## 2 Background and Related Work
### Security Vulnerabilities in Motor Control  
#### 2.2.1 Attack Taxonomy  
Based on a comprehensive threat analysis, we identify four primary attack categories targeting ESC communication, each exploiting different characteristics of the protocol and system vulnerabilities. Figure 3 presents our comprehensive taxonomy of ESC attack vectors, organized by attack mechanism and impact severity, which forms the foundation for SMART DShot's security requirements.  
Timing-based attacks exploit protocol timing tolerances to inject malicious commands while maintaining valid checksums, using sub-microsecond timing manipulation to cause frame misinterpretation without triggering conventional error detection. Signal integrity attacks manipulate electrical characteristics to induce specific bit error patterns that preserve the validity of CRCs, leveraging knowledge of the limitations of polynomial error detection. Firmware-level attacks compromise the ESC firmware to modify timing behavior, telemetry  
Figure 3: Comprehensive taxonomy of ESC attack vectors organized by attack mechanism and severity of impact.  
Figure 2: DShot frame structure and signal encoding showing 16-bit frame composition and binary encoding timing.  
reporting, or command interpretation, representing persistent threats undetectable by signal-level monitoring. Coordinated multi-channel attacks synchronize manipulation across multiple ESC channels to induce specific flight behaviors while avoiding detection by individual channel monitoring systems.  
The severity of these attack categories becomes evident when considering their sophisticated evasion techniques and potential consequences:  
Timing-based attacks represent the most insidious threat because they operate below the detection threshold of conventional CRC validation systems. These attacks can gradually destabilize flight dynamics while maintaining apparently valid checksums, making them virtually undetectable by static monitoring systems. The sophistication lies in their ability to exploit the precise timing tolerances of digital protocols while preserving frame validity.  
Signal integrity attacks exploit the fundamental limitations of polynomial error detection. By carefully crafting bit error patterns, attackers can inject malicious commands that preserve CRC validity, bypassing the primary defense mechanism of current ESC implementations. These attacks demonstrate deep understanding of error detection mathematics and protocol implementation details.  
Firmware-level attacks establish persistent control channels that survive system reboots and software updates. These attacks operate below the protocol monitoring level, making them undetectable by signal-level security measures. The persistence and stealth of firmware compromise represent an existential threat to system integrity.  
Coordinated multi-channel attacks synchronize manipulation across multiple ESC channels to induce specific flight behaviors while avoiding detection by individual channel monitoring systems. The system-wide coordination masks individual anomalies, making these attacks particularly dangerous as they can cause catastrophic failure while appearing as normal operation at the channel level.  
These sophisticated attack vectors highlight why traditional static defenses are inadequate and why adaptive ML-based protection is essential for modern UAV security.