FlyBlind: Cross-Slice Timeliness Attacks on UAV Situational Awareness over 5G

2026-08-27

AI Summary

研究解决了5G网络中无人机态势感知的时效性攻击问题，通过FlyBlind方法展示了合法共租户如何导致地面控制站状态老化而不被传统监控手段发现。

Abstract

Beyond Visual Line of Sight (BVLOS) Uncrewed Aerial Systems (UAS) operating over 5G Standalone (SA) networks use a shared User Plane for both command-and-control (C2) data and video feedback. Operators assess link quality through latency and availability, relying on soft isolation between network slices. However, the risk that an authorized co-tenant could make the Ground Control Station (GCS) state outdated without disrupting the connection remains underexplored. This work introduces FlyBlind, a timeliness attack in which an authorized co-tenant on a neighboring slice maintains legitimate uplink demand, causing state aging at the GCS without a rogue gNB or direct interference with C2 traffic. Our key insight is that, under soft isolation, sharing idle resources turns authorized competition for grants into state aging that conventional link monitors fail to detect. We formalize this effect, termed Silent State Staleness, as a falsifiable false-healthy predicate. On a dedicated testbed, telemetry age at the GCS saturates at approximately 12 seconds, with discrepancies of tens of meters between the GCS position estimate and ground truth, while the one-way delay (OWD) p99 remains in the tens of milliseconds, availability exceeds 99.9%, and the vehicle keeps operating in GUIDED mode without triggering failsafe mechanisms. These findings indicate that, in deployments with asymmetric uplink enforcement, verifying state freshness at the destination is essential rather than relying solely on link health.

Problem

• UAV Situational Awareness
• 5G Standalone Networks
• Cross-Slice Timeliness Attacks
• Ground Control Station
• Soft Isolation

Innovation

• FlyBlind
• Timeliness Attack
• Silent State Staleness
• Soft Isolation
• UAV Situational Awareness