New Research
Combating Mobile-enabled Military Drones
Responding to an Imminent Threat
The experience from Ukraine shows that drones operating deep within enemy territory depend in many cases on locally available mobile networks to extend their range, enhance resilience, and evade electronic warfare measures. Since the first mobile-enabled drone attacks in Ukraine were reported in 2023, the number of use cases for mobile connectivity and their sophistication has grown, signaling an increasing reliance on mobile connectivity. That trend is likely to continue.
For governments and defense organizations, malicious drone operations have become a critical issue, posing military and hybrid threats. The European Commission has recognized mobile networks as a crucial resource to enhance drone detection and mitigation efforts in its recent action plan. Enea has extensive experience in control-plane and user-plane data analytics, as well as mobile network security. This uniquely positions us to research this area with the aim of providing solutions to government agencies, defense forces, and mobile network operators.
What is Enea’s Drone Research About?
Enea is researching countermeasures against drones that exploit mobile network connectivity. This research has two main components:
- How can drones be detected by monitoring network activity? Understanding on a detailed level how drones utilize mobile networks, including how and when they connect, and what the communication over the mobile connection looks like, enables detection.
- Design a detection and defense system that specifically targets identified drones, leveraging insights from the first part and information shared between operators or from external sources.
This research draws on and combines several of Enea’s areas of expertise, including:
- Network Data Traffic Analytics, which provides real-time visibility into how users interact with mobile data services.
- DPI traffic intelligence providing fine-grained application, flow, and session classification, including for encrypted traffic.
- Mobile network security, detecting and mitigating malicious use of mobile networks via control plane analysis and blocking.
Enea is uniquely equipped to combine deep expertise in DPI, traffic intelligence, network data analytics, signaling security, and AI to develop defenses that leverage information already present in mobile networks.
Network detection and blocking require multiple technologies to be used in the mobile network. Relying on a single method can be too inaccurate or may not work in all situations, but analyzing traffic on both the user plane and control plane at the same time can provide clear insights.
Background: Targeted Countermeasures Against Mobile-Enabled Drones
Why are Combat Drones using Mobile Connectivity?
There are several advantages to using existing mobile networks for drone communication. Equipping a drone with mobile connectivity is cheap and simple, as it uses standardized consumer technology. It blends communication into legitimate traffic from mobile subscribers and IoT devices in the network. Additionally, countermeasures can significantly impact legitimate critical communication, making it harder to fight back.
Wars are not the only situation where drones threaten national security. Hybrid attacks and espionage are also cases where drones pose threats to critical infrastructure. For example, in the fall of 2025, several airports in Scandinavia temporarily closed after sightings of drone activity (these incidents have mostly not been confirmed as actual drone attacks, let alone attributed to any state actor). Mobile communication can provide similar benefits in hybrid attacks as in warfare.
Defenses against hostile drones, whether in outright war or hybrid attacks, increasingly depend on the ability to detect their activity in mobile networks and subsequently block them from access to the network.
What is Needed to Detect and Mitigate Hostile Drones?
As militaries increasingly combine dedicated defense communication channels with civilian mobile networks, the implications for security and society become more significant. Countermeasures within mobile networks, such as broad service outages, can cause major societal and economic disruption. A more targeted approach is therefore necessary. As our research shows, drones connecting via mobile networks can be detected and neutralized through the network itself, making it possible to disconnect only the drone-operator communication link and thereby minimizing impact on legitimate users.
Mobile networks are critical infrastructure that support daily life, economic activities, and emergency communications, making widespread service shutdowns unacceptable. Instead, the preferred strategy is a precise, targeted intervention that restricts connectivity solely for verified hostile drones, maintaining normal service for everyone else.
How can Malicious Drone Activity in Mobile Networks be Detected?
One reason why mobile connectivity is efficient for operating drones in hostile territory is that the communication easily blends with legitimate traffic. Using the same network and radio interface as any other mobile user allows the drone to hide in plain sight. However, as our research shows, there are several potential ways to detect a drone’s communication using data already available within a mobile network.
- First is how it moves – its trajectory. A drone will not move across the landscape as people typically do. These checks are already performed by signaling firewalls to verify signaling traffic from mobile users. Detecting drones will require different algorithms, but based on the same principle.
- Second is how it uses data and communicates. A drone’s communication differs from that of a regular mobile user. Analyzing traffic patterns (also for encrypted communication) can provide vital insights. Commercial drones use standardized communication protocols, some of which are drone-specific. These protocols have unique signatures that can be detected, allowing the separation of drone communication from other types.
- Third is the behavior. The history of the SIM identity, including when and where it has been activated, how it has been used, and if there is any suspicious SIM activity, can provide additional clues.
Machine learning and AI have a significant role in drone detection. Learning the patterns of legitimate subscribers provides a baseline for detecting anomalies. This is a fundamental task well-suited for machine learning.
Riders on the Cellular Storm – Mobile Connected UAVs in Conflict
Enea’s report on detecting and mitigating UAVs in mobile networks provides the empirical foundation for our research into potential drone countermeasures.
Drawing on information from Ukraine and other armed conflicts, the report tracks how drone network connectivity has evolved from early 2G systems to advanced 4G and 5G links required for audiovisual transmissions and command‑and‑control. It also explores next‑step innovations including non‑terrestrial networks and AI‑enabled autonomous operations, comparing mobile network–based communication with other technologies.
Critically, the report offers guidance on countering enemy drones that exploit local mobile connectivity, which is directly relevant to mobile network operators, regulators, and national security and defense agencies. It assesses mitigation options based on operational effectiveness and their effects on civilian communications, public safety, and economic activity, issues that are of increasing concern for governments facing security threats in highly connected societies.
Get in Touch
We partner with governments, defence organizations, and mobile network operators to advance counter-drone capabilities within cellular networks. Our research focuses on detection, identification, and mitigation at scale.
Contact us for a briefing or to discuss collaboration.