Several market sectors are attracted by the potential of unmanned aerial vehicles (UAVs), such as delivery, agriculture, and cinema, among others. UAVs are becoming part of Internet of Things (IoT) networks in the development of autonomous and scalable solutions. However, these vehicles are gradually becoming attractive targets for cyberattacks. This study proposes the development of an efficient platform based on the Message Queuing Telemetry Transport (MQTT) protocol for UAV control and Denial-of-Service (DoS) detection embedded in the UAV system. For the efficiency test, latency, network and memory consumption on the platform were measured, in addition to the correlation between payload and delay time. The results of efficiency tests were collected for the three levels of quality of service (QoS). A strong correlation greater than 90% was found between delay and data size for all QoS levels, showing almost a linear proportion. In DoS detection, the best results were a true positive rate (TPR) of 0.97 with 16 features from the AWID2 dataset using LightGBM with Bayesian optimization and data balancing. Unlike other studies, the built platform shows efficiency for UAV control and guarantees security in the communication with the broker and in the Wi-Fi UAV network.

Wi-Fi is a widely used technology worldwide but can also be a source of insecurity. One of the most common forms of attack is the evil twin, where an attacker creates a fake Wi-Fi network with the same name as a legitimate network. Machine learning algorithms are a promising solution to identify this type of attack. Existing works use databases known as Aegean Wi-Fi Intrusion Datasets (AWID) and detect different types of attacks. This paper focuses on the evil twin attack on AWID3 based on analysis and detection, exploring data science techniques, encompassing the steps of pre-processing, data analysis, data balancing, training and validation, and model testing. The results indicate that the optimized LightGBM reached a False Positive Rate (FPR) of 0.00602 in the test with all columns of the dataset, in addition to an FPR of 0.00898 using a column set, promising for an Intrusion Detection System (IDS).

As Unmanned Aerial Vehicles (UAVs) become increasingly popular and affordable, it is essential to ensure their safe operation, especially around critical devices such as the aircraft's Global Positioning System (GPS). GPS plays an indispensable role in aviation systems. This study presents an efficient multiclass detection method to identify GPS attacks on UAVs, focusing on differentiating between spoofing and jamming attacks. The proposed approach outperforms existing methods. The results obtained in this study contribute to increasing the security of UAVs and provide valuable information for developing robust detection systems to combat evolving threats in the UAV domain.

Unmanned Aerial Vehicles (UAVs) are increasingly used in military, civil, and commercial applications, but they are vulnerable to cyberattacks that threaten security and privacy. These threats include signal interception, unauthorized access, data theft, and remote control of UAVs. An Intrusion Detection System (IDS) is used to mitigate these risks. However, most IDS focus on individual data sources, failing to detect swarm-specific threats. This work presents REMY, a collaboRative intrusion dEtection system for unManned aerial vehicles swarm SecuritY that detects network and in-flight anomalies using machine learning techniques. REMY identifies network attacks such as blackhole, grayhole, and flooding, as well as in-flight threats like GPS spoofing and jamming. Federated learning is applied in model training to ensure data privacy and collaboration. The system is designed to be hardware-independent and lightweight, with low energy consumption and efficient use of resources.

DNS is vital for the proper functioning of the Internet. However, users use this structure for domain registration and abuse. These domains are used as tools for these users to carry out the most varied attacks. Thus, early detection of abused domains prevents more people from falling into scams. In this work, an approach for identifying abused domains was developed using passive DNS collected from an authoritative DNS server TLD along with the data enriched through geolocation, thus enabling a global view of the domains. Therefore, the system monitors the domain’s first seven days of life after its first DNS query, in which two behavior checks are performed, the first with three days and the second with seven days. The generated models apply the machine learning algorithm LightGBM, and because of the unbalanced data, the combination of Cluster Centroids and K-Means SMOTE techniques were used. As a result, it obtained an average AUC of 0.9673 for the three-day model and an average AUC of 0.9674 for the seven-day model. Finally, the validation of three and seven days in a test environment reached a TPR of 0.8656 and 0.8682, respectively. It was noted that the system has a satisfactory performance for the early identification of abused domains and the importance of a TLD to identify these domains.