MAVLink Proxy Defense with Intrusion Detection, Safety Quarantine, and Dual-View Deception for UAV Command-and-Control

Abstract

Unmanned aerial vehicle (UAV) command-and-control (C2) over MAVLink is safety-critical because protocol-valid attacks can disrupt vehicle movement, mission execution, and operator control even when the link remains operational. Existing UAV defenses often treat detection, blocking, and deception separately, leaving no integrated way to contain an untrusted MAVLink source while preserving trusted-operator control. This paper presents CACD, a hybrid detection and enforcement architecture implemented as an in-path MAVLink/PX4 proxy for PX4 SIH/SITL simulation. CACD aggregates flow-scoped traffic into one-second windows for a Random Forest (RF) traffic-window classifier, complements RF inference with protocol-aware rate guards on untrusted HEARTBEAT, PING, and PARAM_REQUEST_LIST traffic, blocks unsafe or untrusted commands through runtime safety rules, and applies policy-driven session escalation and quarantine through a shared session-state manager. When deception is enabled, quarantined attacker flows receive bounded bursts of MAVLink-valid synthetic telemetry rather than a continuous fake stream; the trusted operator continues to receive real PX4 telemetry. We evaluate CACD on a self-collected supervised MAVLink dataset of 9,645 one-second traffic windows across five attack scenarios and on live SIH/SITL tests covering the same categories. Offline group/log-split RF evaluation yields 99.38% ± 0.53% F1 on the self-collected windows; live campaign testing showed consistent RF detection of unsafe-command traffic, partial RF detection of replay traffic, and protocol-rate-guard coverage for flooding attacks where RF alone is insufficient, with layered containment and an opt-in dual-view fork that delivered fake telemetry only to the attacker path (zero operator-path leakage). Reported deception checks validate routing and isolation, not attacker believability. All reported results are limited to PX4 SIH/SITL simulation.