UAV Cybersecurity with Mamba-KAN-Liquid Hybrid Model: Deep Learning-Based Real-Time Anomaly Detection

Abstract

Highlights What are the main findings? Novel Mamba-KAN-Liquid hybrid architecture achieves detection rates exceeding 95% across six UAV cyberattack types (GPS spoofing: 97.3%, jamming: 95.8%, MITM: 96.2%, sensor manipulation: 94.7%, DDoS: 98.1%, zero-day: 89.4%) with 47.3 ms inference latency, representing 4-5x speedup over transformer baselines. The model demonstrates exceptional robustness with 89.4% zero-day attack detection and maintains 76.5% accuracy under severe noise conditions (sigma = 0.20), outperforming state-of-the-art methods by 16-22 percentage points in adversarial scenarios. What are the implications of the main findings? Real-time cybersecurity deployment becomes viable on resource-constrained UAV platforms with only 2.5 M parameters requiring 96 MB memory, enabling onboard threat detection without reliance on ground station connectivity. The architectural framework extends beyond UAV applications to other edge computing scenarios requiring real-time anomaly detection under computational constraints, with proven scalability to 50-UAV swarm monitoring while maintaining sub-100 ms latency.Highlights What are the main findings? Novel Mamba-KAN-Liquid hybrid architecture achieves detection rates exceeding 95% across six UAV cyberattack types (GPS spoofing: 97.3%, jamming: 95.8%, MITM: 96.2%, sensor manipulation: 94.7%, DDoS: 98.1%, zero-day: 89.4%) with 47.3 ms inference latency, representing 4-5x speedup over transformer baselines. The model demonstrates exceptional robustness with 89.4% zero-day attack detection and maintains 76.5% accuracy under severe noise conditions (sigma = 0.20), outperforming state-of-the-art methods by 16-22 percentage points in adversarial scenarios. What are the implications of the main findings? Real-time cybersecurity deployment becomes viable on resource-constrained UAV platforms with only 2.5 M parameters requiring 96 MB memory, enabling onboard threat detection without reliance on ground station connectivity. The architectural framework extends beyond UAV applications to other edge computing scenarios requiring real-time anomaly detection under computational constraints, with proven scalability to 50-UAV swarm monitoring while maintaining sub-100 ms latency.Abstract Unmanned Aerial Vehicles (UAVs) are increasingly being used in critical infrastructure, defense, and civilian applications, and face new cybersecurity threats. In this work, we present a novel hybrid deep learning architecture that combines Mamba, Kolmogorov-Arnold Networks (KAN), and Liquid Neural Networks for real-time cyberattack detection in UAV systems. The proposed Mamba-KAN-Liquid (MKL) model integrates Mamba's selective state-space mechanism for temporal dependency modeling, KAN's learnable activation functions for feature representation, and Liquid networks' dynamic adaptation capabilities for real-time anomaly detection. Extensive evaluations on CIC-IDS2017, CSE-CIC-IDS2018, and synthetic UAV telemetry datasets demonstrate that our model achieves detection rates exceeding 95% across six different attack scenarios, including GPS spoofing (97.3%), network jamming (95.8%), man-in-the-middle attacks (96.2%), sensor manipulation (94.7%), DDoS (98.1%), and zero-day attacks (89.4%). The model meets real-time processing requirements with an average inference time of 47.3 ms for a sample batch size of 32, making it suitable for practical deployment on resource-constrained UAV platforms.