Machine Learning-Based Intrusion Detection Systems for the Internet of Drones: A Systematic Literature Review

Internet of Drones (IoD) is a dynamic network architecture in which multiple drones, equipped with communication, sensing, and computation capabilities, are interconnected through Internet of Things (IoT) technologies to perform coordinated tasks autonomously. This infrastructure enables seamless real-time data exchange and collaborative operations across diverse applications, ranging from surveillance to delivery services, while ensuring adaptability, scalability, and security in dynamic aerial environments. However, the IoD introduces new security challenges, as drones are highly vulnerable to various cyberthreats and cyberattacks. Existing Intrusion Detection Systems (IDS) for IoD face several limitations, including high false positive rates, resource constraints of drones, limited adaptability to evolving attack patterns, and a lack of standardized datasets for benchmarking, despite ongoing research efforts. Moreover, there is a lack of a comprehensive study that systematically consolidates existing research. In this paper, we present a systematic literature review to examine the current research area of intrusion detection systems for IoD, focusing on the effectiveness of implemented machine learning models, employed datasets, existing challenges and limitations, as well as emerging trends and future research directions. This review follows PRISMA guidelines, with peer-reviewed journal articles and conference papers selected as the inclusion criteria. Publications relevant to the topic are sourced from a range of databases, including Scopus, IEEE Xplore, ScienceDirect, SpringerLink, ACMDigital Library, and MDPI, covering a 10-year period from 2014 to 2024. From an initial pool of 1,909 records, 62 relevant reports are selected to address the identified research questions. The selected studies are categorized according to publication year, venue, journal, drone domain, IDS type, utilized algorithms, datasets, attack classifications, and software environments. Additionally, a comparative analysis across various factors is presented.