Drone detection with RF: how software-defined radio systems identify and track UAVs

By Corvus Intelligence Engineering Team · About the team →

June 4, 2026 10 min read

Every drone that flies with active remote control is an RF emitter. The pilot's ground station transmits on 2.4 GHz or 5.8 GHz to command the drone; the drone replies with telemetry on the same or an adjacent channel; the FPV camera streams live video back to the pilot's goggles. These emissions cannot be eliminated without eliminating the ability to control the aircraft – which means that radio frequency detection is the primary and most reliable modality for counter-drone operations. Unlike radar, which requires a reflected signal from the physical airframe, RF detection picks up the drone's own transmissions. Unlike electro-optical cameras, RF detection works at night, in fog, and at ranges that exceed camera resolution. And unlike acoustic sensors, RF detection is not defeated by wind, distance, or low rotor noise.

For security teams protecting fixed installations, base commanders managing airspace, and C-UAS procurement officers evaluating detection systems, understanding how RF-based drone detection actually works – what it can and cannot detect, what determines range, how false positives are managed – is essential for making effective procurement decisions and deploying systems that genuinely protect the defended area.

Why every drone emits RF

The fundamental reason RF detection works is simple: a remotely piloted aircraft requires a control link. The operator must be able to send flight commands to the drone and receive position and status telemetry back. This bidirectional data link uses RF spectrum regardless of the frequency band chosen. Consumer drones – DJI Mavic, Air, Mini, and Phantom series – use DJI's OcuSync protocol variants (OcuSync 2, OcuSync 3, O3+) which operate on 2.4 GHz and 5.8 GHz simultaneously, switching between bands adaptively based on link quality. The ground station transmits at 100–200 mW, the drone replies with a lower-power uplink, and a continuous stream of telemetry (GPS position, battery voltage, altitude, gimbal state) flows between them at all times while the drone is airborne.

FPV racing and freestyle drones have a separate RF architecture. The control link uses a dedicated RC protocol – ExpressLRS (ELRS) on 2.4 GHz or 900 MHz, TBS Crossfire on 868/915 MHz, FrSky on 2.4 GHz – operating with frequency hopping spread spectrum (FHSS) to resist interference. The video downlink is a separate unidirectional transmission: analog video on 5.8 GHz (25 mW to 1 W), or increasingly digital video using DJI's O3 digital FPV system on 5.8 GHz. The result is a pair of simultaneous RF emissions that, together, form a characteristic FPV signature detectable even when neither transmission alone would be recognized in isolation.

Fixed-wing UAVs used in reconnaissance or logistics roles typically use longer-range control links: 900 MHz or 433 MHz RC systems for shorter ranges, and proprietary L-band or C-band satellite control links for BLOS (beyond line of sight) operations. Military UAS may use Link 16, MUOS, or classified waveforms, but even these are RF emitters detectable by a system monitoring the appropriate frequency range.

Key insight: RF detection does not require decrypting the drone's communications – it requires only detecting the signal's presence and matching its characteristics against a known signature library. An encrypted OcuSync 3 transmission is just as detectable as an unencrypted one; encryption hides the payload, not the signal.

The RF detection pipeline

A production RF drone detection system processes incoming spectrum data through a well-defined pipeline that transforms raw IQ samples into actionable alerts.

Wideband IQ capture. The SDR receiver digitizes the target frequency band – typically covering 400 MHz to 6 GHz in one or more receive channels – and streams IQ (in-phase/quadrature) samples to the processing host. At a 20 MHz sample rate per channel, this generates approximately 80 MB/s of IQ data that must be processed in real time. High-performance platforms such as the Ettus USRP X310 with dual UBX-160 daughterboards can capture 160 MHz of instantaneous bandwidth across two independent channels simultaneously, enabling parallel monitoring of the 2.4 GHz and 5.8 GHz bands without frequency switching.

Signal detection. The IQ stream is transformed into a time-frequency spectrogram using a sliding FFT. Signal presence is detected using a CFAR (Constant False Alarm Rate) algorithm that computes a dynamic noise floor estimate and flags energy exceedances above a configurable threshold multiplier. CFAR adapts to changing background RF environments – a spectrum with dozens of Wi-Fi networks will have a higher noise floor than a rural site, and CFAR adjusts the detection threshold accordingly to maintain a constant false alarm rate rather than a fixed power threshold.

Feature extraction and protocol identification. Each detected signal segment has features extracted: center frequency, instantaneous bandwidth, burst duration, inter-burst period, hopping pattern (if FHSS), modulation type estimated from cyclostationary analysis, and spectral shape. These features are compared against a library of drone RF signatures built from controlled testing of commercial and military UAV platforms. DJI OcuSync 2 has a distinctive 10 MHz wide OFDM channel with a specific subcarrier spacing; ExpressLRS has a characteristic FHSS hopping sequence timing; FPV analog video on 5.8 GHz has a recognizable spectral envelope. Pattern matching against this library produces a signal type classification with an associated confidence score.

Track association and alert generation. Individual signal detections are associated into drone tracks – linking the control uplink, telemetry downlink, and video downlink of the same drone into a single entity – using frequency, timing, and spatial correlation. A track must accumulate a configurable number of consistent detections within a time window before triggering an alert, suppressing transient false positives from brief interference events. The alert output includes signal type, drone category (consumer multi-rotor, FPV, fixed-wing), estimated bearing or position, detection confidence, and first-detected timestamp.

Drone RF signatures by category

Consumer multi-rotor (DJI, Autel). DJI products using OcuSync 3 operate simultaneously on 2.4 GHz and 5.8 GHz with 10 MHz channel bandwidth, OFDM modulation, and dynamic frequency selection based on channel quality. The characteristic bidirectional traffic pattern – short downlink telemetry bursts interleaved with longer uplink acknowledgements – is distinct from standard Wi-Fi traffic even at the same frequencies. Autel EVO series drones use a similar approach with minor protocol differences detectable in the hopping sequence and burst timing. Both vendors' products transmit a home-point beacon on initial takeoff that is particularly easy to detect.

FPV racing and freestyle drones. The combination of a FHSS RC control link (ExpressLRS, Crossfire, FrSky) and a 5.8 GHz video downlink creates a dual-emission signature. The video downlink is particularly strong – analog FPV transmitters at 200 mW to 1 W produce a signal detectable at several kilometers with a directional antenna. Digital FPV systems (DJI O3, HDZero, Walksnail) replace the analog video with OFDM digital streams that have distinct spectral footprints compared to their analog predecessors.

Fixed-wing and hybrid VTOL. Long-range fixed-wing drones used for reconnaissance or payload delivery typically use 900 MHz or 433 MHz control links for their extended range. These longer wavelengths propagate further and penetrate foliage better than 2.4 GHz, making them preferred for rural and forested operating environments. Detection requires monitoring the sub-GHz bands specifically; a system configured only for 2.4 GHz and 5.8 GHz would miss these platforms entirely.

Military and government UAS. Larger military UAVs – Group 3 and above – typically use encrypted, frequency-agile waveforms on L-band (1–2 GHz) or C-band (4–8 GHz) for their primary control links, with satellite links for BLOS operations. While the waveforms are encrypted and proprietary, the spectral occupancy, frequency range, and EIRP characteristics are detectable. Detection of military UAS is primarily of interest to peer-state adversaries; most C-UAS deployments are focused on Group 1 and Group 2 threats (commercial and modified commercial drones).

Key insight: A drone detection system is only as good as its signature library. A system trained on DJI Mavic 3 will not automatically detect a new DJI model released after its library was last updated. Operational C-UAS programs require active signature library maintenance as new drone models enter the threat environment.

SDR hardware options for drone detection

The choice of SDR front-end hardware significantly affects detection performance, and the options span a wide range of cost, capability, and form factor.

RTL-SDR (RTL2832U-based dongles). The RTL-SDR, originally a DVB-T television tuner, covers approximately 24 MHz to 1766 MHz with up to 2.4 MHz usable instantaneous bandwidth. At a price of $25–$35, it is the entry-level platform for SDR experimentation and drone detection proof-of-concept work. Its limitations – narrow instantaneous bandwidth, poor dynamic range, limited frequency coverage – make it unsuitable for production deployment, but it is a useful tool for single-band monitoring experiments and student training. Monitoring only 433 MHz or 868 MHz RC links is feasible with an RTL-SDR; monitoring the 2.4 GHz or 5.8 GHz bands requires a hardware upgrade.

HackRF One. The HackRF covers 1 MHz to 6 GHz with 20 MHz instantaneous bandwidth and USB 2.0 connectivity. At approximately $300–$400, it covers all major drone frequency bands and is usable for development and low-duty-cycle monitoring. Its half-duplex architecture (cannot transmit and receive simultaneously) and relatively high phase noise limit production applicability, but it is widely supported by GNU Radio and serves as an excellent development and testing platform.

Ettus USRP B205mini / B210. The USRP B210 covers 70 MHz to 6 GHz with 56 MHz instantaneous bandwidth, two independent receive channels, and full-duplex operation via USB 3.0. At approximately $1,100–$1,800, it is the standard research-grade platform for serious drone detection development work. The B210 can simultaneously cover 2.4 GHz and a portion of 5.8 GHz with some compromises, or cover a single band with 56 MHz of clean instantaneous bandwidth – enough to capture a complete DJI OcuSync 3 spectrum segment.

Ettus USRP X310 / X410. The USRP X310 with dual UBX-160 daughterboards covers 10 MHz to 6 GHz with 160 MHz instantaneous bandwidth across two independent channels, connected via 10 GbE. The X410 extends this to 400 MHz per channel with the QSFP+ interface. These platforms support true simultaneous monitoring of multiple bands and are suitable for production C-UAS deployments where performance is prioritized over cost. Integration with Corvus.Sense for automated RF signal classification leverages the high-bandwidth IQ capture these platforms provide.

Custom and ODM RF front-ends. Commercial C-UAS systems – DroneSentry, DroneTracker, D-Fend Solutions EnforceAir – typically use custom RF front-ends designed specifically for the 400 MHz to 6 GHz drone detection range, with proprietary FPGA-based real-time signal processing that avoids the host CPU bottleneck of PC-connected SDRs. These purpose-built systems offer superior reliability and form factor for fixed-site deployments but come at substantially higher cost than open SDR platforms.

Detection range and environmental factors

RF detection range is not a single number – it is a function of antenna gain, receiver noise figure, drone transmit power, propagation environment, and competing RF background. In free-space conditions with an omnidirectional antenna and a sensitive receiver (noise figure below 6 dB), a commercial drone's 100 mW 2.4 GHz control link is detectable at 2–4 km. The same drone's 5.8 GHz video downlink, at 200 mW, is detectable at similar range. With a 12 dBi directional antenna, these ranges extend to 5–10 km – sufficient for perimeter protection of military installations or critical infrastructure.

Urban environments degrade these figures significantly. Buildings cause multipath reflections that create constructive and destructive interference patterns, so effective range in dense urban areas may be 200–800 m. High RF background from thousands of concurrent Wi-Fi networks raises the noise floor and forces CFAR thresholds higher, reducing sensitivity to weak signals. Rain and fog have minimal impact at 2.4 GHz and 5.8 GHz (attenuation is below 0.1 dB/km at these frequencies for typical rainfall rates), unlike the severe impact they have on millimeter-wave radar and EO/IR sensors.

The most significant environmental challenge is not propagation loss but RF congestion. Urban 2.4 GHz spectrum is saturated with Wi-Fi (802.11b/g/n), Bluetooth, ZigBee, and microwave oven interference. A drone detection system must reliably distinguish DJI OcuSync signals from hundreds of concurrent 802.11n transmissions in the same band – a classification problem that requires a well-trained ML classifier, not a simple energy threshold. This is where machine learning-based signal classification provides the most significant performance improvement over rule-based approaches.

Key insight: RF detection range is maximized by antenna height and gain, not by SDR receiver sensitivity alone. A high-gain antenna elevated 20 m above ground level typically doubles effective detection range compared to the same receiver with a ground-level omnidirectional antenna, because it eliminates near-ground multipath and extends line-of-sight to the horizon.

Multi-sensor fusion with radar and EO/IR

RF detection provides the earliest warning of drone presence but has limitations that complementary sensors address. RF detection loses track of a drone that switches to autonomous GPS waypoint navigation with the control link disabled – the drone is still flying but no longer transmitting RC control link signals. Radar provides continuous tracking of the physical airframe regardless of RF emission status. EO/IR cameras provide visual confirmation and, with sufficient resolution, can identify the drone type and potentially the operator's ground position.

In a fused C-UAS system, the three sensor modalities work together: RF detection provides the first alert and an estimated bearing; the radar cues to that bearing and acquires a precise 3D track; the PTZ camera slews to the radar-reported position and provides visual confirmation. Track association logic in the fusion engine links the RF detection, radar return, and camera track into a single UAV entity with a combined confidence score. When the combined confidence exceeds the alert threshold, the operator receives a single unified alert rather than three separate sensor notifications to correlate manually.

The value of fusion extends to false positive management. An energy burst that triggers the RF detector but produces no radar return and is not visible in the camera is almost certainly a false positive from a ground-based 2.4 GHz emitter. Requiring at least two sensor confirmations for a high-confidence alert substantially reduces operator alert fatigue without significantly increasing the time to confirm a genuine threat. For spectrum monitoring of unauthorized emitters in general, this fusion principle extends to any scenario where multiple sensing modalities are available.

Alert thresholds and false positive management

The operational effectiveness of a drone detection system is as much a function of false positive rate as it is of detection probability. A system that generates dozens of false alarms per day trains security personnel to ignore alerts – defeating the purpose of the system. Effective alert threshold management requires understanding the specific RF environment of each deployment site and tuning the classifier and track confirmation parameters accordingly.

The standard approach is to deploy the sensor in monitor-only mode for 48–72 hours before activating alerting, during which the system builds a baseline model of the local RF environment. Known emitters – fixed Wi-Fi access points, licensed microwave links, Bluetooth devices with predictable patterns – are added to a whitelist that suppresses detections at their specific frequencies and locations. After baselining, alert thresholds are set conservatively and adjusted downward over the first week of operation as the false positive rate is measured and refined.

Long-term false positive management requires ongoing classifier updates as new drone models appear in the threat environment. A DJI Avata 2 released after the classifier was last trained will not be recognized by its specific protocol signature – it may still be detected as an unknown 5.8 GHz emitter, but the classification confidence will be low. Maintaining a current signature library, similar to maintaining antivirus signatures, is an operational requirement rather than a one-time setup task.

Corvus.Sense for RF signal classification

Corvus Intelligence's Corvus.Sense platform provides automated RF signal classification capabilities applicable to counter-UAS operations. The platform ingests IQ data streams from wideband SDR receivers and applies trained signal classification models to identify drone control links, video downlinks, and telemetry channels across the 400 MHz to 6 GHz range. Classification outputs include signal type, confidence score, and protocol family, enabling downstream alerting and track management systems to operate on structured detection events rather than raw spectrum data.

For organizations building or deploying C-UAS detection infrastructure, Corvus.Sense provides the signal intelligence layer – the component that transforms raw RF into actionable drone classifications – while integrating with existing radar, camera, and command-and-control systems via standard data interfaces. The platform supports both fixed-site deployments with wideband multi-channel SDR front-ends and portable configurations with single-channel SDRs for mobile or rapid-deployment scenarios. For a broader view of how RF classification fits into overall SIGINT system architecture, see our discussion of SIGINT platform architecture design.

Protect Your Airspace

We build RF signal classification and counter-UAS detection software — from wideband IQ ingestion and drone signature libraries to multi-sensor fusion and alert management. Let's discuss your C-UAS requirements.

Corvus.Sense → Book a Briefing

This analysis was prepared by Corvus Intelligence engineers who build mission-critical software for defense and government organizations. Learn about our team →

Frequently Asked Questions

What detection range can RF-based drone detection systems achieve?

Detection range depends heavily on antenna gain, receiver sensitivity, drone transmit power, and the environment. In open terrain, a high-gain directional antenna with a sensitive SDR receiver can detect commercial drone control links (2.4 GHz, 20–100 mW) at ranges of 1–5 km. FPV video downlinks operating at higher power (up to 1 W at 5.8 GHz) can be detected at similar or slightly greater ranges. Urban environments with multipath and competing RF sources reduce effective range to 200–500 m. Military-grade systems with large aperture antennas and STAP processing extend detection ranges significantly beyond these figures.

Can encrypted drones still be detected by RF methods?

Yes. Encryption protects the content of the control link but does not hide the RF signal itself. An RF detection system does not need to decrypt the payload to detect the drone — it detects the signal's presence, frequency, modulation type, burst timing, and frequency-hopping pattern. DJI OcuSync 3 and similar encrypted protocols are still detectable as RF emitters, and their characteristic hopping sequences and burst patterns serve as fingerprints for identification. The limitation is protocol attribution: an encrypted signal can be detected and localized but not always definitively identified to a specific operator without additional intelligence.

How does an RF detection system distinguish drones from other RF sources?

Modern RF drone detection relies on a library of known drone RF signatures — frequency ranges, modulation types, burst structures, hopping patterns, and timing characteristics — built from controlled laboratory testing of commercial drones. When a detected signal matches a signature profile with sufficient confidence, the system classifies it as a drone signal. Consumer Wi-Fi devices operating at 2.4 GHz and 5.8 GHz are the most common false-positive source; they are distinguished by their OFDM symbol structure (802.11 vs. proprietary drone protocols), burst timing, and absence of telemetry data structures. Machine learning classifiers trained on large IQ recording datasets substantially reduce false positives compared to rule-based systems.

What SDR hardware is used in professional drone detection systems?

Professional counter-UAS RF sensors typically use wideband SDR front-ends covering 400 MHz to 6 GHz continuously, allowing simultaneous monitoring of all major drone frequency bands. Ettus USRP X-series and N-series platforms are common in research and integration projects due to their high instantaneous bandwidth (up to 400 MHz per channel) and strong software ecosystem. Deployable systems often use custom or ODM RF front-ends integrated with FPGA-based signal processing for real-time detection without cloud dependencies. RTL-SDR dongles are adequate for single-band monitoring in training and proof-of-concept work but lack the bandwidth and dynamic range for production deployment.

How does RF drone detection integrate with radar and electro-optical sensors?

RF detection, radar, and EO/IR sensors provide complementary information that is fused in a common operating picture. RF detection is the most reliable first-alert modality — it detects the control link before the drone is close enough for radar or camera confirmation. Radar provides precise 3D position and track continuity even when the drone is RF-silent (autonomous flight mode). EO/IR cameras provide visual confirmation and operator identification. In a fused system, an RF alert cues the radar to a search volume and the PTZ camera to slew to a bearing, reducing camera scan time and radar processing load. Track association logic merges detections from all sensors into a single UAV track with a confidence score.