# Runtime Anomaly Detection for Drones: An Integrated Rule-Mining and Unsupervised-Learning Approach

arXiv: https://arxiv.org/abs/2505.01947 · HTML: https://mlsanity.com/paper/2505.01947/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 34 references that are in the map.
- First posted on arXiv 3 May 2025.

## Builds on (most cited first, 5 of 5)

- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System](https://mlsanity.com/paper/1801.00903/) (2018)
- [Log-based Anomaly Detection of CPS Using a Statistical Method](https://mlsanity.com/paper/1701.03249/) (2017)
- [Control Parameters Considered Harmful: Detecting Range Specification Bugs in Drone Configuration Modules via Learning-Guided Search](https://mlsanity.com/paper/2112.03511/) (2021)

## Built on by (most cited first, 1 of 1)

- [RisConFix: LLM-based Automated Repair of Risk-Prone Drone Configurations](https://mlsanity.com/paper/2512.07122/) (2025)

## Abstract (arXiv)

UAVs, commonly referred to as drones, have witnessed a remarkable surge in popularity due to their versatile applications. These cyber-physical systems depend on multiple sensor inputs, such as cameras, GPS receivers, accelerometers, and gyroscopes, with faults potentially leading to physical instability and serious safety concerns. To mitigate such risks, anomaly detection has emerged as a crucial safeguarding mechanism, capable of identifying the physical manifestations of emerging issues and allowing operators to take preemptive action at runtime. Recent anomaly detection methods based on LSTM neural networks have shown promising results, but three challenges persist: the need for models that can generalise across the diverse mission profiles of drones; the need for interpretability, enabling operators to understand the nature of detected problems; and the need for capturing domain knowledge that is difficult to infer solely from log data. Motivated by these challenges, this paper introduces RADD, an integrated approach to anomaly detection in drones that combines rule mining and unsupervised learning. In particular, we leverage rules (or invariants) to capture expected relationships between sensors and actuators during missions, and utilise unsupervised learning techniques to cover more subtle relationships that the rules may have missed. We implement this approach using the ArduPilot drone software in the Gazebo simulator, utilising 44 rules derived across the main phases of drone missions, in conjunction with an ensemble of five unsupervised learning models. We find that our integrated approach successfully detects 93.84% of anomalies over six types of faults with a low false positive rate (2.33%), and can be deployed effectively at runtime. Furthermore, RADD outperforms a state-of-the-art LSTM-based method in detecting the different types of faults evaluated in our study.