent and adaptive security solutions are becoming increasingly important, driving the adoption of AI-based defenses.

3. Taxonomy of AI Methods for UAV Security

The application of AI into UAV security represents a substantial shift away from conventional, rule-based defenses and toward data-driven and adaptive procedures. Due to their mobility and need for wireless connection, UAVs are vulnerable to both physical and cyber threats. Despite their merits, traditional cybersecurity methods often miss unseen and adaptive attack patterns. AI techniques get beyond these limitations by modeling abnormalities, learning behavioral patterns, and, in some scenarios, adapting on their own to unfavorable circumstances.

Figure 3. UAV architecture.

Figure 3. UAV architecture.

This section describes the novel multi-dimensional taxonomy we developed to classify the AI-based research in the context of securing UAV systems. This taxonomy relies on three main dimensions as follows:

• AI Model Type: this is the main dimension covering all variety of traditional AI models such as ML and DL, and more advanced ones such as FL, RL, GNN and GAI.
• Attack Type: this is the second dimension that covers the cyber attacks thwarted by the AI models in each model type. These attacks are further refined according to the functional UAV layer, i.e. physical layer, communication layer, navigation layer, control layer and application layer.
• Security Property: this is the final dimension, which covers the security properties enforced by the proposed works in each AI model category.

Our coverage of security properties goes beyond the classical CIA triad, which represents the foundation of cybersecurity, to include other critical properties in UAV systems such as authenticity and privacy. In fact, authenticity implies verifying the identity of the source of sent data to/from UAVs, while privacy focuses on protecting against sensitive inference that is very important in AI-based systems for UAV security. In addition, such systems can be vulnerable against adversarial inputs thus we consider robustness as part of the security properties due to its role in achieving resilience against such perturbations.

Inclusions criteria of the papers in our survey are described as follows:

• Publication year: we considered recent papers published between 2020 and 2025.
• Reputable publication venue: IEEE, ACM, Elsevier, Springer, MDPI, or similar journals and/or conferences.
• Scope: directly related to AI methods used for UAV security.

4. Machine Learning Methods

Classical and supervised ML techniques [27] have long been used to protect UAV networks by identifying intrusions, spoofing, jamming, and aberrant behaviors via flight data, network traffic, or radio frequency (RF). As seen in Table 2, classical and supervised machine learning algorithms are very popular for UAV security. These algorithms, which use telemetry, network traffic, and RF characteristics, can perform real-time detection under stringent resource limitations, laying the groundwork for more advanced AI-based approaches like deep learning, reinforcement learning, and federated learning.

MAVIDS [28] is an onboard intrusion detection system that uses principal component analysis (PCA) and one-class anomaly detection to detect GPS spoofing and jamming attempts based on UAV flight logs. MAVIDS operates without labeled attack data, under severe onboard resource constraints, and achieves macro-averaged F1 scores of 90.57% and 94.3%, respectively, while retaining real-time detection capabilities even during communication disruptions. Supervised machine learning algorithms have also been used to UAV network traffic.

Moustafa and Jolfaei [29] created a testbed that generated both benign and malicious UAV traffic. They trained classifiers such as Decision Tree, KNN, Naïve Bayes, SVM, and shallow MLP. The Decision Tree achieved the best accuracy (99.99%), followed by KNN and MLP ( 99.98%). SVM reached competitive accuracy ( 99%) but had the largest fall-out rate (2.245%). Although rapid to train, Naïve Bayes fared poorly (39.9% accuracy). These findings show that lightweight supervised machine learning models, particularly decision trees, can achieve high accuracy with low computing overhead, enabling real-time intrusion detection for UAV networks.

Shafique et al. [30] employed handcrafted GPS-derived features, such as jitter, shimmer, and frequency modulation, combined with SVM classifiers and a K-fold voting method, to discriminate authentic from counterfeit signals, obtaining 98.7% accuracy and 0.98 F1 score. Agnew et al. [31] investigated predictive modeling of network-level performance statistics, including inter-arrival time, transmission latency, and packet count, for ML-based intrusion detection in SD-UAV networks. Classifiers were able to detect jamming, blackhole, and grayhole attacks even under zero-day settings by simulating normal traffic using queuing theory, enhancing training efficiency and enabling rapid anomaly identification. Lightweight high-precision models, such as Fuzzy Rough Set (FRS) based IDS combined with Shallow Neural Networks (SNN) and Random Forest (RF) [32], maintain 99% accuracy and low false alarm rates on datasets such as CIC-DDOS2019. This offers interpretable and resource-efficient alternatives to deep learning for constrained UAV hardware.

Identification of UAV operation modes and encrypted communication analysis are examples of resource-efficient detection frameworks. In [38], a method based on packet size and inter-arrival times with re-weighted l1 norm regularization and maximum likelihood estimation achieves 85.7-95.2% detection accuracy within 0.15-0.35 seconds and accurate mode identification (88.5-98.2%), making it suitable for real-time UAV identification in Wi-Fi environments. Hybrid CNN-LSTM architectures [33] used in UAV-assisted agricultural IoT networks detect aberrant behavior with 93.5% accuracy, while reinforcement learning (DDQN) optimizes UAV deployment. Similarly, [34] shows that Decision Trees (DT) trained on CSE-CIC IDS-2018 achieve 99.99% accuracy and zero false negatives in UAV- and satellite-based 5G networks. The authors also tested various other ML algorithms such as Logistic Regression (LR), Linear Discriminant Analysis (LDA), K-nearest Neighbor (KNN), Gaussian Naive Bayes (GNB), Stochastic Gradient Descent (SGD), and K-means (K-M).

A novel technique employing one-class classifiers and PCA for dimensionality reduction [35] detects GPS spoofing with F1 scores of up to 99.73% for malicious readings. RF fingerprinting paired with ML and DL algorithms [36] achieves more than 95% accuracy in UAV recognition with SNR higher than 5dB, even with Gaussian noise. Simulated UAV IDS evaluation [37] shows that Random Forest classifiers reach 95-96% detection accuracy.

5. Deep Learning Methods

DL[39] have become increasingly important for safeguarding UAV systems, allowing strong, real-time detection of both cyber and physical threats. These systems use large-scale network traffic, sensor telemetry, and UAV operational data to detect intrusions, authenticate devices, and assure swarm resilience. The summary of the research work is described in Table 3. Tlili et al. design [40] proposed a model based on LSTM that uses coordinated detection units across UAV platforms, integrating several IDS components to achieve 98.6% global detection accuracy while minimizing onboard computing. UAV-DiPNID [41] uses knowledge distillation via Distilled Pruned Networks (DPN) to create compact deep networks with 99.61% detection accuracy. This reduces inference time by 80.7% and model size by 90%, allowing for real-time deployment on resource-constrained UAV platforms.

Intrusion detection systems (IDS) that use DL models have demonstrated great performance across several UAV datasets. Niyonsaba et al. [42] proposed a hybrid CNN-LSTM method that achieved up to 99.063% accuracy on CICIDS2017, with hybrid models excelling at real-time threat detection. UAV-assisted reconfigurable intelligent surface (RIS) networks use a hybrid method based on LSTM and Deep Deterministic Policy Gradient (DDPG) [43] to improve communication security and achieve 99.10% detection accuracy. UAVs operating as mobile relays can use cooperative jamming tactics optimized using Deep Neural Networks (DNN) and deep Q-networks (DQN) [44] to avoid eavesdropping while responding to channel uncertainty.

Adaptive IDS architectures integrate deep learning and reinforcement learning to provide proactive threat mitigation. Zero Trust Architectures (ZTA) enhance UAV security by continually authenticating network entities and merging RF signals with explainable AI algorithms like SHAP and LIME, achieving 84.59% accuracy [45].

UAV-IDS-ConvNet [46] employs deep CNNs to analyze encrypted Wi-Fi data across multiple UAV platforms, reaching 99.50% two-class accuracy with a prediction time of 2.77 ms and beating existing IDS models by 6-23%. LSTM-RNN architectures [49] provide real-time anomaly detection in FANETs. When combined with big-data stream analytics, they outperform classic systems like Snort by up to 36% in detection accuracy.

Cross-UAV feature fusion in swarm testbeds [50] reveals that integrating cyber and physical telemetry from several UAVs enhances F1 scores, reaching 96.3% when both attacked and benign UAV data are fused, demonstrating the relevance of swarm security. Extensive evaluations of deep learning architectures—including CNN, LSTM, hybrid CNN-LSTM, and ConvLSTM—show that ConvLSTM consistently achieves near-perfect accuracy (99.99%) in UAV network intrusion detection across multiple datasets, emphasizing the importance of modeling spatiotemporal patterns. UAV-CIDS [52], an autonomous collaborative IDS architecture, uses Feed Forward CNN (FFCNN) to identify zero-day and known assaults with 98.23% accuracy and real-time event response. Hybrid techniques, including feature selection, modified deep CNN-BiLSTM architectures, and attention mechanisms such as in [53]. Also, Benjamin and Kacem [54] proposed another hybrid approach based on Transformer and LSTM to detect DoS and DDoS in UAV systems. Kacem and Tossou [55] proposed a transformer-based system to detect replay attacks targeting ADS-B systems.

6. Federated Learning Methods

FL [56] has emerged as a crucial strategy for improving UAV network security, especially in situations where data privacy, distributed computation, and restricted bandwidth are issues. Unlike traditional centralized learning, FL enables UAVs to train models jointly across remote devices without sharing raw data, ensuring privacy while achieving excellent detection accuracy. The summary of research work is Table 4. UAV networks can identify known and undiscovered cyber-attacks, such as blackhole, sinkhole, floods, GPS spoofing, and jamming, by combining FL with machine learning, deep learning, and advanced data augmentation techniques [57,58,59].

Several frameworks demonstrate the practical application of FL in UAV cybersecurity. Lightweight Spectrogram Network (LSNet) [57] was developed as a zero-trust federated framework for UAV authentication using a spectrogram-based model, achieving over 80% accuracy for recognized UAVs and an AUROC of 0.7 for unknown UAV kinds across five remote clients. FL-IDS [58,60] allows for collaborative intrusion detection in FANETs, identifying high-impact assaults like floods with near-ideal accuracy, even at low attacker ratios, while maintaining privacy and adaptability through weight-sharing. Advanced frameworks use generative models, like CGAN-LSTM architectures and blockchain-based federated aggregation (BFA) [59,68], to improve training data, solve class imbalance, and assure safe, decentralized model updates.

FL enables distributed anomaly detection in UAV swarms with excellent accuracy and robustness. Multi-modal denoising autoencoder and federated learning (L-MDAE) [61] uses multi-modal denoising autoencoders trained with FL to detect communication anomalies, with up to 99.19% accuracy across several datasets. Hybrid FL-based IDS frameworks [62,63] combine unsupervised approaches for in-flight anomalies (e.g., GPS spoofing and jamming) with supervised learning for network assaults, resulting in high F1-scores (up to 97.9%) in resource-constrained contexts. Few-shot FL (FSFL-IDS) [64] and continuous learning frameworks (FCL-SBLS) [65] improve flexibility, enabling UAVs to retain detection performance with less computational overhead.

Mowala [66] proposed a FL-based approach for on-device jamming detection based on a custom model where the training depends on both the local and global models along with client group prioritization using Dempster–Shafer theory. Fahim-Ul-Islam [67] proposed FedWGCA frameworks based on weighted Gradient Clipping (GC) aggregation and Attention-based Neural Networks that reduces the impact of malicious updates while preserving accuracy, precision, and recall.

Federated GAN-augmented IDS (FGA-IDS) [68] combines synthetic data generation with FL to enhance detection reliability and reduce bandwidth utilization. Deng et al. [69] proposes a custom model, FIDSUS, that optimizes feature aggregation by collaborative sensing and cross-round feature fusion, resulting in 4-34% greater accuracy compared to conventional FL approaches. Additional research demonstrates FL’s potential for UAV navigation and mission-critical operations. TCN-Transformer networks [70] and FL detect GPS spoofing and jamming with greater accuracy. Online personalized FL (OPFL) [71] adjusts models to heterogeneous UAV hardware, attaining 95.88% detection accuracy. SP-IoUAV [72] is a privacy-preserving FL architecture that uses Differential Privacy (DP), secure multi-party computation, and CNN-LSTM models to provide great security (99.98% accuracy) and data confidentiality in real-time threat detection.

7. Reinforcement Learning Methods

RL [47] has emerged as a useful paradigm for improving autonomous UAV security because it allows agents to learn optimal defensive or navigation methods through interaction with dynamic surroundings. In UAV systems, RL techniques such as Deep Q-Networks (DQN), and Policy Gradient approaches are popular since they enable UAVs to deal with threat vectors. Table 5 summarizes the research done in this area.

A lightweight DQN-based Intrusion Detection and Prevention System (IDPS) [48] allowed UAVs to identify harmful actions and respond autonomously under onboard computational constraints. The model achieved 99.70% accuracy, with precision, recall, and F1-scores of 0.95, 0.97, and 0.96, respectively, while using very little energy. A context-adaptive IDS [73] used many independent Deep Reinforcement Learning (DRL) agents to detect and classify complicated attacks. Evaluations on the NSL-KDD, UNSW-NB15, and AWID datasets demonstrate higher accuracy and fewer false positives than conventional approaches. The system remains resistant to adversarial manipulations, and integration with a denoising autoencoder improves resilience and adaptation to changing assault patterns. Similarly, an AI-driven IDS optimized for UAVCAN networks [74] successfully detected developing attack patterns, considerably increasing the cybersecurity and operational resilience of UAV communication systems.

Deep Deterministic Policy Gradient (DDPG) was proposed by Tao et al. [75] to effectively identify intrusions in UAV aerial computing environments, providing advice for future security advancements in these networks. In defense and rescue scenarios, fully autonomous UAVs [76] integrated clever onboard security systems capable of discriminating between normal and faked signals, evading threats, and assuring safe return home under cyber-attack conditions. The approach is based on Self Taught Learning (STL) used with multiclass SVM and DQN. Federated Deep Learning (FDL) techniques have been combined with RL to improve UAV network security. A drone client selection algorithm [77] optimized participation in federated deep learning, resulting in FLID, a federated IDS, combining MLPs, CNNs, and LSTM-based RNNs to detect variants of DoS attacks such as flooding, blackhole, and selective forwarding in FANETs while maintaining privacy and minimizing computation. Experiments with the WSN-BFSF dataset yielded high results: 99.38% accuracy, 99% precision, 99% recall, and 99% F1-score.

Adversarial attack detection framework [78] used explainable DRL with Deep Deterministic Policy Gradient (DDPG), Prioritized Experience Replay (PER), and Artificial Potential Fields (APF) to efficiently avoid obstacles and detect attacks. Experiments with Basic Iterative Method (BIM) adversarial attacks reveal that a CNN-based detector gets 80% accuracy, whereas an LSTM-based detector achieves 91% accuracy with faster processing, allowing for real-time adversary identification. Reinforcement learning equips UAVs with adaptive, proactive, and resilient security capabilities, allowing for autonomous threat detection, optimal navigation, and real-time reaction even in complex situations.

8. Graph Neural Network Methods

GNNs [79] are popular in modeling complex relational data in UAV networks, particularly for applications in swarm coordination, communication, and security. By representing UAVs as nodes and their interactions or communication links as edges, GNNs capture spatial, temporal, and topological dependencies that traditional machine learning models often overlook. The summary of the research works is provided Table 6.

Wang et al. [80] proposed an anomaly detection model for multivariate UAV sequences that integrates GNNs with transformers and a graph attention mechanism. Using a multi-channel transformer for intrinsic pattern extraction, a Graph Attention Network (GAT) for temporal-spatial dependencies, and a multi-channel fusion module using Bi-LSTM with channel attention, their proposed approach achieved accuracies of 92.83% and 96.59% on two UAV datasets while maintaining computational efficiency, outperforming existing anomaly detection methods. Swamy and Sophia [81] proposed a Spatial-Temporal Fusion GNN enhanced with the Walrus Optimizer. The purpose was to detect data poisoning attacks using visual inputs and control signals from the Udacity and custom GoPro datasets.

By extracting spatial-temporal features through fused adjacency matrices and gated CNN outputs and using a Privacy-Preserving Federated Learning (PPFL) framework, their proposed approach reached 99.2% accuracy, 99% sensitivity, specificity, and precision, and an RMSE of 0.105, surpassing baseline methods in both robustness and predictive performance. Dual-GAT [82], a Dual-Branch GAT architecture for UAV intrusion detection, modeled cyber and physical telemetry data as asynchronous graphs and fused modality-specific representations at the decision level. Evaluated on a public UAV cyber-physical dataset, Dual-GAT outperforms cyber-only, physical-only, and early-fusion approaches, particularly excelling in detecting message injection and DoS attacks requiring domain context. Sun et al. [83] leveraged attack graphs and real-time network measurements to model both static and dynamic network attributes, achieving high precision, recall, F1-score, and AUC while providing insights into uncertainty, explainability, and robustness. A GAT-based approach using Received Signal Strength Indicator (RSSI) data [84] constructed a radius graph representing drone-to-drone communications, incorporating RSSI deviations as node features.

Mughal et al. [85] proposed a model entitled Chebyshev Graph Neural Network (ChebNet) for UAV swarm security. The authors setup a hexagonal UAV swarm testbed study showing that leveraging spatial relationships alongside temporal patterns significantly improves intrusion detection performance under false data injection, evil twin, replay, and DoS attacks compared to traditional deep neural networks. Majumder et al. [86] transformed tabular UAVCAN messages into graph structures then employed GCNNs, GATs, GraphSAGE, and Graph-based Transformers (GT) for intrusion of message injection and variants of DoS such as fuzzing and flooding. Inductive models such as GraphSAGE, GAT, and GT generalize effectively to unseen nodes and achieve high accuracy—for instance, 99.45% compared to 69.81% for baseline LSTM, consistently outperforming traditional models across complex attack scenarios. For UAV networks with sparse ECU nodes, UAV-GCN-LSTM (UGL) [87] combined GCNs for network topology modeling with LSTMs for sequential behavior, achieving 100% accuracy for flooding, 98.54% for Fuzzing, and 96.35% for Replay attacks, significantly outperforming baseline approaches.

Collectively, these studies underscore the strengths of GNN-based approaches in capturing complex spatiotemporal and relational patterns within UAV networks. By consistently achieving high accuracy, low false positive rates, and robust generalization to unseen scenarios, GNNs provide a reliable, scalable, and efficient solution for UAV security, anomaly detection, and cooperative swarm operations.

9. Generative AI Methods

GAI [88] has emerged as an effective technique for improving UAV cybersecurity by tackling crucial issues such as data scarcity, class imbalance, and the necessity for realistic attack simulation. Generative Adversarial Networks (GANs) are increasingly being used in UAV intrusion detection systems (IDS) to generate synthetic data that mimics actual network traffic or sensor behavior. Generative AI also augments local UAV datasets, decreasing reliance on centralized data gathering and strengthening IDS resilience in dynamic or data-constrained contexts. Summary of the research work done in this category is summarized in Table 7.

A GAN-enhanced IDS [89] generated adversarial samples targeting the IDS’s vulnerabilities, which were then used in training to improve robustness. This method outperformed traditional intrusion detection systems in terms of detecting evasion attacks while retaining a low false-positive rate. DroneDefGANt [90] used GAN-based data creation and transformer-based feature extraction to detect both external threats like GPS spoofing and jamming, as well as internal defects like actuator failures. Synthetic dataset evaluations reveal 97.43% for spoofing and 98.96% for jamming, indicating robustness against Gaussian noise.

Zhao et al. [91] relied on a Mixture of Experts (MoE) based GAI model that included GAN, Auto Encoders (AE) and Variational Auto Encoders (VAE) to guide learning and generate high-quality synthetic samples. This approach achieved 99% intrusion detection accuracy while decreasing labeled data requirements by 98%. A Conditional GAN (CGAN) based framework [92] generated stealthy adversarial perturbations that evade traditional IDSs. Detection via a conditional variational autoencoder (CVAE) negative log-likelihood achieves very hight AUC, 99%, demonstrating a reliable defense against stealth attacks. Synthetic data generation with CTGAN, Gaussian Copulas (GC), and VAEs [93] improved IDS performance, with CTGAN providing more realistic distributions and VAE-generated data sustaining IDS accuracy with only a 1% loss.

Generative AI has also been used in more complicated UAV security designs. Nagendra Kumar et al. [94] proposed a solution to deal with message injection and MiTM by leveraging GANs for anomaly detection, zk-SNARK for privacy-preserving identity verification, and PBFT consensus for secure transactions. Their solution achieved 98.4% accuracy, 98.7% precision, 97.9% recall, 98.3% F1-score, and 98.7% AUC while maintaining low latency and reduced computation and communication overhead. Real-time intrusion detection frameworks that combine Human-in-the-Loop Machine Learning (HITL-ML) and GANs [95] to improve adaptability to evolving threats and outperform standard IDSs.

Gaber [96] used GANs to create hybrid datasets of real IoFT traffic and synthetic adversarial attacks. Adversarial training was performed to protect against FGSM, BIM, and C&W attacks. Experimental evaluation tested the effectiveness of ML classifiers such as RF, DT, SVM, and LR reveals that RF achieves up to 96.5% accuracy, demonstrating strong performance in both real and synthetic data.

10. Tools, Datasets & Metrics

There ahs been a great deal of variation in experimental design, datasets, and evaluation metrics across the surveyed literature on UAV and IoT intrusion detection, from classical machine learning to deep learning, generative models, graph neural networks, reinforcement learning, and multitask learning. What is noticed is that there are two main types of datasets: generic cyber security and specialized UAV captures. While the former leverages the similarities between classic cyber attacks in networked environments due to the lack of specialized datasets that capture a wide variety of attacks, the latter dives into more specialized case studies using captures from specific UAV makers or generic protocols used in AUV communication such as MAVLink or ADS-B. Classical machine learning approaches frequently use structured or telemetry-based data, such as GPS logs, handcrafted signal features, or SDN statistical traces, and are frequently evaluated on datasets such as NSL-KDD, UNSW-NB15, KDD-CUP99, WSN-BFSF, and custom UAV-specific datasets such as UAV-IDS 2020. Deep learning and hybrid models rely increasingly heavily on high-dimensional traffic datasets such as CIC-IDS2017, CSE-CIC IDS2018, CIC-DDOS2019, and proprietary UAVCAN or Wi-Fi traffic captures, which provide richer temporal and semantic data. Although promising, GNN and transformer-based solutions often rely on domain-specific graph structures or manually built multi-view packet representations, which limits consistency between research. Reinforcement learning works mostly on simulated environments rather than standardized datasets, making cross-paper comparisons more difficult. Meanwhile, multitask learning research uses multi-view IoT traffic datasets or integrated UAV communication datasets to learn categorization, detection, and device-level tasks. While this diversity shows the UAV security research adaptability, it also highlights a significant reproducibility gap where researchers frequently use alternative datasets, unique pre-processing methods, and non-public traffic captures.

There are three categories of tools used in UAV security: network simulators, navigation simulators and attack generators. For network simulators, prominent tools include Omnet++ and NS3 that are widely used for simulating network communication including some networked-based attacks. Tools such as ArduSIM can also be used in conjunction with them to connect with drone navigation simulators. Tools such as Gazebo and AirSim are widely used in navigation simulations as it allows researchers to simulate 3D physics with great fidelity which allows testing navigation based attacks such as GPS spoofing. Other tools that may be used in this context include Matlab, Simulink and Pixhwak. Finally for attack generation there are a variety of available tools , starting with Aircrack-NG used for launching network-based attacks, Software Defined Radio (SDR) tools such as GNU Radio and HackRF can generate physical or communication based attacks. Tool such as DroneSploit and Nmap are popular for discovering vulnerabilities in networked-based UAVs and are used mostly in conjunction with Kali Linux or Parrot OS.

Evaluation criteria differ greatly among systems, although accuracy, F1-score, precision, recall, false-positive rate (FPR), and false-negative rate (FNR) remain the most used benchmarks. Classical ML systems report good performance. Deep learning models typically outperform ML in term of accuracy, with certain hybrid systems (e.g., CNN-LSTM or distilled models like UAV-DiPNID) reaching up to 99.61% accuracy while drastically lowering model size. GNN and transformer-based models frequently stress enhanced categorization of complex, multi-stage, or hybrid attacks, although their metrics differ greatly because to conflicting job descriptions. Reinforcement learning methods primarily measure reward convergence, attack mitigation success rates, or decision performance under adversarial manipulation, rather than traditional measures such as accuracy or F1, making direct comparisons to supervised learning models problematic. On three separate datasets, MTL systems consistently outperformed single-task designs in terms of multi-task accuracy when compared to specialized models, such as simultaneous anomaly detection, attack identification, and device recognition. Overall, while high accuracy figures are routinely claimed, often exceeding 95-99%, the absence of uniform evaluation settings and agreed benchmarks restricts the legitimacy and reproducibility of many stated metrics.

11. Comparative Analysis

Despite major gains, the literature still has severe methodological limitations that are summarized as follows:

• Cross-dataset evaluation: almost every work presents findings from a single dataset or simulation environment, raising worries about overfitting and domain specificity. Few studies examined their models across heterogeneous UAV traffic datasets or test applicability to unknown environments—an critical prerequisite for real-world UAV deployments in which operational conditions vary greatly.
• Explainability: while some research use attention processes or feature selection strategies, very few provide interpretable explanations for why a model flags specific telemetry patterns or communication anomalies. This disparity is especially concerning for safety-critical systems like as UAVs, where trust and openness are required.
• Adversarial perturbations: denoising autoencoders, and robustness to faked signals, most studies do not systematically assess resilience to adaptive attacks, data poisoning, physical-layer manipulations, or packet-loss situations. RL studies frequently examine robustness through simulation, however these scenarios seldom mimic the complexities of real wireless environments. Similarly, DL and MTL techniques generally presuppose clean, completely labeled datasets, which are rarely met in practice.
• Reproducibility: most research lack publicly available code, rely on proprietary UAV datasets, or leave out critical information regarding pre-processing, feature extraction, or hyperparameter tweaking. RL-based works rely on proprietary simulation setups, whereas many transformer/GNN-driven frameworks require domain-specific graph structures or non-standardized multi-view input formats. Even when datasets are made public, preparation procedures vary so greatly that identical models may give different findings across research. These constraints highlight the urgent need for consistent datasets, uniform evaluation methodologies, explainable intrusion detection algorithms, and robustness tests that are representative of real-world UAV communication scenarios. Without these enhancements, claimed performance measurements, no matter how good, will be difficult to compare, confirm, or trust in mission-critical UAV security deployments.

12. Key Insights

In this section, we summarize the key insight that can be taken from this paper. First, we investigate the mapping between each AI model and every considered security property along with the number of covered papers. In Table 8, we provide these statistics. We refer to security properties as follows: confidentiality (C), integrity (I), availability (Av), authenticity (Au), privacy (P), robustness (R). The first remark is that there are more papers focusing on classical AI models such as ML, DL and FL, when compared to newer and emerging ones such as RL, GNN and GAI. Also, we noticed that availability maintained the highest consistent coverage, which can be explained by the high risk of access to key UAV services such as connectivity or localization. Confidentiality was only lightly covered by ML and DL, which can be explained by the non-secret nature of UAV systems that often use broadcast of location or control messages.

The detailed coverage of security properties per AI method is provided in Figure 4 that shows this coverage in a bar chart clustered by each considered AI method. ML methods focus on availability, with 80% of the papers, followed by integrity at 50% then authenticity at 40% and confidentiality at 10%. It is noticed that privacy and robustness are not covered at all, which can be understandable since these security properties are merging ones that cannot be handled by traditional ML models. Statistics for DL methods is quite similar with availability covered at 85%, authenticity at 78%, integrity at 71% and availability at 7%. This can be completely understood since both fall under the traditional AI models.

FL methods covered privacy at 100%, which can be understood since it is the purpose it was designed for. As far as the availability at 73%, integrity at 60%, authenticity at 46% and robustness at 20%. The other key difference, when compared with ML and DL, is the coverage of robustness which is explained by the hybrid nature of some research work conducted in this area that combines FL and GAN. For the remaining advanced AI models, including RL, GNN and GAI, it is noticed that they have common focus on integrity, availability and authenticity with similar ratios, in addition to robustness at a slightly lower rate. RL methods covered availability at 85%, integrity and authenticity at 71% each, and robustness at 28%. GNN has similar statistics by covering integrity and authenticity at 50%, availability at 62%, and both privacy and robustness at 12% each. GAI exhibited equal coverage for integrity, availability and authenticity at 62% each, in addition to robustness at 50%. It is noticed that robustness coverage increased in the emerging AI methods due to the fact that these models appeared in part as a response to the need for these models to address privacy and robustness.

Figure 5 shows the overall coverage of security properties across all AI methods. It is noticed that authenticity, availability and authenticity are starting to get saturated with coverage ranging from 58% to 75%. On the other hand, there is a noticeable gap in the coverage of other security properties including confidentiality with 3%, privacy with 25% and robustness with 15%. It can be understood that achieving confidentiality using AI method may not be a main concern for researchers considering the secrecy of messages is generally not required. Thus, there is not much prospect in research in that context. However, research work focusing on achieving privacy and robustness would be considered as a very hot and promising research area thanks to emerging models in RL, GNN and GAI, and also due to the importance of these security properties in AI-enabled security for UAV applications nowadays.

13. Open Challenges

Despite significant progress in classical machine learning, deep learning, generative AI, GNNs, reinforcement learning, and, most notably, multitask learning (MTL), a number of persistent challenges continue to impede the deployment of reliable and generalizable intrusion detection and drone security systems. These challenges are discussed as follows:

• Data scarcity: is one of the most fundamental constraints in all techniques. Many UAV-specific datasets, such as GPS spoofing logs, UAVCAN traffic, aerial computing telemetry, or custom RF fingerprints, are extremely small, confidential, or gathered under limited circumstances. Classical machine learning techniques, such as MAVIDS, rely purely on telemetry, whereas many DL- and RL-based algorithms require vast amounts of different training data to avoid overfitting. Even multitask learning frameworks, which normally benefit from shared supervision across tasks, are constrained by the amount and diversity of UAV attack datasets, particularly for hybrid, multi-stage, and zero-day threats. Generative AI has showed promise for developing synthetic attack data, but there are still concerns about distribution fidelity, temporal consistency, and the risk of increasing dataset biases.
• Real-time Constraints: present significant deployment issues. UAV platforms have limited onboard computing, memory, and energy resources, but must detect and respond to assaults with millisecond latency. Although many works, such as distributed IDS designs (e.g., E-DIDS), lightweight fuzzy rough set systems, and pruned deep networks (UAV-DiPNID), significantly reduce inference time, more complex methods, such as GNNs, RL agents, and multi-view MTL architectures, continue to struggle to meet hard real-time deadlines in flight. Reinforcement learning and MTL models are more adaptable, but their inference pipelines might be computationally demanding without additional optimization, model reduction, or hardware acceleration.
• Explainability: remains weak across nearly all surveyed methodologies. Classical machine learning techniques (e.g., PCA-based anomaly detection, decision trees, and SVMs) allow for partial interpretation, but most deep models including CNN-LSTMs, transformers, GNNs, multi-view architectures, and RL policies—function as black boxes. Only a few efforts explicitly incorporate explainability, such as the explainable DRL adversarial detection framework that employs APF and PER. However, the bulk of cutting-edge systems cannot provide practical explanations for why an assault was identified, what variables influenced the conclusion, or how the UAV should change its behavior. This gap is significant in safety-critical aviation contexts where human operators require transparency and verified logic.
• Adversarial robustness: is another big outstanding topic. Deep learning-based IDS models, such as CNNs, LSTMs, transformers, and GNNs, are especially susceptible to evasion attacks, perturbation-based spoofing, and idea drift. While a few studies have examined adversarial settings (e.g., DRL agents tested against adversarial perturbations, denoising autoencoder-enhanced IDSs), the majority of studies continue to assume clean or stationary data distributions. UAV networks are dynamic and vulnerable to hostile actors capable of jamming, replaying, model poisoning, and RF fingerprint obfuscation. Without thorough robustness studies, IDS performance on static datasets may not be consistent with real-world resilience.
• Absence of set benchmarks: greatly hinders the comparability and repeatability of investigations. The datasets used in UAV intrusion detection research are inconsistent: NSL-KDD, UNSW-NB15, AWID, WSN-BFSF, KDD-CUP99, CSE-CIC IDS2018, CIC-DDoS2019, UAVCAN logs, RF fingerprint datasets, simulated COOJA traffic, and custom flight logs. Many UAV-focused datasets are private, corporate, or simulator-generated, making it impossible to replicate results. Metrics such as accuracy, F1, recall, fall-out rate, latency, energy consumption, and robustness margins vary greatly, making cross-paper comparisons useless. Multitask learning systems complicate evaluation by introducing many objectives (e.g., anomaly detection, device identification, attack classification) with no consistent reporting requirements.

14. Future Directions

Future directions of UAV security research include the following topics:

• Federated MTL: due to the heterogeneous and distributed nature of UAV systems, federated MTL is a promising solution that leverages shared representation with different task-specific heads. This can deal with intermittent client participation that is common in UAV swarms, non-IID data distribution while performing all tasks jointly thus making models less complex and potentially more efficient. Challenges in implementing such solution include dealing with data poisoning, integration with differential privacy and handling communication constraints.
• Digital Twins: can be very beneficial in replicating UAV systems thus aiding in simulating attacks and validating defense mechanisms. The benefits include bundling the cyber, physical and AI dimension together facilitating real-time communication between the UAV and its twin while the possibility of being integrated with RL paradigm. Challenges include dealing with the tradeoff between fidelity and computational cost of such solution, and the ability of accurately model the noise.
• Benchmark Creation: most existing datasets are fragmented and non-reproducible making the creation of open and curated benchmark a pressing need. Some of the key requirements for such benchmarks is that they have to cover attacks from various layers, multi-modal data and realistic UAV protocols such as ADS-B and MAVLink. Challenges include dealing with distributed and federated environments in addition to including and dealing with adversarial attacks.
• Trustworthy AI for UAV Security: the issue with current black-box AI models is that they lack trust in dealing with safety-critical use cases. Some research direction include leveraging explainable AI in making attack detection decisions. Also, another interesting research direction is predicting attacks with high confidence even in the presence of adversarial attacks. In addition, with the rise of popular risk frameworks, such as NIST AI Risk Management Frameworks, it is needed to seamlessly align trustworthy AI solution for UAV security with them. Balancing robustness, explainability and real-time constraints represent the key challenges.

15. Conclusion

UAV ecosystems have been on the rise in recent years, being involved in so many domains and promoting novel services that promote better quality of life and more sophisticated applications. However, due to the rise and widespread of cyber attacks, there has been several approaches to detect and thwart these attacks ranging from classic cryptographic solutions to traditional intrusion based detection. These traditional solutions have been facing challenges in dealing with the sophistication of these attacks though prompting the need of AI-based solutions. On the other hand, most existing surveys present a fragmented view focusing on one type of AI model while neglecting others.

In this paper, we close this gap by proposing a comprehensive survey of AI methods used in UAV security. This covers not only the traditional AI models such as ML and DL but also the emerging ones such as FL, RL, GNN and GAI. We developed an attack taxonomy based on the location of each attack, with regards to the layer in the UAV functional stack. We also proposed a novel taxonomy to classify these AI models based on the type of the model being considered, the attack type and the affected security property.

We complement our survey with a coverage of the datasets, tools and evaluation metrics used in UAV security research in addition of performing a comparative analysis covering the key findings of our classification. We also discuss the open challenges remaining to be solved and the future research directions we think are of high relevance to the research community. We aim that this work will be a reference to be used by UAV security researchers and practitioners who are interested in developing AI-based models to solve the latest UAV security problems.