Novelty-Based Intrusion Detection in Unmanned Aerial Vehicles

The rapid proliferation of unmanned aerial vehicles (UAVs) in military and civil domains has raised serious security concerns alongside cyberattacks conducted over wireless communication channels. Threats such as GPS spoofing, signal jamming, denial of service, and sensor manipulation can produce abnormal behaviour in flight logs; traditional signature-based intrusion detection systems (IDS) remain inadequate because labelled attack data are limited. This study systematically evaluates the effectiveness of one-class machine learning methods trained solely on normal flight data for novelty-based intrusion detection. Using real flight logs from the ALFA (A dataset for UAV fault and anomaly detection) dataset, engine, aileron, rudder, and elevator faults were detected with one-class support vector machine (OC-SVM), one-class random forest (OC-RF), local outlier factor (LOF), and autoencoder algorithms. Although the ALFA scenarios are physically injected actuator faults rather than live cyberattacks, they produce abnormal flight-log signatures that are representative of behavioural deviations expected under cyber interference with guidance, navigation, or control commands; therefore, they serve as practical proxy conditions for evaluating novelty-based intrusion detection when labelled attack data are unavailable. During preprocessing, 18 sensor features were reduced to 1,000 sampling points via linear interpolation and z-score normalization was applied. The training set comprised 10 safe flights (10,000 samples) and the test set comprised 37 faulty flights (37,000 samples). OC-SVM, OC-RF, and autoencoder methods achieved accuracy, precision, recall, and F1-score values of 1.00 across all four fault types. LOF achieved accuracy values of 0.9997, 0.9995, 0.9990, and 0.9980 for engine, aileron, rudder, and elevator faults, respectively, with a total of 18 misclassifications. The findings indicate that novelty-based one-class classifiers offer practical solutions for label-free UAV security applications. Future work may examine multi-platform datasets, real-time architectures, and hybrid IDS designs.