*4.2. MAVLink Message Data Acquisition*

To better perform the machine learning-based anomaly detection (MLAD) within LightMAN among UAM networks, we leveraged the MAVLink Protocol, which stands for micro-air–vehicle link, and its related messages as our starting point for the security analysis of UAM networks. It is an open-source protocol, and it is supported by many closed-source projects for drones to send way-points, control commands, and telemetry data [40]. Usually, it contains two types of messages: state messages and command messages. State messages refer to these messages sent from the unmanned system to the ground station and contain information about the state of the system, such as its ID, location, velocity, and altitude. Command messages are usually sent from the ground station to the unmanned system to execute some actions by autopilot. Those messages are transmitted through WiFi, Ethernet, or other serial telemetry channels. We also utilized a SITL simulator (ArduPilot) [40] to emulate the MAVLink message communication. Specifically, we ran the ArduPilot directly on a local server without any special hardware. While running, the sensor data came from a flight dynamics model in a flight simulator.

Figure 3 presents an example of obtained MAVLink message source data. We recorded and saved this key information for MLAD training. For instance, *GPS\_RAW\_INT* refers to the absolute geolocation of GPS, latitude, longitude, and altitude. *AHRS* refers to the attitude and heading reference system (AHRS), which consists of sensors on three axes that provide attitude information for aircraft, including roll, pitch, and yaw. *EKF\_STATUS\_REPORT* indicates that an extended Kalman filter (EKF) algorithm was used to estimate vehicle position, velocity, and angular orientation based on rate gyroscopes, accelerometer, compass, GPS, airspeed, and barometric pressure measurements.

**Figure 3.** Software-In-The-Loop Simulation for Data Acquisition.
