From High-Level Types to Low-Level Monitors: Synthesizing Verified Runtime Checkers for MAVLink

2026-04-04

AI Summary

This work addresses the vulnerability of the MAVLink protocol to stealthy attacks that exploit semantically valid but temporally anomalous message sequences, stemming from its lack of runtime validation of message timing semantics. To mitigate this, the authors propose Platum, a framework that introduces a lightweight domain-specific language (DSL) grounded in refined multiparty session types (RMPST). Leveraging Meta-F*’s reflection mechanism, Platum automatically verifies communication protocols and compiles them directly into heap-free C finite-state machines, deployed as monitoring proxies at the communication boundary between drones and ground stations. By eliminating manual proofs and managed runtimes, Platum enables fully automated, verifiably correct synthesis of high-level type specifications into resource-constrained hardware-compatible monitors. In ArduPilot SITL simulations, Platum reduces monitoring latency by 4× and significantly lowers memory overhead compared to the DATUM approach.

Abstract

Standard communication protocols for Unmanned Aerial Vehicles (UAVs), such as MAVLink, lack the capability to enforce the contextual validity of message sequences. Autopilots therefore remain vulnerable to stealthy attacks, where syntactically correct but semantically ill-timed commands induce unsafe states without triggering physical anomaly detectors. Prior work (DATUM) demonstrated that global Refined Multiparty Session Types (RMPSTs) are an effective specification language for centralized MAVLink protocol enforcement, but suffered from two engineering failures: manual proof terms interleaved with protocol definitions, and an OCaml extraction backend whose managed runtime is incompatible with resource-constrained UAV hardware. We present Platum, a framework that addresses both failures with a minimal DSL requiring only the five semantic components of a global session type (sender, receiver, label, payload variable, refinement predicate), whose structural well-formedness conditions are confirmed via reflective decision procedures in Meta-F*. Confirmed specifications are compiled directly into flat, allocation-free C Finite State Machines (FSMs), deployed as centralized proxy monitors at the GCS/UAV communication boundary. Our evaluation demonstrates a 4x reduction in total monitor latency and lower memory overhead compared to DATUM, measured via ArduPilot SITL simulation.

Problem

• MAVLink
• runtime verification
• contextual validity
• UAV security
• message sequence

Innovation

• Refined Multiparty Session Types
• Verified Runtime Monitor
• Allocation-free FSM
• Meta-F*
• MAVLink Protocol Enforcement