Mohammad Ashiqur Rahman and his cybersecurity research group at FIU developed SHIELD, a real-time defense system against drone hijacking. (Credit: Chris Necuze/Florida International University)

SHIELD Activated: Researchers build a defense to protect drones from cyberattacks

By Angela Nicoletti

October 6, 2025 at 8:51am

Fooled into following a hacker’s rogue commands, a drone is liable to do any number of things. Fly erratically. Speed up. Slow down. Hang suspended in the air. Reverse course. Take a new course. And, most dangerously: Crash.

What the compromised drone cannot do, however, is regain control. Lost to its original assignment – whether it’s delivering a package, inspecting an aging bridge or monitoring the health of crops – the machine is essentially useless.

At FIU, cybersecurity researchers developed a series of countermeasures to fight back mid-flight against hostile takeovers.

Because drones are essentially flying computers, they are subject to the same software and hardware exploitation as their land-bound counterparts. Current drone-defense techniques fail to monitor all possible vulnerabilities.

FIU’s technology, called SHIELD, is different. Keeping watch over the entire control system, it picks up on subtle cues of malicious activity. It then identifies the kind of attack — even the stealthiest ones that often slip under the radar — before launching an attack-specific recovery process. The findings were presented at the prestigious IEEE/IFIP International Conference on Dependable Systems and Networks.

“Without robust recovery mechanisms, a drone cannot complete its mission under attacks, because even if it is possible to detect the attacks, the mission often gets terminated as a fail-safe move,” said Mohammad Ashiqur Rahman, lead researcher and associate professor in FIU’s Knight Foundation School of Computing and Information Sciences.

“What’s important about our framework is that it helps the system recover, so the mission can be completed.”

Safeguarding the security of drones may soon become more important than ever before. This summer, the Federal Aviation Administration proposed expanding commercial drone use across industries. From Amazon deliveries to agriculture, the FAA expects more businesses to deploy unmanned aircraft, raising questions about safety in the face of increasingly sophisticated cyber threats.

What you'll learn in this story

As drones become increasingly common in U.S. skies – delivering packages, inspecting bridges, even monitoring crops – the danger of cyberattacks has grown too.
At the 2025 IEEE International Conference on Dependable Systems and Networks, FIU computer scientists unveiled SHIELD,a comprehensive cybersecurity framework that monitors the entire drone control system.
SHIELD detects subtle signs of attack — including hardware anomalies like battery surges or processor overload — and uses machine learning to classify the threat and initiate a tailored recovery process, allowing the drone to continue its mission.

FIU’s cybersecurity research group who developed SHIELD. From L-R: Jean Tonday Rodriguez, Mohammad Kumail Kazmi, Mohammad Ashiqur Rahman and Muneeba Asif. (Credit: Chris Necuze/Florida International University)

Traditionally, attack detection has revolved around sensors that help the drone perceive its surroundings and fly safely. But these sensors can be easily manipulated. For example, in “spoofing,” hackers transmit fake GPS coordinates to trick the drone into taking a different trajectory.

Sophisticated cyberattacks, though, bypass the sensors and go straight for the control or actuation system, sneaking malware into the drone’s hardware.

“This is why a detection and recovery system that only takes into account the sensors misses the bigger picture,” says Muneeba Asif, Ph.D. candidate in Rahman’s research group and study author. “It will be blind to other attacks that happen across the system and at different levels.”

SHIELD goes further, monitoring the drone’s entire control system. It detects abnormalities not just in sensors but also in the hardware. For example, the battery and computer components reveal a lot. Sudden surges in battery power or overworked processors are strong indicators that an attack is in progress.

The research team, which also includes FIU students Jean Tonday Rodriguez and Mohammad Kumail Kazmi, compares their approach to how a doctor arrives at a final diagnosis. A symptom (in this case, sensor data) doesn’t always reveal the underlying cause of an illness. Physical evidence (what’s happening with the battery), though, can provide a better idea of what’s going on.

Jean Tonday Rodriguez and Mohammad Kumail Kazmi in the The Analytics for Cyber Defense lab. (Credit: Chris Necuze/Florida International University)

And, just as every diagnosis dictates a different treatment, the researchers also found each attack needed a more tailored recovery plan.

Through multiple hardware-in-the-loop simulations in the lab, researchers found that every attack left behind a unique signature and impacted the drone’s system differently. So, the team trained AI machine learning models to spot abnormalities in the data, use the data to classify the attack, and roll out the prescribed recovery protocol. In the lab, all of this happened in less than a second. Average detection time was 0.21 seconds, and recovery 0.36 seconds.

Next, Rahman’s research group will scale up testing, preparing SHIELD for real-world deployment. With drones poised to reshape commerce, infrastructure monitoring, disaster response, and more, FIU researchers say securing them is no longer optional.

“Reliable and secure drones are the key to unlocking future advancements,” Rahman said. “It’s our hope this work can play a role in moving the industry forward.”