Detecting drones status via encrypted traffic analysis

We propose a methodology to detect the current status of a powered-on drone (flying or at rest), leveraging just the communication traffic exchanged between the drone and its Remote Controller (RC). Our solution, other than being the first of its kind, does not require either any special hardware or to transmit any signal; it is built applying standard classification algorithms to the eavesdropped traffic, analyzing features such as packets inter-arrival time and size. Moreover, it is fully passive and it resorts to cheap and general purpose hardware. To evaluate the effectiveness of our solution, we collected real communication measurements from a drone running the widespread ArduCopter open-source firmware, mounted on-board on a wide range of commercial amateur drones. The results prove that our methodology can efficiently and effectively identify the current state of a powered-on drone, i.e., if it is flying or lying on the ground. In addition, we estimate a lower bound on the time required to identify the status of a drone with the requested level of assurance. The quality and viability of our solution do prove that network traffic analysis can be successfully adopted for drone status identification, and pave the way for future research in the area.