Pylon
<3

Pylon

Inspiration

The economics of drone defense are backwards. A normal counter-drone setup is a big radar or RF sensor wired back to a control room, it costs millions of dollars, and it sits in exactly one spot. The drones it's supposed to stop cost a couple hundred bucks and show up in swarms. The attacker wins on cost every time. They also win on resilience, because if you jam that one sensor, take it out, or just fly around it, the whole system goes dark. A centralized detector is a single point of failure by design.

We wanted to flip both halves of that at once.

First, cost. A detection node should cost about what one attacking drone costs, so you can blanket an area instead of guarding a single point. Second, resilience. There should be no central server, no master node, nothing an adversary can knock out that takes the network down with it.

The rest of what we built (the open-world anomaly detection, the operator dashboard) sits on top of that foundation. It's not the point. The foundation is the point.

What it does

Pylon is a decentralized RF drone-detection mesh built out of cheap, off-the-shelf SDRs. Every node is a complete detector on its own. There's no central brain to lose. A couple of things follow from that:

It's cheap per node. A node runs on a ~$30 RTL-SDR, or a couple hundred dollars for a wider-band ADALM-Pluto. That's the same ballpark as the drones you're watching for, so you scale coverage by adding nodes, not by buying one giant sensor.

It has no single point of failure. Nodes find each other by gossip. A new node joins through one peer it already knows about, periodic HELLOs spread the full peer list in about two seconds, and detections get broadcast peer-to-peer. No multicast, no central infrastructure. Kill any node and the mesh reroutes and keeps watching.

On top of that base we built two things that raise what the network can actually catch.

Open-world anomaly detection. A signature library (think Dedrone or DroneShield) only catches drones it already has in its catalog. Show it novel hardware and it returns NO_MATCH and lets the thing walk right through. Pylon takes a different approach: each node learns its own ambient RF for about 30 seconds (a Welch PSD per ~10 ms window, which gives a per-bin baseline) and then flags anything that doesn't fit.

$$ z_{\max} \;=\; \max_{b}\frac{P_b - \mu_b}{\sigma_b} \;\ge\; \tau $$

Here $ \mu_b $ and $ \sigma_b $ are the per-bin mean and standard deviation learned during the ambient window. The model (an IsolationForest) only ever trains on ambient, so when you show it a novel emitter it's never seen, a tuned signature-library baseline misses every time and Pylon misses zero:

Class                              Library miss    Pylon miss
known: wifi / bt / lora / elrs       0 – 15%          0%
novel (held-out)                       100%           0%

The Lattice operator dashboard. A Next.js + Mapbox + deck.gl 3D command view. You drop a relay ring over real terrain, place nodes and FOBs, launch AIR / WATER / GROUND hostile swarms, and watch the mesh heal around destroyed nodes while interceptors chase threats down.

One honesty note: the 100% / 0% figure is on synthetic IQ (3200 windows per class), run through the exact same code path that loads real captures.

How we built it

The mesh is the foundation, so we'll start there. It's pure UDP, bootstrap through a known peer, gossip-based discovery. No multicast, no central server. We brought it up across a few laptops on the venue Wi-Fi with two shell scripts, and every detection a node makes fans out to its peers.

The detector node is Python, NumPy and SciPy for the Welch PSD and scikit-learn for the model. There's a single capture seam that abstracts the radio, so two commodity SDR backends sit behind the same pipeline: an RTL-SDR (NESDR) for the 315/433 MHz key-fob demo, and an ADALM-Pluto over libiio/USB to reach the busy 2.4 GHz WiFi/BT band. Each node exposes GET :5001/status over HTTP and emits detection events over UDP.

The pitch metric is a standalone experiment. A NearestNeighbors template matcher stands in for a real signature library (anything below threshold becomes NO_MATCH, which means no detection), the IsolationForest is the anomaly side, and one script regenerates the miss-rate chart.

The dashboard is a Next.js 14 app-router build with deck.gl 9 layers (Scatterplot, Arc, Icon, Path, Trips, Line) and a zustand store driven by a requestAnimationFrame phase loop.

Challenges we ran into

Decentralization on a hostile network was the first wall we hit. The conference Wi-Fi blocked broadcast and multicast, so the obvious "announce yourself to the subnet" trick was dead on arrival. That turned out to be a good thing. We rebuilt discovery as bootstrap-through-a-known-peer gossip, which means the mesh has no master and doesn't depend on any network feature an adversary's environment might not give us either.

Keeping the node cheap and capable at the same time was the second. The whole thesis falls apart if a node needs expensive hardware, so the pipeline had to run on a $30 RTL-SDR. Getting it to also reach 2.4 GHz with a Pluto over libiio/USB took real fighting to pull clean IQ out of.

Catching the unseen with zero labels was the third. We never train on the thing we're trying to catch, so tuning the threshold meant suppressing false positives on a noisy ambient baseline without a single example of the actual target to lean on.

And then there was the clock. Everything in the repo was written inside the hackathon window, from hand-out to the Sunday 11 AM deadline.

Accomplishments that we're proud of

A detection network with no single point of failure: gossip-discovered, no central server, no multicast, and it self-heals when a node dies.

Cost symmetry with the threat: a working detector that runs on a ~$30 commodity radio, so the defender scales coverage the same cheap way the attacker scales the swarm.

A live-RF prototype, not just a sim. Real SDR hardware picking up a real 433 MHz key fob on press.

The open-world layer turning a 100% library miss into a 0% miss on a held-out novel emitter, as a bonus on top of all that.

35 unit tests plus a hardware smoke test, written under hackathon time pressure.

What we learned

Counter-UAS is an economics and resilience problem before it's a sensing problem. If your defense is expensive and centralized, you've already lost on cost and on robustness before detection accuracy even enters the conversation.

You can build genuinely decentralized peer discovery on a network that gives you nothing, no broadcast and no multicast, as long as you lean on gossip instead of the network doing the work for you.

And once detection is the second priority instead of the first, open-world anomaly methods are the obvious fit, because they generalize to threats nobody has cataloged yet.

What's next for Pylon

Scale the mesh and then exploit it. With a lot of cheap nodes already sharing detections, the natural next capability is direction-finding and triangulation across nodes, which turns "something is out there" into "it's right here." That's only possible because the system is decentralized in the first place.

Close the loop end to end by bridging the nodes' UDP detection stream into the dashboard's existing WebSocketRFSource, so the operator view runs on live mesh data instead of a sim.