{"id":3010,"date":"2026-07-06T09:31:56","date_gmt":"2026-07-06T09:31:56","guid":{"rendered":"https:\/\/theemcnews.co.uk\/?page_id=3010"},"modified":"2026-07-06T09:39:48","modified_gmt":"2026-07-06T09:39:48","slug":"drone-mag-uav-identification-and-authentication-via-electromagnetic-emissions","status":"publish","type":"page","link":"https:\/\/theemcnews.co.uk\/index.php\/drone-mag-uav-identification-and-authentication-via-electromagnetic-emissions\/","title":{"rendered":"Drone-Mag: UAV Identification and Authentication via Electromagnetic Emissions"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Unmanned Aerial Vehicles (UAVs) are gaining increased popularity in a wide range of domains and applications. As a result, they are also becoming a target of malicious attacks. For example, drone impersonation of military or civilian drones can cause serious security and privacy breaches. There have been some recent contributions that aim to integrate digital certificates as an authentication tool for drones, but such software techniques are often defenseless against physical compromise. In this article, to the best of our knowledge, we are the first to propose a physical layer drone authentication framework to augment existing multifactor authentication schemes leveraging the unintentional Electromagnetic (EM) emissions of the drone\u2019s electronic components. Our solution,\u00a0Drone-Mag<\/i>, exploits the inherent non-idealities and imperfections present in drones\u2019 electronic integrated circuits that are introduced during their manufacturing process. Those emissions are hard to mimic or replicate, providing a robust basis for drone authentication.\u00a0Drone-Mag<\/i>\u00a0is a passive, non-interactive, and privacy-preserving authentication solution and does not require software or hardware modifications to available drones. We test the performance of\u00a0Drone-Mag<\/i>\u00a0focusing on the unintentional EM emissions of 23 drones. In particular, we addressed three main tasks: (i) identification of 14 different drones and flight controllers; (ii) authentication of 10 identical (same brand and model) drones; and (iii) rogue drone detection using autoencoders. All the listed tasks achieve a minimum average of 0.97 F1-score, showing the viability and efficiency of the proposed authentication method.<\/div><\/section><\/section><\/div><\/div>

1 Introduction<\/h2>
Unmanned Aerial Vehicles (UAVs)<\/b>, often referred to as drones, are becoming increasingly popular due to their inexpensive cost and enticing features. Nowadays, drones are used for various functions, including inspections, perimeter management, remote monitoring, and emergency response [4<\/a>]. With their rapid adoption in different domains, they have become an attractive attack target. For example, drone impersonation attacks can cause grave security and privacy violations in different scenarios. One possible scenario is the impersonation of a drone in the military field; if the impersonation is successful, the drone could be used for a number of rogue activities, such as attacking the opponent\u2019s military infrastructure. As such, authenticating drones is of paramount importance. Furthermore, since UAVs can be integrated into many critical infrastructures, such as transportation systems and merchandise delivery, the potential threat of impersonation attacks extends beyond military scenarios to include both civilian and economic activities.<\/div>
Unlike drone detection techniques that are well-developed [5<\/a>,\u00a024<\/a>,\u00a045<\/a>], there are just a few existing drone authentication techniques such as broadcasting unencrypted identity information [13<\/a>]. As this technique is not privacy-preserving and is susceptible to impersonation attacks, the use of Public Key Infrastructure and digital certificates is proposed to authenticate drones [3<\/a>,\u00a055<\/a>]. Unfortunately, there are many attacks targeting such software-based solutions and allowing malicious impersonation by compromising certificate authorities or faking certificates [46<\/a>].<\/div>
Physical-Layer Security is gaining increased traction in recent years as it overcomes many of the limitations of standard cryptography-based authentication techniques [20<\/a>,\u00a061<\/a>]. In particular,\u00a0Physical-Layer Authentication (PLA)<\/b>\u00a0provides great compatibility and security with little complexity since it leverages the devices\u2019 inherent physical layer characteristics rather than a secret key. As threats evolve and become more sophisticated, PLA can be integrated into existing multi-layered authentication frameworks to enhance the security of drone systems. PLA techniques are based on the fact that despite ICs are precisely built (with a tolerance in the order of\u00a0– or\u00a0-meter and using standardized materials), occasional structural deviations exist on a deep sub-micrometer level. As a result of such variances, there are no two ICs that are structurally 100% identical. The electrical components will function properly as long as those deviations remain within an acceptable limit. However, when an electric current runs through such ICs, an unintentional\u00a0Electromagnetic (EM)<\/b>\u00a0field is generated, and the EM emissions released are unique to each individual IC. A dedicated EM probe can be used to detect such EM field emissions. The Maxwell\u2019s equations [2<\/a>] describe the complex creation process of such EM emissions.<\/div>
Contribution<\/i>. In this article, to the best of our knowledge, we are the first to explore fingerprinting drones by leveraging their unintentional EM emissions. We present\u00a0Drone-Mag<\/i>, an efficient, non-interactive, and privacy-preserving solution designed to verify the authenticity of drones and augment existing multi-factor authentication frameworks. Implementing an EM fingerprinting solution for drone authentication poses several technical challenges. First, the stability of EM emissions can be affected by environmental noise and external interference, necessitating precise data collection methods to ensure reliable fingerprinting. Second, distinguishing between different drone brands and models, as well as identical drones of the same make and model, requires a robust and scalable classification approach that balances accuracy and computational efficiency. Third, detecting rogue or imposter drones poses an additional challenge, as adversaries may attempt to mimic legitimate drones to gain unauthorized access. An effective solution must be capable of identifying such imposters even in high-security environments.<\/div>
We address these challenges by proposing\u00a0Drone-Mag<\/i>, which capitalizes on the inherent uniqueness of EM emissions from the flight controller and other electronic components. Specifically, we demonstrate that these emissions are sufficiently unique to distinguish between different brands and models of drones and authenticate individual drones from a pool of identical drones. Additionally,\u00a0Drone-Mag<\/i>\u00a0incorporates a rogue drone detection framework to identify unauthorized drones attempting to impersonate legitimate ones. To validate our approach, we implemented two setups for collecting unintentional EM emissions: a high-precision setup using a spectrum analyzer and a streamlined setup using RTL\u00a0Software-Defined Radio (SDR)<\/b>\u00a0receivers. We conducted extensive experimental evaluations involving 23 drones and flight controllers, including 13 drones with different flight controllers and 10 identical 3DR Solo drones. EM emission samples were collected indoors in a lab environment and outdoors to simulate real-world conditions. Each sample was recorded over 250 ms across eleven 2-MHz frequency bands: 30\u201332, 32\u201334, 34\u201336, 36\u201338, 40\u201342, 42\u201344, 44\u201346, 46\u201348, 49\u201351, 75\u201377, and 112\u2013114 MHz. Notably, our results indicate that any single 2 MHz bandwidth among these is sufficient to achieve an excellent F1-score, highlighting both the scalability and viability of\u00a0Drone-Mag<\/i>. Using a linear\u00a0Support Vector Machine (SVM)<\/b>\u00a0classifier, our system achieved a minimum average F1-score of 0.97 for both brand\/model identification and individual drone authentication, utilizing only 35\u00a0Fast Fourier Transform (FFT)<\/b>\u00a0features across a single 2 MHz bandwidth.<\/div>
Additionally, our rogue drone detection framework, implemented using autoencoders, achieved an average F1-score of 0.99 with EM samples collected over 250 ms across four 2 MHz frequency bandwidths (30\u201332, 32\u201334, 34\u201336, and 36\u201338 MHz). Our solution is entirely passive, requiring no access to the drone\u2019s internal logic or firmware. It integrates seamlessly into existing protocols, requires no hardware or software modifications, and is resistant to spoofing due to its reliance on the physical layer properties of the drone\u2019s electronic components. By addressing key technical challenges\u2014including the detection of rogue drones\u2014and demonstrating high performance across multiple scenarios,\u00a0Drone-Mag<\/i>\u00a0offers a robust and effective approach to drone authentication in security-critical environments.<\/div>
Roadmap<\/i>. The rest of the article is organized as follows:\u00a0Section 2<\/a>\u00a0describes the scenario and adversary model;\u00a0Section 3<\/a>\u00a0describes\u00a0Drone-Mag<\/i>\u00a0in details;\u00a0Section 4<\/a>\u00a0reports the setup used in\u00a0Drone-Mag<\/i>\u00a0experiments;\u00a0Section 5<\/a>\u00a0presents an extensive experimental performance assessment;\u00a0Section 6<\/a>\u00a0discusses some aspects of\u00a0Drone-Mag<\/i>;\u00a0Section 7<\/a>\u00a0reviews the related work with qualitative comparison to\u00a0Drone-Mag<\/i>, and, finally,\u00a0Section 8<\/a>\u00a0concludes the article.<\/div><\/section>

2 Scenario and Adversary Model<\/h2>
Our proposed framework is intended to achieve two main objectives: (i) Different drone brands and flight controllers identification; and (ii) Identical drones and flight controllers authentication.<\/div>
Scenario<\/i>. We first aim to identify different drone brands and models, equipped with different flight controllers. After that, we aim to authenticate the specific individual drone and flight controller from a group of identical drones. We consider the following scenario: a military base, where drones are sent out in different missions outside the military base. First, all the drones operating from this specific military base (the drones are equipped with different or identical flight controllers) are fingerprinted using the framework described in\u00a0Section 3<\/a>. After that, when the drone returns to the base after completing a mission, it has to land on a landing pad placed in a safety zone on the outer skirts of the military base, as shown in\u00a0Figure 1<\/a>. This landing pad is equipped with equipment to collect the EM emissions of the drone using a dedicated magnetic probe placed on a predefined test point on the drone, i.e., the same point that was used to fingerprint the drone in the Training Phase. If the real-time collected fingerprint matches the stored profile of this specific drone, the drone is allowed to enter the military base. Otherwise, the drone is subject to further inspections to check if it has been tampered with. While our proposed framework is well-suited for military environments, it can also be applied in civilian and critical infrastructure scenarios. For instance,\u00a0Drone-Mag<\/i>\u00a0could enhance security at airports, where unauthorized drones pose risks to air traffic control and restricted zones. Similarly, it can be used to authenticate drones deployed for industrial inspections of power plants, oil refineries, or smart city surveillance, ensuring that only authorized UAVs operate in sensitive areas and mitigating risks from impersonation or rogue drone intrusions.<\/div>
Fig. 1.<\/span><\/div><\/header>
Drone-Mag<\/i>\u00a0scenario.<\/div><\/figcaption><\/figure><\/div>
Adversary Model<\/i>. We assume that the adversary\u2019s primary objective is to have their drone pass the authentication check at the landing pad, thereby infiltrating the secure zone (e.g., military base or critical infrastructure). The adversary may attempt one or more of the following approaches to achieve this objective:
(1)<\/div>
Replay and Mimicry Attacks<\/i>: The adversary may attempt to record the EM emissions of a legitimate drone and replay them to deceive the authentication system, or they may attempt to mimic the target drone\u2019s EM fingerprint by manipulating the software or configurations of their own drone.<\/div><\/div><\/div>
(2)<\/div>
Hardware Tampering<\/i>: The adversary may attempt to tamper with or replace the internal electronic components (e.g., the flight controller) of a legitimate drone to alter its EM fingerprint. In doing so, the adversary\u2019s goal may not necessarily be to gain entry with the tampered drone but to cause the legitimate drone to fail the authentication process, rendering it unusable for the military base or facility.<\/div><\/div><\/div>
(3)<\/div>
Impersonation with Identical-Looking Drones<\/i>: The adversary may use a drone that looks identical to a legitimate one (same brand and model) to blend in visually. This impersonation attempt may also involve internal modifications to the electronic components or firmware to make it appear authentic during basic inspections.<\/div><\/div><\/div><\/div><\/div><\/section>

3\u00a0Drone-Mag<\/i>\u00a0Framework<\/h2>
In this section, we provide the details of\u00a0Drone-Mag<\/i>, our proposed solution to provide authentication for drones. Specifically,\u00a0Section 3.1<\/a>\u00a0provides an overview of\u00a0Drone-Mag<\/i>,\u00a0Section 3.2<\/a>\u00a0details the actors involved in\u00a0Drone-Mag<\/i>,\u00a0Section 3.3<\/a>\u00a0lists the modules used in\u00a0Drone-Mag<\/i>, while\u00a0Section 3.4<\/a>\u00a0reports the details of the phases included in\u00a0Drone-Mag<\/i>.<\/div>

3.1\u00a0Drone-Mag<\/i>\u00a0in a Nutshell<\/h3>
In this article, we explore the potential of exploiting mainly the EM emissions that are unintentionally generated as a consequence of electrical currents flowing through the electronic circuits of drones. The generation of these magnetic fields is primarily governed by the principles of the Biot\u2013Savart Law. This law states that the magnitude of a magnetic field produced by a long conductor carrying current\u00a0I<\/i>\u00a0is expressed as\u00a0, where\u00a0\u00a0is the magnetic constant and\u00a0r<\/i>\u00a0is the distance from the conductor [27<\/a>].<\/div>
Figure 2<\/a>\u00a0summarizes our proposed solution\u00a0Drone-Mag<\/i>. Essentially,\u00a0Drone-Mag<\/i>\u00a0offers a method for authenticating drones based on their unique EM emissions. The solution first starts by training an autoencoder to detect rogue drones and an SVM model to authenticate drones.<\/div>
Fig. 2.<\/span><\/div><\/header>
Overview of\u00a0Drone-Mag<\/i>.<\/div><\/figcaption><\/figure><\/div>
In the first phase, we use a magnetic probe to gather the EM emissions from the drone\u2019s flight controller and ICs while the drone is powered ON but not in flight. In the second phase, we calculate relevant\u00a0Machine Learning (ML)<\/b>\u00a0features based on the collected EM emissions samples. These features serve as input to train or test the autoencoder and SVM models.<\/div>
When a drone authentication is required, the EM emissions are collected, the relevant features are extracted, and then passed as a test sample to the trained autoencoder model. If the drone successfully passes the autoencoder test, it is recognized as an authorized drone. Otherwise, the drone authentication fails. In cases where individual drone authentication is necessary, the test sample is then evaluated by SVM model specifically trained to differentiate between different authorized drones. If the test sample profile passes this additional test, the authentication process successfully identifies the specific drone. Otherwise, the authentication fails.<\/div><\/section>

3.2 Actors<\/h3>
Overall,\u00a0Drone-Mag<\/i>\u00a0mainly involves the following two entities:
\u2014<\/div>
Prover<\/i>: It is a drone belonging to a specific entity.<\/div><\/div><\/div>
\u2014<\/div>
Verifier<\/i>: It is a system or a device interested in authenticating the\u00a0prover<\/i>. To this aim, at the\u00a0Enrolment Phase<\/i>, it does the following: (i) record the drone EM emissions; (ii) extract the relevant features and train both an autoencoder and an SVM model; and (iii) store such profiles locally or on a dedicated online server. After that, when authentication of the\u00a0prover<\/i>\u00a0is required, it again records a sample of its EM emissions, extracts the relevant features, and feeds them to the previously trained autoencoder. If the sample is recognized as being produced by an authorized drone, the sample is passed to the trained SVM model for identifying the specific drone. The\u00a0verifier<\/i>\u00a0is assumed to be fitted with the tools required to record the EM emissions and run signal analysis (e.g., an SDR).<\/div><\/div><\/div><\/div><\/div><\/section>

3.3 Modules<\/h3>
We define two main modes of operation for\u00a0Drone-Mag<\/i>\u00a0framework:
\u2014<\/div>
Training Phase<\/i>: During this step, a Local Database is generated with all approved drone profiles.<\/div><\/div><\/div>
\u2014<\/div>
Classification Phase<\/i>: This is the online operating phase of\u00a0Drone-Mag<\/i>, where a drone is examined to see whether its profile matches the one acquired during the Training Phase.<\/div><\/div><\/div><\/div><\/div>
Overall,\u00a0Drone-Mag<\/i>\u00a0framework consists of five different modules, as depicted in\u00a0Figure 3<\/a>:<\/div>
\u2014<\/div>
Emissions Extraction Module<\/i>: This module\u2019s function is to collect and log unintentional EM emissions from a certain drone under test. More details about the equipment used in our experiments will be provided in\u00a0Section 4<\/a>.<\/div><\/div><\/div>
\u2014<\/div>
Features Extraction Module<\/i>: This module is in charge of producing the relevant features from the raw data supplied by the Emissions Extraction Module. This module runs in three distinct stages:
\u2013<\/div>
Data Normalization<\/i>: To enable cross-comparisons between different measurements, the\u00a0Received Signal Strength (RSS)<\/b>\u00a0raw data in dBm acquired by the Emissions Extraction Module are normalized to the\u00a0\u00a0range.<\/div><\/div><\/div>
\u2013<\/div>
Regions Definition<\/i>: In the recorded data, each sample of EM emissions RSS in dBm is associated with a specific timestamp and frequency. In this module, we partition each sample of EM emissions into a number of regions, producing a matrix where each region consists of the RSS values collected at a specific range of time and frequency.<\/div><\/div><\/div>
\u2013<\/div>
Features Computation<\/i>: Starting from the matrix created in the previous step, we compute the features of each defined region.<\/div>
We consider the following statistical features: (i) mean (); (ii) variance (); (iii) standard deviation (); (iv) kurtosis (); and (v) skewness (), to precisely characterize the unintentional EM emissions from each drone\u2019s electronic components, as per the following equations:
\u00a0<\/div><\/div>
(1)<\/div><\/div>
\u00a0<\/div><\/div>
(2)<\/div><\/div>
\u00a0<\/div><\/div>
(3)<\/div><\/div><\/div><\/div>
For each region\u00a0, we construct the features vector\u00a0\u00a0by computing those five statistical features:
\u00a0<\/div><\/div>
(4)<\/div><\/div><\/div>
The concatenation of different regions\u00a0\u00a0features vectors\u00a0\u00a0yields the final features vector\u00a0\u00a0of 35 statistical features for each sample of magnetic emissions:
\u00a0<\/div><\/div>
(5)<\/div><\/div><\/div>
The output of this phase is a matrix of features\u00a0\u00a0for the fingerprinted samples of magnetic emissions\u00a0\u00a0that is passed either to the\u00a0Training Module<\/i>\u00a0or to the\u00a0Classification Module<\/i>, depending on the action required.
\u00a0<\/div><\/div>
(6)<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
\u2014<\/div>
Training Module<\/i>: This module, which is only active in the Training Phase, is in charge of constructing the reference profile for the specific drone under examination by utilizing the features already defined by the\u00a0Features Extraction Module<\/i>. The generated profile is saved to the\u00a0Local Database<\/i>.<\/div><\/div><\/div>
\u2014<\/div>
Verification Module<\/i>: This module employs an autoencoder to run a preliminary evaluation of the collected EM sample in order to determine if it originates from a legitimate drone or not. If the verification is successful, the EM sample is passed to the\u00a0Classification Module<\/i>\u00a0to identify the specific drone.<\/div><\/div><\/div>
\u2014<\/div>
Classification Module<\/i>: This module, which is only active in the\u00a0Authentication Phase<\/i>, determines if the previously saved profiles in\u00a0Local Database<\/i>\u00a0match the one obtained in real-time from the device under test. We utilized the one-class linear SVM classifier available in Matlab\u2019s ML Toolbox as the classification algorithm. This module returns a similarity score, which indicates how close the EM emissions recorded in real-time from the device under test to the stored profile.<\/div><\/div><\/div><\/div><\/div>
Fig. 3.<\/span><\/div><\/header>
Logical architecture of the\u00a0Drone-Mag<\/i>\u00a0framework.<\/div><\/figcaption><\/figure><\/div>
We employ the following performance evaluation metrics to evaluate the performance of\u00a0Drone-Mag<\/i>:
\u2014<\/div>
Accuracy (ACC):
\u00a0<\/div><\/div>
(7)<\/div><\/div>Represents the overall correctness of a classifier\u2019s predictions by measuring the ratio of correctly classified instances to the total instances.<\/div><\/div><\/div>
\u2014<\/div>
Area Under the Curve (AUC)<\/b>: Represents the area under the Receiver Operating Characteristic curve, which quantifies a classifier\u2019s ability to distinguish classes.<\/div><\/div><\/div>
\u2014<\/div>
Precision (Pr):
\u00a0<\/div><\/div>
(8)<\/div><\/div>Measures the accuracy of positive predictions by indicating the ratio of\u00a0True Positives (TPs)<\/b>\u00a0to all predicted positives (TP + FP).<\/div><\/div><\/div>
\u2014<\/div>
Recall (Re):
\u00a0<\/div><\/div>
(9)<\/div><\/div>Measures the ability of a classifier to identify all positive instances correctly by indicating the ratio of TPs to all actual positives (TP + FN).<\/div><\/div><\/div>
\u2014<\/div>
F1-score:
\u00a0<\/div><\/div>
(10)<\/div><\/div>The F1-score is the harmonic mean of precision (Pr) and recall (Re).<\/div><\/div><\/div><\/div><\/div><\/section>

3.4 Phases of\u00a0Drone-Mag<\/i><\/h3>
Drone-Mag<\/i>\u00a0includes two main phases, namely, the\u00a0Enrolment Phase<\/i>\u00a0and the\u00a0Authentication Phase<\/i>, detailed in the following.
\u2014<\/div>
Enrolment Phase<\/i>:\u00a0Figure 4(a)<\/a>\u00a0shows the sequence diagram of the\u00a0Enrolment Phase<\/i>. Before deployment, the\u00a0verifier<\/i>\u00a0collects the EM emissions of the\u00a0prover<\/i>\u00a0for a specific time window using the\u00a0Emissions Extraction Module<\/i>. For each sample collected, the\u00a0verifier<\/i>\u00a0computes the relevant features of the recorded EM emissions using the\u00a0Features Extraction Module<\/i>, trains an autoencoder and an SVM model using the Training Module, and saves the trained model locally or on an online database.<\/div><\/div><\/div>
\u2014<\/div>
Authentication Phase<\/i>: The\u00a0Authentication Phase<\/i>\u00a0steps are detailed in\u00a0Figure 4(b)<\/a>. Upon any authentication exchange, the\u00a0verifier<\/i>\u00a0records the EM emissions emitted from the\u00a0prover<\/i>\u00a0using the\u00a0Emissions Extraction Module<\/i>\u00a0and fingerprints them via the\u00a0Features Extraction Module<\/i>\u00a0to extract the relevant features. After that, using the\u00a0Verification Module<\/i>, the\u00a0verifier<\/i>\u00a0checks first if the model of the features just computed belongs to a legitimate drone in the trained model using the trained autoencoder. If it is recognized as a legitimate drone, the\u00a0Classification Module<\/i>\u00a0determines exactly which drone produced the EM emissions sample under test, and the drone is authenticated. Otherwise, authentication fails.<\/div><\/div><\/div><\/div><\/div>
Fig. 4.<\/span><\/div><\/header>
Sequence diagrams of the\u00a0Enrolment<\/i>\u00a0and\u00a0Authentication Phases<\/i>\u00a0of\u00a0Drone-Mag<\/i>.<\/div><\/figcaption><\/figure><\/div><\/section><\/section>

4 Experimental Setup<\/h2>
In the following, we list the equipment and tools used in our experimental setup.
\u2014<\/div>
Drones<\/i>: We tested the performance of\u00a0Drone-Mag<\/i>\u00a0with a set of 23 drones including 13 different drones, each equipped with a different flight controller board to test the ability of\u00a0Drone-Mag<\/i>\u00a0in distinguishing different drones, and 10 identical 3DR Solo drones to evaluate\u00a0Drone-Mag<\/i>\u00a0performance in uniquely identifying identical drones leveraging the non-idealities present even between identical electronic components. The list of different drones and flight controllers tested is summarized in\u00a0Tables 1<\/a>\u20133<\/a>.<\/div><\/div><\/div>
\u2014<\/div>
Aaronia PBS2 EMC Probe Set<\/i>: We utilized the Aaronia PBS2 EMC Probe set [1<\/a>] to capture the unintentional EM emissions generated by the drones. This equipment enables simple pinpointing and measuring of emissions from the electronic components in the frequency range from DC (1 Hz) to 9 GHz. We used the 25 mm magnetic (H) field probe PBS-H3 probe to collect the EM emissions from the drones. It has an insulating layer that provides a safe measuring environment for oscillators and different electronic components. This probe is connected to the UBBV2 40dB EMC RF pre-amplifier, which allows for a clear separation of the relevant signal from the background noise. The probe is then connected to the spectrum analyzer or RTL-SDR through a low-impedance cable.<\/div><\/div><\/div>
\u2014<\/div>
Rohde & Schwarz FSW8 Spectrum Analyzer<\/i>: The Rohde & Schwarz FSW8 Spectrum Analyzer was utilized to capture the unintentional EM emissions from the magnetic Probe across a 200 MHz frequency bandwidth. This equipment automatically translates raw data into power spectral density measurements by executing an FFT over the recorded samples, and it produces a tuple for each time frame with (among other features) a timestamp (in milliseconds), a frequency (in Hz), and a power level (in dBm).<\/div><\/div><\/div>
\u2014<\/div>
RTL-SDR<\/i>: In our experiments, we also designed a more compact and cheap emissions collection setup by employing the RTL-SDR instead of the expensive Rohde & Schwarz FSW8 Spectrum Analyzer. This was done in order to decrease the cost and increase the portability of the setup. The RTL-SDR was connected to a magnetic probe and used to measure EM emissions within a 2 MHz frequency bandwidth, e.g., from 30 to 32 MHz. The device collects raw IQ samples which are then converted to values of power spectral density in dBm. This is done by using the FFT method on the collected data, with a step of 125 Hz and 2 MHz range, resulting in 16,000 frequency points and their corresponding power levels in dBm.<\/div><\/div><\/div>
\u2014<\/div>
Matlab R2024a<\/i>: Matlab R2024a was used to implement the\u00a0Features Extraction Module<\/i>, the\u00a0Training Module<\/i>, the\u00a0Local Database<\/i>, and the\u00a0Classification Module<\/i>.<\/div><\/div><\/div><\/div><\/div>
Table 1.<\/span><\/div><\/header>
Drone ID<\/th>Flight controller<\/th>Count<\/th><\/tr><\/thead>
1<\/td>Pixhawk 2.0<\/td>10<\/td><\/tr>
2<\/td>MATEKSYS F722<\/td>1<\/td><\/tr>
3<\/td>Flywoo GOKU HDF4 EVO F4<\/td>1<\/td><\/tr>
4<\/td>FlightOne SKITZO Revolt OSD Lite F4<\/td>1<\/td><\/tr>
5<\/td>HGLRC Zeus F722 3-6S<\/td>1<\/td><\/tr>
6<\/td>Racerstar StarF4S 30A Blheli_S Dshot<\/td>1<\/td><\/tr><\/tbody><\/table><\/div>
List of Flight Controllers Installed on Drones Used in\u00a0Drone-Mag<\/i>\u00a0Experiments<\/div><\/figcaption><\/figure><\/div>
Table 2.<\/span><\/div><\/header>
Parameter<\/th>Description<\/th><\/tr><\/thead>
Encoder layers<\/td>Four dense layers<\/td><\/tr>
Decoder layers<\/td>Three dense layers<\/td><\/tr>
Encoder activation<\/td>ReLU<\/td><\/tr>
Decoder activation<\/td>ReLU (first two layers), Sigmoid (last layer)<\/td><\/tr>
Optimizer<\/td>Adam<\/td><\/tr>
Epochs and batch size<\/td>50<\/td><\/tr>
Standardize data<\/td>True<\/td><\/tr><\/tbody><\/table><\/div>
Autoencoder Parameters<\/div><\/figcaption><\/figure><\/div>
Table 3.<\/span><\/div><\/header>
Drone ID<\/th>Flight controller<\/th>Count<\/th><\/tr><\/thead>
1<\/td>Pixhawk 2.0<\/td>10<\/td><\/tr>
2<\/td>Hobbywing F7<\/td>1<\/td><\/tr>
3<\/td>Holybro F722 Kakute<\/td>1<\/td><\/tr>
4<\/td>T-Motor Velox F7<\/td>1<\/td><\/tr>
5<\/td>SpeedyBee F405 V4<\/td>1<\/td><\/tr>
6<\/td>iFlight BLITZ F745 V1.1<\/td>1<\/td><\/tr>
7<\/td>BrainFPV Radix 2 H7<\/td>1<\/td><\/tr>
8<\/td>Skystars H743 HD<\/td>1<\/td><\/tr>
9<\/td>SpeedyBee F7 V3<\/td>1<\/td><\/tr><\/tbody><\/table><\/div>
List of Drones and Flight Controllers Used in Outdoor\u00a0Drone-Mag<\/i>\u00a0Experiments<\/div><\/figcaption><\/figure><\/div>
Table 1<\/a>\u00a0provides a list of the flight controllers used to evaluate the performance of\u00a0Drone-Mag<\/i>.<\/div>

4.1 Spectrum Analyzer Setup<\/h3>
All of the tests reported in the following were carried out under standard laboratory conditions across 3 days by collecting the unintentional EM emissions emitted by the target drone under test, with no attempt made to decrease background noise. It is worth emphasizing that the magnetic probe we utilize is a near-field probe, which primarily records EM emissions from a close range around the probe, which enables the most effective noise reduction from the surrounding environment. We collect the EM emissions across 11 different 2 MHz frequency bandwidths, i.e., 30\u201332, 32\u201334, 34\u201336, 36\u201338, 40\u201342, 42\u201344, 44\u201346, 46\u201348, 49\u201351, 75\u201377, and 112\u2013114 MHz. Our spectrum analyzer experimental setup is shown in\u00a0Figure 5(a)<\/a>.<\/div>
Fig. 5.<\/span><\/div><\/header>
Measurement setups.<\/div><\/figcaption><\/figure><\/div>
Note that we just switch the drone ON, then start collecting the EM emissions using the described setup. The drone is idle with the motors and propellers switched OFF, so the unintentional EM emissions collected are related to the powered ON state of the drone\u2019s electronic components without performing any specific function or movement.<\/div><\/section>

4.2 RTL-SDR Setup<\/h3>
In this section, we reduce the form factor of the experimental setup for\u00a0Drone-Mag<\/i>, using cheap Commercial off-the-shelf RTL-SDR instead of the spectrum analyzer to collect the EM emissions captured by the magnetic probe, as shown in\u00a0Figure 5(b)<\/a>. We select four 2 MHz frequency bandwidths: 30\u201332, 32\u201334, 34\u201336, and 36\u201338 MHz to test the performance of\u00a0Drone-Mag<\/i>.<\/div><\/section><\/section>

5 Experimental Results<\/h2>
In the following, we provide several experimental results obtained using both the spectrum analyzer and the RTL-SDR setups previously described.<\/div>

5.1 Power Spectral Density of Drones<\/h3>
We first evaluate the profile of unintentional EM emissions generated by different drone flight controllers when the drone is switched ON but not flying. We considered six different drone flight controllers as summarized in\u00a0Table 1<\/a>.<\/div>
Figure 6(a)<\/a>\u00a0shows the power spectral density of the unintentional EM emissions of the full 200 MHz bandwidth acquired by the spectrum analyzer from the 6 different flight controllers under test, and\u00a0Figure 6(b)<\/a>\u00a0shows the 10 identical Solo drones considered for evaluating the performance of\u00a0Drone-Mag<\/i>, respectively. Each trace in the cited figures lasts for around 150 ms. Due to the normalization phase executed during the\u00a0Features Extraction module<\/i>, all of the unintentional EM emissions RSS samples recorded in dBm are normalized to values in the range between 0 and 1. Specifically, the blue color maps values in the range\u00a0, the cyan corresponds to values in the range\u00a0, the yellow color is related to values in the range\u00a0, while the red color indicates values in the range\u00a0.<\/div>
Fig. 6.<\/span><\/div><\/header>
Power spectral density of the unintentional EM emissions recorded for around 150 ms with 200 MHz frequency bandwidth for each of the 15 different drone flight controllers considered for testing\u00a0Drone-Mag<\/i>, separated by black lines.<\/div><\/figcaption><\/figure><\/div>
While we collect the unintentional EM emissions of each drone flight controller using 200 MHz frequency bandwidth to get a clear insight into their differences as shown in\u00a0Figure 6(a)<\/a>\u00a0and (b), we only consider a 2 MHz fingerprinting bandwidth for drone identification and authentication. We chose four random 2 MHz frequency bandwidths from the EM emissions of the six different drones under test collected using the spectrum analyzer setup shown in\u00a0Figure 5(a)<\/a>, i.e., 30\u201332, 49\u201351, 75\u201377, and 112\u2013114 MHz; and four consecutive frequency bandwidths, i.e., 30\u201332, 32\u201334, 34\u201346, and 36\u201338 MHz from the drones\u2019 EM emissions traces collected using the RTL-SDR setup depicted in\u00a0Figure 5(b)<\/a>, in order to show the scalability of\u00a0Drone-Mag<\/i>\u00a0and its ability to authenticate drones across a wide range of frequency bandwidths.\u00a0Figure 7(a)<\/a>, (b), (c), and (d) shows the power spectral density of the unintentional EM emissions recorded for the following 2 MHz frequency bandwidths: 30\u201332, 32\u201334, 34\u201346, and 36\u201338 MHz, respectively. In addition,\u00a0Figure 8(a)<\/a>\u2013(c) shows the unintentional EM emissions recorded for the 49\u201351, 75\u201377, and 112\u2013114 MHz frequency bandwidths, respectively.<\/div>
Fig. 7.<\/span><\/div><\/header>
Power spectral density of the unintentional EM emissions recorded for around 150 ms with 2 MHz frequency bandwidth, shown across four consecutive frequency windows (30-38 MHz), for each of the six different drone flight controllers considered for testing Drone-Mag, separated by black lines.<\/div>
Power spectral density of unintentional EM emissions recorded over approximately 150\u202fms with a 2\u202fMHz bandwidth, shown across four consecutive frequency windows spanning 30\u201338\u202fMHz. The figure is divided into six sections\u2014each corresponding to a different drone flight controller evaluated in\u00a0Drone-Mag<\/i>\u2014separated by black lines.<\/div><\/figcaption><\/figure><\/div>
Fig. 8.<\/span><\/div><\/header>
Power spectral density of the unintentional EM emissions recorded for around 150 ms with 2 MHz frequency bandwidth, shown across three scattered frequency windows, for each of the six different drone flight controllers considered for testing Drone-Mag, separated by black lines.<\/div>
Power spectral density of unintentional EM emissions recorded over approximately 150\u202fms with a 2\u202fMHz bandwidth, shown across three scattered frequency windows. The figure is divided into six segments-one per drone flight controller considered for testing\u00a0Drone-Mag<\/i>-separated by black lines.<\/div><\/figcaption><\/figure><\/div><\/section>

5.2 Features Computation<\/h3>
In this section, we detail the features computation process for the EM data collected using both setups: Spectrum Analyzer and RTL-SDR.<\/div>

5.2.1 Spectrum Analyzer.<\/h4>
In the following, we provide a description of the segmentation and features computation process of the EM emissions traces collected using the spectrum analyzer.<\/div>
We consider 15 drones in our analysis of the performance of\u00a0Drone-Mag<\/i>\u00a0as detailed in\u00a0Table 1<\/a>. We collect 600 samples for each drone and consider a 2 MHz acquisition frequency bandwidth covering the following ranges: 30\u201332, 49\u201351, 75\u201377, and 112\u2013114 MHz. We select those frequencies randomly from the 200 MHz range depicted in\u00a0Figure 6<\/a>\u00a0to show the scalability of\u00a0Drone-Mag<\/i>\u00a0and its capability to fingerprint and authenticate drones via a large number of frequency bandwidths. This allows for robust authentication of drones, as the system administrator can use an increased number of frequency bandwidths to authenticate drones, i.e., 30\u201332 and 75\u201377 MHz samples are used to authenticate a drone. We consider a fixed observation window of around (150 ms) for each sample of each of the collected traces of EM emissions. For the six different drone brands and flight controllers identification, the differences are apparent even to the naked eye, as shown in\u00a0Figure 6(a)<\/a>. Each time window is further divided into a number of time and frequency regions to compute the following five statistical features over each of them: mean, standard deviation, variance, skewness, and kurtosis. Overall, we considered 35 features generated by computing the five statistical features over each of the seven regions of the EM emissions sample. Specifically, the features are computed as follows: first, we compute the five statistical features over the whole observation window of 150 ms, generating five features. Then, we further divide the observation window of 150 ms into 2 time regions, each 75 ms long, and compute the same 5 statistical features for each of them, resulting in 10 additional features. After that, we further divide each of the time regions resulting from the previous step into two frequency regions, each with a bandwidth of 1 MHz. For each of the\u00a0\u00a0frequency regions, we compute the five aforementioned statistical features, generating\u00a0\u00a0features. By summing up the three stages, we have a total of\u00a0\u00a0features. Those features are used as input to train or test the verification and classification models.<\/div><\/section>

5.2.2\u00a0RTL-SDR<\/abbr>.<\/h4>
We consider only the 10 identical drones in our reduced experimental setup utilizing the RTL-SDR instead of the spectrum analyzer, as the differences between the EM emissions of different flight controllers are clear even to the naked eye, as shown in\u00a0Figure 6(a)<\/a>. We collect 600 samples of the EM emissions for each of the 10 identical 3DR Solo drones using the setup illustrated in\u00a0Figure 5(b)<\/a>. Each sample lasts for 250 ms, spanning 2 MHz frequency bandwidth, covering the following frequency bandwidths (each bandwidth EM emissions are collected separately): 30\u201332, 32\u201334, 34\u201346, 36\u201338 MHz, with 125 Hz step, resulting in 16,000 FFT points and their RSS values.<\/div><\/section><\/section>

5.3 Rogue Drone Detection<\/h3>
In this section, we propose an autoencoder-based solution to check if the EM fingerprint extracted from the drone under analysis belongs to the pool of the EM traces collected from the authorized drones. This step is taken before the identification and\u00a0Authentication Phase<\/i>, leaving the other two for further analysis should the drone pass this test. We conducted the experiments within the RTL-SDR reduced form setup as it represents a more efficient and cost-effective setup.<\/div>
An autoencoder is a type of unsupervised neural network that can learn to compress and encode data efficiently. In addition, it can also learn to reconstruct the data from the compressed representation to a version that closely resembles the original input [16<\/a>]. An autoencoder can be trained on a dataset built recording the normal expected behavior of some devices, and then it can be used to identify any new devices that deviate from the model built over the cited dataset. This pipeline of actions can be implemented by encoding the profiles of the new drones and comparing them to the encoded representation of the authorized drones. If the encoded representation of the new device is significantly different from the authorized drones\u2019 profiles, it can be flagged as a rogue drone.<\/div>
Our aim is to test the ability of\u00a0Drone-Mag<\/i>\u00a0to reject rogue drones based on the unique EM emissions profiles. Since the task of classifying identical drones is more challenging than classifying different drones that are distinct even to the naked eye, we consider the 10 identical Solo drones to evaluate\u00a0Drone-Mag<\/i>\u00a0rogue drone detection performance. From the dataset of EM emissions data collected from the 10 identical Solo drones using the minimized setup described in\u00a0Section 4.2<\/a>, we build an autoencoder framework, and we use it to train a model utilizing the EM emissions data of 8 out of the 10 identical drones as authorized drones, and we consider the data of the remaining 2 as rogue drones. We use the most relevant 50 FFT points as features out of the 16,000 FFT points collected. The autoencoder architecture used for detecting rogue drones is summarized in\u00a0Table 2<\/a>.<\/div>
In\u00a0Figure 9<\/a>, we plot the\u00a0Mean Squared Error (MSE)<\/b>\u00a0of both the eight authorized drones and the two rogue drones across four frequency bandwidths, i.e., 30\u201332 MHz in\u00a0Figure 9(a)<\/a>, 32\u201334 MHz in\u00a0Figure 9(b)<\/a>, 34\u201336 MHz in\u00a0Figure 9(c)<\/a>, and 36\u201338 MHz in\u00a0Figure 9(d)<\/a>. We set a separating threshold between authenticated and rogue drones as follows: 0.005, 0.004, 0.0045, and 0.0027, respectively. The selected threshold used to accept or reject the samples of EM emissions of the drone under test can be adjusted according to the desired system performance, either to increase security and reduce false accept errors, or reduce false reject errors and enhance accessibility. A comprehensive performance analysis for\u00a0Drone-Mag<\/i>\u00a0rogue drone detection is summarized in\u00a0Figure 10<\/a>.<\/div>
Fig. 9.<\/span><\/div><\/header>
MSE of the autoencoder in\u00a0Drone-Mag<\/i>\u00a0for detecting rogue drones in four different frequency bandwidths.<\/div><\/figcaption><\/figure><\/div>
Fig. 10.<\/span><\/div><\/header>
Drone-Mag<\/i>\u00a0autoencoder rogue drone detection performance for different frequency bandwidths.<\/div><\/figcaption><\/figure><\/div>
We use the following performance metrics: Accuracy, Precision, Recall, and F1-score.\u00a0Drone-Mag<\/i>\u00a0has a minimum F1-score of approximately 0.99 for the four frequency bandwidths considered. We chose four consecutive frequency bandwidths, i.e., 30\u201332, 32\u201334, 34\u201336, and 36\u201338 MHz, and four dispersed ones for the spectrum analyzer setup, i.e., 30\u201332, 49\u201351, 75\u201377, and 112\u2013114 MHz to show that\u00a0Drone-Mag<\/i>\u00a0is scalable and can work across a wide range of frequency bandwidths.<\/div><\/section>

5.4 Classification Results<\/h3>
This step is performed only if the drone passes the verification test carried out by the rogue drone detection autoencoder framework. The classification results for each of the two main objectives illustrated in\u00a0Section 2<\/a>\u00a0are detailed in the following.<\/div>

5.4.1 Spectrum Analyzer Setup.<\/h4>
For the EM emissions collected using the spectrum analyzer, we obtain the following classification results.<\/div>
We test on 600 samples of the unintentional EM emissions for each of the 15 drones, including 6 different flight controllers and 10 identical Solo drones. Each sample lasts for 10 frames; each frame is around 15 ms, for a total of around 150 ms per sample. Each frame spans a 2 MHz frequency bandwidth, i.e., 30\u201332, 49\u201351, 75\u201377, and 112\u2013114 MHz. The EM emissions are collected when the specific drone is switched ON, and the drone is not flying. We divided those 600 samples into 80% (480 samples) for the training of the SVM ML model, and the remaining 20% (120 samples) are for testing the trained model.<\/div>
Specifically, we utilize the one-class linear SVM classifier that evaluates each drone as an independent class by developing a profile that matches the features supplied for the unique drone flight controller (or the specific drone from a pool of identical drones). When a test set is presented as input for classification, the one-class linear SVM classifier produces an evaluation score for each input sample. Such an evaluation score reveals whether or not the given input test sample is consistent with the constructed model. This strategy is especially beneficial when the number of potential classes is large, as in the case of drones, and a multi-class classification approach is not appropriate. Also, this technique provides a way to detect drones that have not been seen before by the classification model, as its evaluation score would be below the threshold set for the authorized drones used to train the ML model. We note here that we tested multiple ML algorithms with comparable results. The choice of the specific ML algorithm is flexible, depending on the scenario and resources available to system administrators.<\/div>
We tested the classification performance of an increasing number of features, i.e., 5, 10, 20, and 35 statistical features, generated as detailed in\u00a0Section 5.2<\/a>. We employed performance metrics such as Accuracy, AUC, Precision, Recall, and F1-score for performance evaluation.\u00a0Figure 11<\/a>\u00a0summarizes the classification performance of the 15 drones across different frequency bandwidths and an increasing number of features. The average F1-score across all 4 frequency bandwidths and 35 features is around 0.99.<\/div>
Fig. 11.<\/span><\/div><\/header>
Classification performance of\u00a0Drone-Mag<\/i>\u00a0for 15 drones using EM emissions samples collected using the spectrum analyzer setup across different frequency bandwidths and an increasing number of features.<\/div><\/figcaption><\/figure><\/div><\/section>

5.4.2 Drone-Mag Robustness.<\/h4>
As we detailed in the previous section, we train the SVM ML model on 80% of the collected data and test it using the remaining unseen 20%. This allows us to evaluate the model\u2019s performance on data not seen before during training, providing an assessment of the ML-trained model\u2019s generalization ability.<\/div>
To further ensure the robustness of the trained ML model, we collected entirely new data traces of EM emissions for each of the 10 identical Solo drones in a separate time instance after 2 weeks from the first collection across 2 days. This new dataset provides a more rigorous way to evaluate the model\u2019s performance, as it has never been used in the initial training and testing phases. In addition, it verifies the robustness of the EM emissions of the drones across different time instances and proves that the trained ML model is not overfitted.\u00a0Figure 12<\/a>\u00a0summarizes the classification performance when testing the trained ML model with the new dataset of the 10 drones across different frequency bandwidths and 35 statistical features.<\/div>
Fig. 12.<\/span><\/div><\/header>
Drone-Mag<\/i>\u00a0classification performance when testing the trained ML model with the new dataset of the 10 drones across different frequency bandwidths.<\/div><\/figcaption><\/figure><\/div>
We can notice a decline in the performance in the 75\u201377 MHz bandwidth, i.e., from 0.99 F1-score in the initial training and testing phase to 0.86 F1-score when testing on the separately collected dataset. This degradation in performance suggests that some frequency bandwidths are less temporally stable than others, and system administrators of\u00a0Drone-Mag<\/i>\u00a0might have to employ an iterative process to determine the most stable and reliable frequency bandwidths for drone authentication. In addition,\u00a0Drone-Mag<\/i>\u00a0can employ a majority voting strategy with multiple samples from the same or different frequency bandwidths in order to enhance the drone\u2019s authentication process. As each EM emissions sample is only 150 ms long, this approach will incur minimal delay while ensuring the robustness of the authentication process.<\/div><\/section>

5.4.3 RTL-SDR Setup.<\/h4>
Since the EM emissions for the 6 different drone brands and flight controllers are distinct even to the naked eye, as shown in\u00a0Figure 6(a)<\/a>, we consider only the 10 identical drones in our reduced experimental setup utilizing the RTL-SDR instead of the spectrum analyzer. Using the described setup in\u00a0Figure 5(b)<\/a>, we collect 600 samples of the EM emissions for each of the 10 identical 3DR Solo drones. Each sample lasts for 250 ms, with 16,000 FFT points and their respective RSS values spanning 2 MHz frequency bandwidth, covering the following frequency bandwidths: 30\u201332, 32\u201334, 34\u201346, 36\u201338 MHz, with 125 Hz step. As it can be seen from\u00a0Figure 6<\/a>, drones\u2019 EM emissions show variations along the whole 200 MHz frequency span, not just in the four frequency bandwidths that we select as examples. For each of the 600 samples, out of the 16,000 sampled FFT points collected, we select an increased number of features, i.e., 5, 10, 20, and 35 FFT points for the classification task of the 10 identical drones.\u00a0Figure 13<\/a>\u00a0summarizes the classification performance of the 10 identical Solo drones across different frequency bandwidths and number of features.<\/div>
Fig. 13.<\/span><\/div><\/header>
Classification performance of\u00a0Drone-Mag<\/i>\u00a0for 10 identical drones using EM emissions samples collected using the RTL-SDR setup across different frequency bandwidths and number of features.<\/div><\/figcaption><\/figure><\/div><\/section><\/section>

5.5 Outdoor Experimental Validation<\/h3>
To further validate the robustness and environmental resilience of\u00a0Drone-Mag<\/i>, we conducted outdoor experiments by collecting a new set of EM traces from 18 drones and flight controllers under real-world conditions. Our goal is to examine whether Drone-Mag\u2019s classification accuracy, previously validated under controlled laboratory conditions, remains consistent when deployed in outdoor scenarios. We collected EM traces from 10 identical Solo drones and 8 additional flight controllers that had not been tested in prior experiments, as summarized in\u00a0Table 3<\/a>. Each drone\u2019s EM emissions were recorded twice: once in an indoor laboratory environment and again in an outdoor setting. This dataset was used to assess whether environmental variations impact classification performance. For the data collection, we selected four 2 MHz frequency bandwidths within the 40\u201348 MHz range: 40\u201342, 42\u201344, 44\u201346, and 46\u201348 MHz. Each sample was recorded for 250 ms and captured using 16,000 FFT points, with an FFT resolution step of 125 Hz, effectively spanning 2 MHz per bandwidth. For classification purposes, we extracted 35 of the most relevant FFT points from each sample, ensuring that we retained the most distinguishing features of each drone and flight controller. Our ML model was trained exclusively on the EM traces collected indoors. We then tested the model using the outdoor-collected samples to evaluate its generalization performance in different environmental conditions. The classification results were assessed using five key metrics: Accuracy, AUC, Precision, Recall, and F1-score. As summarized in\u00a0Figure 14<\/a>, our results show an average F1-score of 0.9822, 0.9721, 0.9796, 0.9925 for the 40\u201342 MHz, 42\u201344 MHz, 44\u201346 MHz, and 46\u201348 MHz frequency bandwidths, respectively. These results confirm that the EM fingerprinting approach remains consistent and reliable across both indoor and outdoor environments, achieving near-identical classification accuracy. This finding aligns with prior research [10<\/a>], which demonstrated that near-field EM emissions are unaffected by environmental factors due to their localized nature. A critical factor in the consistency of our results is the nature of near-field EM emissions, which originate from a drone\u2019s internal electronics rather than its wireless communication modules. Since these emissions are detectable only within a very short range (typically under 5 cm), they are inherently resilient to external interference from environmental\u00a0Radio Frequency (RF)<\/b>\u00a0sources. Moreover, this near-field characteristic enhances the security of Drone-Mag, making it resistant to eavesdropping and replay attacks. An adversary attempting to capture and replay an EM fingerprint would need to place a recording device within 5 cm of the drone\u2019s components, a highly impractical scenario. This property also aligns with our assumed military and critical infrastructure deployment scenarios, where drones are expected to land in designated zones free from external electronic interference at distances of 5\u201310 cm or more. Additionally, we ensured that the fingerprinting process leveraged unoccupied frequencies within the 40\u201348 MHz range (and also in the 0\u201332, 32\u201334, 34\u201336, 36\u201338, 49\u201351, 75\u201377, and 112\u2013114 MHz). This choice minimizes interference from widely used communication services such as Wi-Fi or Bluetooth, further improving classification robustness. Moreover, these new indoor and outdoor tests were conducted on a new frequency range that had not been tested before in the previous indoor lab-only experiments detailed in\u00a0Section 4<\/a>, further demonstrating the scalability of\u00a0Drone-Mag<\/i>\u00a0across the entire 200 MHz bandwidth, as shown in\u00a0Figure 6(a)<\/a>. Our outdoor experimental results confirm that\u00a0Drone-Mag<\/i>\u00a0provides robust, environment-independent authentication of drones and flight controllers. The near-field nature of the collected EM emissions ensures consistent classification performance across different operational settings, further strengthening its applicability for high-security environments such as military bases and critical infrastructure. The ability to maintain over 0.97 F1-score outdoors validates the feasibility of real-world deployment, reinforcing the scalability and reliability of the\u00a0Drone-Mag<\/i>\u00a0authentication framework. In addition to our outdoor experiments, prior studies on EM fingerprinting of laptops and mobile phones [10<\/a>,\u00a029<\/a>] have investigated the effects of different locations, times, and temperatures on EM fingerprints. These studies found that the fingerprints remain consistent across different locations and time instances, while temperature variations affect the fingerprints only after crossing a specific threshold. In our case, the primary operational scenario is a military base or similarly controlled environment, where such environmental factors can be maintained within acceptable bounds, ensuring consistent fingerprinting during each authentication instance.<\/div>
Fig. 14.<\/span><\/div><\/header>
Drone-Mag<\/i>\u00a0classification performance when testing the indoor trained ML model with the outdoor collected dataset of the 18 drones across different frequency bandwidths.<\/div><\/figcaption><\/figure><\/div><\/section><\/section>

6 Discussion<\/h2>
In the following, we discuss some aspects of our proposed solution\u00a0Drone-Mag<\/i>.<\/div>

6.1 Spectrum Analyzer vs. RTL-SDR Setup<\/h3>
When comparing the classification performance of\u00a0Drone-Mag<\/i>\u00a0using EM emissions samples collected using the spectrum analyzer and RTL-SDR, we can see that they produce comparable results. However, the spectrum analyzer setup requires less sample time length of 150 ms compared to 250 ms for the EM samples collected using the RTL-SDR setup. In addition, the spectrum analyzer can collect the EM emissions from the drones over a wider frequency bandwidth of up to 2 GHz compared to around 3 MHz for the RTL-SDR. However, the RTL-SDR is much cheaper and portable than the spectrum analyzer. The system administrator can decide on which setup to deploy based on the system requirements and available resources.<\/div><\/section>

6.2\u00a0Drone-Mag<\/i>\u00a0Scalability<\/h3>
We acknowledge that the relatively simple models employed in Drone-Mag\u2014such as the SVM and autoencoder\u2014may face limitations when scaled to accommodate thousands or tens of thousands of UAVs. As the dataset size increases, computational overhead, memory requirements, and training times can also increase. However, the simplicity of these models was chosen to fit the current dataset and ensure real-time performance without the need for extensive computational resources.<\/div>
For larger datasets, more complex models or alternative architectures, such as convolutional neural networks or transformer-based models, may be employed to maintain scalability and accuracy. These architectures are known for their ability to handle larger feature spaces and complex datasets while maintaining robust performance. However, for the size and nature of our current dataset, these more complex models are not necessary, as the SVM and autoencoder have demonstrated excellent performance with minimal computational overhead.<\/div>
In addition to the previous point of adopting more complex ML models for larger datasets, several strategies can be employed to enhance Drone-Mag\u2019s scalability to accommodate an increasing number of drones:
\u2014<\/div>
Sample Duration<\/i>: In our current implementation, each recorded EM emissions sample is only 250 ms long and spans a 2 MHz frequency bandwidth, which is sufficient for drone brand and flight controller identification as well as identical drone authentication. This sampling period can be extended beyond 250 ms to further accommodate an increasing number of drones and be able to distinguish their differences more clearly. Additionally, multiple samples can be used in conjunction with majority voting to enhance accuracy.<\/div><\/div><\/div>
\u2014<\/div>
Majority Voting for Authentication<\/i>: Instead of relying on a single 250 ms sample for authentication, the system can utilize multiple samples and apply majority voting. For instance, using three samples, if at least two confirm authentication, the drone is authenticated. This approach reduces false positives and negatives, improving robustness while increasing authentication delay.<\/div><\/div><\/div>
\u2014<\/div>
Frequency Bandwidth Optimization<\/i>: We have tested Drone-Mag\u2019s performance across multiple frequency bandwidths (30\u201332, 32\u201334, 34\u201336, 36\u201338, 40\u201342, 42\u201344, 44\u201346, 46\u201348, 49\u201351, 75\u201377, and 112\u2013114 MHz), achieving excellent performance. However, the recorded 200 MHz frequency bandwidth shows variations in EM emissions that can be further utilized, as shown in\u00a0Figure 6<\/a>. By optimizing the selection of specific bandwidths, the system can accommodate more drones without significantly increasing computational demands. Additionally, instead of relying on a single 2 MHz bandwidth per sample, multiple 2 MHz bands can be used simultaneously to improve robustness and scale to an increased number of drones.<\/div><\/div><\/div>
\u2014<\/div>
Feature Selection<\/i>: In our RTL-SDR-based setup, each sample is 250 ms long and spans 2 MHz, but we use only 35 FFT points as features for the classification task and 50 FFT points for rogue drone detection, out of a total of 16,000 FFT points. This represents only about 0.3% of the total recorded spectrum. By selecting different FFT point groups or combining multiple groups, the system administrator can increase the number of identifiable drones or ensure a more robust authentication process without needing a complete model retraining. Furthermore, the total number of FFT points can be increased\u2014for example, from 16,000 to 32,000\u2014allowing for finer granularity and higher precision in feature extraction, improving discrimination between a larger number of drones.<\/div><\/div><\/div><\/div><\/div><\/section>

6.3\u00a0Drone-Mag<\/i>\u00a0Proximity as a Security Advantage<\/h3>
While the close proximity requirement for\u00a0Drone-Mag<\/i>\u00a0may seem like a limitation, it actually provides a significant security advantage. Since\u00a0Drone-Mag<\/i>\u00a0utilizes a near-field EM probe, the adversary must be in extremely close physical proximity (within a few centimeters) to the drone to successfully record its EM emissions for a potential replay attack. In practice, this is highly unlikely due to the secure and monitored nature of the areas where drones undergo authentication (e.g., military bases, airports, critical infrastructure). Unlike acoustic or vision-based authentication methods, which can be eavesdropped from the far-field using basic recording devices, Drone-Mag\u2019s near-field requirement makes it nearly impossible for an adversary to passively capture the EM emissions without being detected. In addition, the adversary would also need to get very close to the authentication pad to replay the recorded emissions effectively, adding an additional layer of security.<\/div><\/section>

6.4 Re-Fingerprinting and PLA<\/h3>
It is well established that EM and RF-based authentication methods may require periodic re-fingerprinting to account for changes over time. This issue is common across physical-layer fingerprinting methods [28<\/a>], as demonstrated in prior research:
\u2014<\/div>
Maes and Van Der Leest [36<\/a>] discussed how silicon aging, such as Negative Bias Temperature Instability, can impact SRAM\u00a0Physical Unclonable Function (PUF)<\/b>\u00a0reliability, requiring periodic recalibration.<\/div><\/div><\/div>
\u2014<\/div>
Guo et al. [15<\/a>] highlighted that aging-induced unreliability in SRAM PUFs necessitates periodic fingerprint updates to maintain accuracy.<\/div><\/div><\/div>
\u2014<\/div>
For\u00a0Drone-Mag<\/i>, we acknowledge that over extended periods (like other physical-layer fingerprinting solutions), electronic components may experience gradual changes that can affect the EM fingerprint. To address this, we propose a fingerprint slow updating technique, as described in prior studies on physical-layer fingerprinting [10<\/a>]. This approach involves periodically updating the fingerprints in the database if the current fingerprint is still classified as belonging to the legitimate drone but shows a small, consistent offset due to slow changes. This compensation mechanism ensures that gradual feature drifts caused by hardware aging do not impact the overall authentication accuracy. Additionally, in our specific scenario involving military bases and critical infrastructures, drones typically undergo routine checkups during landing after missions. During these checkups, additional EM samples can be collected to reinforce the existing fingerprint profile. This allows the fingerprint to evolve over time and incorporate any minor variations in the drone\u2019s EM emissions, effectively strengthening the model through continuous feedback. This enforcement process ensures that the system remains robust over the lifespan of the drone without requiring significant operational changes.<\/div><\/div><\/div><\/div><\/div><\/section>

6.5 Impersonation Attack<\/h3>
Impersonation or mimicry attacks involve attempting to imitate the EM fingerprint of a target device by manipulating the software or configurations of a similar device. However, the fundamental discrepancies in EM fingerprints originate from the physical hardware (e.g., the flight controller\u2019s electronic components). Manipulating the software or settings of an attack device may alter its EM fingerprint, but it is nearly impossible to make it identical to the target drone\u2019s fingerprint due to the hardware-dependent nature of the emissions\u2014as commonly assumed in the literature [9<\/a>,\u00a025<\/a>]. Studies [10<\/a>] have shown that the hardware-level variations are subtler yet more defining than the variations caused by software configurations, making successful mimicry highly unlikely.<\/div><\/section>

6.6 Replay Attack<\/h3>
Unlike other physical-layer fingerprinting techniques such as acoustic or vision,\u00a0Drone-Mag<\/i>\u00a0relies on a near-field EM probe that only detects emissions within close proximity. Hence, in order to record\/replay the EM emissions of a specific drone, an adversary would need to get extremely close to the drone during the fingerprinting process. In our scenario, this process typically occurs within a restricted and secure area, such as a military base, airport, or critical infrastructure facility. These locations have stringent security protocols, making it difficult for an adversary to access the authentication area and record\/replay the EM fingerprint of a legitimate drone. Furthermore, even if an adversary intercepts the drone outside of the secure zone (e.g., military infrastructure, airports, or other critical locations) and manages to record its EM emissions from near-field proximity, they would still need to enter the secure zone and be in close proximity to the authentication system to conduct a replay attack. Given the controlled nature of such environments and the security measures in place, this adds an additional layer of protection against replay attacks.<\/div><\/section>

6.7 Drone Firmware Modification Detection<\/h3>
For most commercial drones, changing the drone\u2019s firmware is fairly simple. However, in the case of military or classified drones considered in the scenario detailed in\u00a0Section 2<\/a>, manipulating the firmware might be protected by hardware or software techniques [32<\/a>,\u00a057<\/a>]. Nevertheless, as proven in [26<\/a>], the firmware modifications can be detected leveraging ICs EM emissions.<\/div><\/section><\/section>

7 Related Work<\/h2>
We can divide the EM fingerprinting contributions into two main categories: (i) electronic components and devices classification and (ii) codes or electronic components activities monitoring. In the following, we summarize some of the relevant contributions to those two topics in addition to discussing existing drone fingerprinting techniques.<\/div>
Electronic Components and Devices Classification<\/i>. The feasibility of fingerprinting wireless devices via RF signal non-idealities was first shown in [53<\/a>]. Later, Cobb et al. [58<\/a>] linked manufacturing variances in integrated circuits to unique RF characteristics, enabling identification of 40 identical microcontrollers via unintentional emissions. Similarly, Wright [59<\/a>] identified SCADA sensors and actuators by analyzing emissions during code execution. Authors in [6<\/a>] exploited unintentional RF emissions to classify IEEE 802.15.4 ZigBee devices in critical infrastructure. Magnetic emissions were also used for fingerprinting devices and antennas [21<\/a>]. IEEE 802.15.4 emissions helped reject rogue devices in [12<\/a>]. USB Flash drives were fingerprinted via unintentional EM emissions [26<\/a>], while [10<\/a>,\u00a029<\/a>] leveraged CPU emissions to identify laptops and smartphones. Authors in [62<\/a>] distinguished smartphone brands and camera statuses via EM emissions. Arduino devices and their software were fingerprinted in [38<\/a>]. Car fingerprinting via unintended emissions was explored in [14<\/a>].<\/div>
Codes or Electronic Components Activities Monitoring<\/i>. For fingerprinting device activities, Sehatbakhsh et al. [48<\/a>] introduced EMMA, using EM emissions for attestation. IDEA [30<\/a>] detected malware in embedded systems via EM analysis. Other malware detection methods include [7<\/a>,\u00a017<\/a>,\u00a039<\/a>,\u00a047<\/a>,\u00a049<\/a>]. EM emissions were used as PUF for IoT authentication [23<\/a>,\u00a025<\/a>]. Trojan detection via EM sensors was introduced by He et al. [19<\/a>], while Chaman et al. [8<\/a>] leveraged EM emissions to detect RF eavesdroppers. Cryptojacking detection via GPU magnetic emissions was proposed by Xiao et al. [60<\/a>], and Maia et al. [37<\/a>] inferred neural network topology from GPU power cable flux. Hidden camera detection using EM emissions was explored by Liu et al. [34<\/a>], and Ramesh et al. [41<\/a>] estimated laptop microphone status similarly. Jamming detection via magnetic emissions was proposed in [22<\/a>].<\/div>
Drone Fingerprinting<\/i>. A survey of drone detection and classification methods is introduced in [54<\/a>].\u00a0Table 4<\/a>\u00a0provides a qualitative comparison of\u00a0Drone-Mag<\/i>\u00a0against related literature on drone authentication. SoundUAV [42<\/a>] proposed a solution to fingerprint drones based on their motors\u2019 noise characteristics that are unique due to manufacturing defects. Additional drone acoustic fingerprinting methods are presented in [11<\/a>,\u00a031<\/a>,\u00a050<\/a>,\u00a056<\/a>]. However, such solutions are susceptible to environmental noises that could disrupt the motors sounds and unique fingerprint, unlike our proposed solution\u00a0Drone-Mag<\/i>\u00a0that leverages the unintentional EM emissions that are collected only from near-field around the drone ICs. In addition, acoustic solutions are unable to detect any adversary tampering with the drone\u2019s electronic hardware. On the other hand,\u00a0Drone-Mag<\/i>\u00a0is based on the EM signature of each individual drone that is tied to the inherent properties of its electronic components. Drone RF fingerprinting has been proposed in [33<\/a>,\u00a044<\/a>,\u00a051<\/a>]. However, RF methods require the drone to have an RF interface and are susceptible to interference and environmental noises in addition to the possibility of signal interception by an adversary. Drone detection and identification using a camera is introduced in [43<\/a>]. However, it can be spoofed, is susceptible to environmental noises and obstructions, and cannot detect adversary hardware tampering. Authors in [18<\/a>,\u00a040<\/a>] discuss radar detection and classification of drones. However, radars cannot distinguish or authenticate identical drones, nor can they detect malicious tampering done to the drone\u2019s electronic components. Authenticating drones via PUF is proposed in [35<\/a>,\u00a063<\/a>]. While PUF is one of the few authentication techniques that can detect hardware tampering, they require an interactive communication channel with the drone. Finally, Gyrosfinger [52<\/a>] investigated the issue of drone fingerprinting, as the researchers utilized gyroscope offset values to distinguish different drones. However, their approach is limited to drones that possess an unencrypted telemetry channel and cannot detect hardware tampering, e.g., a different flight controller is installed in the drone by an adversary. In contrast,\u00a0Drone-Mag<\/i>\u00a0is not reliant on the underlying protocols and can operate on any type of drone, as it exploits the unique unintentional EM emissions produced by the drones ICs.<\/div>
Table 4.<\/span><\/div><\/header>
Ref.<\/th>Auth. Method<\/th>Robust to noise<\/th>Non- interactive<\/th>Only near-field emissions<\/th>Hardware tampering detection<\/th>Identical drones Auth.<\/th>No RF needed<\/th><\/tr><\/thead>
[42<\/a>]<\/td>Acoustic<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cf<\/td><\/tr>
[11<\/a>]<\/td>Acoustic<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cf<\/td><\/tr>
[31<\/a>]<\/td>Acoustic<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td><\/tr>
[50<\/a>]<\/td>Acoustic<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td><\/tr>
[56<\/a>]<\/td>Acoustic<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td><\/tr>
[35<\/a>]<\/td>PUF<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cf<\/td>\u25cb<\/td><\/tr>
[63<\/a>]<\/td>PUF<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cf<\/td>\u25cb<\/td><\/tr>
[51<\/a>]<\/td>RF<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td><\/tr>
[44<\/a>]<\/td>RF<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td><\/tr>
[33<\/a>]<\/td>RF<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td><\/tr>
[43<\/a>]<\/td>Camera<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cf<\/td><\/tr>
[40<\/a>]<\/td>Radar<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td><\/tr>
[18<\/a>]<\/td>Radar<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td><\/tr>
[52<\/a>]<\/td>Gyroscope<\/td>\u25cf<\/td>\u25cb<\/td>\u25cb<\/td>\u25cb<\/td>\u25cf<\/td>\u25cb<\/td><\/tr>
Drone-Mag<\/i><\/td>EM emissions<\/td>\u25cf<\/td>\u25cf<\/td>\u25cf<\/td>\u25cf<\/td>\u25cf<\/td>\u25cf<\/td><\/tr><\/tbody><\/table><\/div>
Qualitative Comparison of\u00a0Drone-Mag<\/i>\u00a0against Related Literature on Drone Authentication<\/div><\/div>
The filled-circle symbol indicates that the feature is available, while the empty-circle symbol indicates that the feature is not available.<\/div><\/div><\/figcaption><\/figure><\/div><\/section>

8 Conclusion<\/h2>
In this article, we introduced\u00a0Drone-Mag<\/i>, a physical-layer based UAVs authentication scheme to boost the existing multifactor authentication protocols via exploiting the intrinsic manufacturing variations of the drone\u2019s flight controller and electronic components in the form of its unintentional EM emissions.\u00a0Drone-Mag<\/i>\u00a0is an authentication technique that is privacy-preserving, passive, can detect adversary hardware tampering with the integrated circuitry of the drone, and does not require any hardware or software modification to the existing drones. We conducted an extensive experimental campaign on 23 drones to test three main scenarios: (i) identification of 14 different drones and flight controllers; (ii) authentication of 10 identical drones; and (iii) detection of rogue drones using an autoencoder-based framework. All tasks achieved a minimum average of 0.97 F1-score. Overall,\u00a0Drone-Mag<\/i>\u00a0emerges as an efficient, unique, experimentally proven, viable, and crypto-less solution to authenticate UAVs.<\/div><\/section><\/div><\/section>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Unmanned Aerial Vehicles (UAVs) are gaining increased popularity in a wide range of domains and applications. As a result, they are also becoming a target of malicious attacks. For example, drone impersonation of military or civilian drones can cause serious security and privacy breaches. There have been some recent contributions… <\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-3010","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/3010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=3010"}],"version-history":[{"count":7,"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/3010\/revisions"}],"predecessor-version":[{"id":3042,"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/3010\/revisions\/3042"}],"wp:attachment":[{"href":"https:\/\/theemcnews.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=3010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}