Toward secure complex UAV cyber-physical systems: A unified threat taxonomy and cross-layer survey of cybersecurity challenges

Autonomous Unmanned Aerial Vehicles (UAVs) are employed for a variety of purposes in civil and military applications, such as package delivery, disaster management, and more. Within the last decade, three characteristics, namely enhanced autonomy, onboard intelligence and situational awareness, have enabled UAVs to navigate their surroundings, make intelligent decisions, and perform tasks, either independently, or with limited direct human control. Therefore, such UAVs can be considered as complex cyberphysical systems. Whilst these developments enhance UAV capabilities, they also introduce unique cybersecurity challenges by expanding the attack surface through which adversaries can seek to disrupt missions, thereby compromising confidentiality, integrity, availability, and trust. In this paper, we investigate how the integration of these three characteristics within a complex UAV architecture i) creates opportunities to enhance their operational effectiveness and ii) introduces new and complex cybersecurity challenges that threaten their reliable operation. For this, we first review the development of traditional UAVs toward complex systems, as their three characteristics have improved. Secondly, we describe complex UAV architecture across five functional layers. More importantly, to help researchers, we introduce a novel Unified Taxonomy of UAV Security Threats (U-TUAST), which classifies security attacks and their effects across these layers and is systematically evaluated. Countermeasures against these attacks are presented as either preventive, detective, or reactive. This serves as a point of reference for how to handle the typical and evolving threats identified in the U-TUAST taxonomy. Finally, this paper outlines key open challenges and future research directions for securing complex and autonomous UAV systems under realistic operating conditions.