The application field for Unmanned Aerial Vehicle (UAV) technology and its adoption rate have been increasing steadily in the past years. Decreasing cost of commercial drones has enabled their use at a scale broader than ever before. However, increasing the complexity of UAVs and decreasing the cost, both contribute to a lack of implemented security measures and raise new security and safety concerns. For instance, the issue of implausible or tampered UAV sensor measurements is barely addressed in the current research literature and thus, requires more attention from the research community. The goal of this survey is to extensively review state-of-the-art literature regarding common sensor-and communication-based vulnerabilities, existing threats, and active or passive cyberattacks against UAVs, as well as shed light on the research gaps in the literature. In this work, we describe the Unmanned Aerial System (UAS) architecture to point out the origination sources for security and safety issues. We evaluate the coverage and completeness of each related research work in a comprehensive comparison table as well as classify the threats, vulnerabilities and cyber-attacks into sensor-based and communication-based categories. Additionally, for each individual cyber-attack, we describe existing countermeasures or detection mechanisms and provide a list of requirements to ensure UAV's security and safety. We also address the problem of implausible sensor measurements and introduce the idea of a plausibility check for sensor data. By doing so, we discover additional measures to improve security and safety and report on a research niche that is not well represented in the current research literature.
KEYWORDSUnmanned aerial vehicle; unmanned aerial system; cyber security and privacy; drone swarm; security vulnerabilities; cyber-threats; cyber-attacks; plausibility check Nomenclature UAV Unmanned aerial vehicle UAS Unmanned aerial system GCS Ground control station IMU Inertial measurement unit FDI Fault detection and isolation FTC Fault tolerant control 1020