Mind the Attack: How security threats are shaping software deployed on Unmanned Aerial Vehicles

Context Autonomous unmanned aerial vehicles (UAVs) are increasingly used in applications that depend on reliable software operation, making security an important concern. Objective This paper provides a systematic, software-oriented overview of security attacks against autonomous UAVs, identifying attack types, affected software components, and mitigation strategies. Methods We conduct a systematic mapping study (SMS) of the literature and selected 185 peer-reviewed primary studies from an initial pool of 1,797 articles. Guided by seven research questions, we analyze attacks, targeted software components, exploited vulnerabilities, and detection and mitigation techniques. Results Our findings map UAV vulnerabilities across a seven-layer software taxonomy and reveal cross-layer attack paths that can affect autonomy and physical safety. Existing studies rely heavily on simulation and limited open-source datasets, while defenses primarily use machine learning. Limited attention to control-theoretic methods and inconsistent reporting of deployment-critical metrics further constrain real-world applicability on resource-constrained UAVs. Conclusions We identify 17 key takeaways and 13 actionable recommendations for the autonomous UAV software engineering community. Security analysis should move beyond individual components to the autonomy pipeline, where attacks can propagate across layers and affect safety. Future research should prioritize integrated cyber-physical defenses, closed-loop evaluation, reproducibility, collaboration, and resource-aware deployment.