Metric Learning for Generalizable Cyber Attack Detection in Unmanned Aerial Vehicles

Abstract

Unmanned aerial vehicles (UAVs) operate as cyber-physical systems that continuously exchange telemetry and control data over wireless links, exposing them to attacks targeting both communication and data integrity. Existing machine learning-based intrusion detection systems for UAVs are evaluated under closed-set assumptions, where training and test attacks share the same distribution and all test classes are known at training time, leaving generalization to attack types unseen during training underexplored. In this paper, we propose a supervised temporal contrastive open-set detector (TCOD) for generalizable attack detection. TCOD adopts a metric learning approach in which a temporal convolutional network encoder is trained with supervised contrastive loss to construct an embedding space for time-windowed data. In this embedding space, benign windows are mapped near other benign windows, windows from the known training attack are mapped near other known-attack windows, and embeddings from the two training labels are separated. TCOD then uses distance to class prototypes to identify benign and known-attack windows while rejecting attack behavior unseen during training as attack. We evaluate TCOD under four attack cases including deauthentication, evil twin, false data injection, and replay attacks over physical-only, cyber-only, and fused cyber-physical feature sets. Our experimental results demonstrate that TCOD consistently outperforms supervised and unsupervised benchmark detectors by 9–30% and 8–23%, respectively, in F1-score across attack cases and feature-set modalities, highlighting the efficacy of temporal contrastive metric learning for generalizable attack detection against seen and unseen attacks on UAVs.