Hierarchical Detection of Encrypted UAV Communication Traffic for Low-Altitude Ground-Side Monitoring

Ground-side monitors may observe UAV communication alongside ordinary IP traffic, even when application payloads are encrypted or removed during capture. Detection then relies on observable packet metadata: packet length, inter-arrival time, direction, and transport protocol. Changes in platforms, communication patterns, and link conditions can also produce target UAV traffic absent from training. A detector must therefore retain training-unseen UAV communication while rejecting non-UAV background traffic with similar local statistics. We propose a hierarchical detector for IP-based UAV communication. It converts bidirectional packet streams into fixed-length windows, learns multi-scale temporal representations, screens the target UAV support space, and assesses candidate and boundary windows using periodic and morphological descriptors. We evaluate known and training-unseen UAV traffic, mixed non-UAV background traffic, controlled perturbations, and limited external-domain cases. The method provides communication-side evidence for IP-based UAV activity and is intended to complement physical sensing; radio links without an observable IP/transport layer remain outside its scope.