Detect, track and interdict cellular-connected drones — including those using the mobile network for BVLOS control — from a single signalling integration, without field-deployed sensors.
The Cellular Drone Detector turns LTE S1AP and 5G NGAP control-plane signalling into nationwide detection, continuous tracking, operator correlation and, where legally authorised, network-based interdiction.
Cellular-connected drones leave distinctive signatures in the control-plane signalling of public mobile networks. Because those networks are engineered for ground users, airborne devices are observable without inspecting communications content.
Cellular control is what makes BVLOS practical: the pilot can operate from anywhere with a network connection. The detector is not limited to those command links. It is there to detect, track and, where authorised, interdict the wider cellular-connected space — any drone that attaches to a public mobile network, whether for control, telemetry, video or a mix of the three.
The minimum input is S1AP and/or NGAP signalling from a mobile network. For full national detect–track–interdict coverage, and for correlation with a cellular-connected operator of the drone, signalling feeds should be available from all mobile networks in the country. A drone and its operator are often on different networks; a drone may also use several networks itself so that it can stay connected as it travels. Where available, other signalling streams and user-plane streams can be incorporated to raise detection confidence, enable enhanced interdiction and improve platform performance.
A single-network deployment still detects and tracks devices attached to that network. It cannot see a drone or operator that never attaches there, it loses the track if the aircraft reattaches to another operator, and it cannot complete multi-network correlation.
The Cellular Drone Detector is for any organisation with lawful access to the required signalling — S1AP on LTE, NGAP on 5G, or both. That can be the mobile network operator itself. It can also be another lawfully authorised organisation — for example a law-enforcement, defence or intelligence service — that has obtained signalling feeds from one or more mobile network operators.
Cellular control is what makes BVLOS practical, and that is why these aircraft now appear in attempted attacks, in state conflict and in organised crime. The detector addresses the wider cellular-connected space — not only drones whose command link rides the mobile network.
The attempted attack at Leipzig/Halle Airport in August 2026 is a public example. An explosives-carrying drone reached a civilian airfield. Reporting on the recovered airframe described SIM cards and cellular antennas, consistent with control over the public mobile network rather than a conventional radio link — traffic that a frequency scanner cannot tell apart from an ordinary handset.
In the war in Ukraine, both sides use cellular-connected drones. Mobile network links carry command, telemetry and video beyond visual line of sight, including where conventional radio is jammed or out of range.
Illicit prison drops are also rising, and an increasing share of those flights are cellular-connected. Cellular control lets the pilot fly BVLOS and stand off from the prison wall, which local RF detectors and perimeter sensors are poorly placed to stop.
Connect a live or replay feed from at least one public mobile network. LTE S1AP, 5G NGAP, or both, is sufficient to begin on that operator’s footprint.
Cell locations, topology and configuration turn protocol events into geography, neighbour relationships and plausible movement.
Rules, path analysis and machine-learning models combine radio, mobility and temporal evidence into a graded confidence — not a binary drone verdict.
Follow the device across the networks it uses, reconstruct history, associate a cellular-connected operator where feeds allow, and apply authorised interdiction options.
Minimum requirement: S1AP and/or NGAP signalling from a mobile network.
Those feeds may be held by the mobile network operator, or provided by the operator to a lawfully authorised organisation such as a law-enforcement, defence or intelligence service.
Recommended: signalling feeds from all mobile networks in the country.
Optional: other signalling streams and user-plane streams, where available, to raise detection confidence, enable enhanced interdiction and improve platform performance.
A drone and its controller are often on different networks, and a drone may itself use several networks to stay connected as it travels. Full detect–track–interdict coverage and operator correlation need every MNO connected.
4G LTE (S1AP), 5G NSA (S1AP) and 5G SA (NGAP) are all supported. Cell and site reference data provide geographic context.
The same signalling record supports several operational modes. Organisations typically start with real-time detection on one network and add tracking, retrospective analysis and multi-network correlation as feeds and authority allow. Where available, other signalling streams and user-plane streams can also be incorporated to raise detection confidence, enable enhanced interdiction and improve platform performance.
Available options include:
Cellular-connected drones choose whichever network gives them a usable session, and may use several networks to stay connected with the operator as they move across a country.
The person flying the aircraft often uses a different operator, SIM or device.
A detector connected to one MNO sees only that MNO.
Connecting all mobile networks in a country is the recommended architecture for a national layer.
It is also the condition under which a track can be held when the aircraft changes network, and under which drone-to-operator correlation becomes routinely possible.
Where legal authority exists, measures are subscriber-specific and identity-bound. They are not RF jamming and they do not deny spectrum to other users. Options include:
APIs and feeds deliver detections into OSS, SIEM, C4I and SAPIENT so results arrive in the systems operators already use.
A typical deployment includes:
Deployed with Melrose Networks engineering support into the operator or government environment you specify.
Documentation is included with the software.
Commercial services include:
The detector sees drones that attach to public mobile networks — whether the session is used for control, telemetry, video or a combination of the three. Platforms that communicate only via direct radio, dedicated spectrum or satellite produce no corresponding public-network signalling.
Outputs are graded confidence, not a classification. They should not be treated as confirmation of a specific activity or device type without corroboration.
Interdiction requires clear legal authority, operator cooperation and oversight. Detection and tracking can operate with less authority than interdiction.
The product is supplied to organisations that have lawful access to the required signalling. Melrose Networks does not provide access to mobile network feeds.
For a primer on detecting and tracking cellular-connected drones from mobile network signalling, see UAV Detection and Tracking using Mobile Network Signalling.
Read the signalling primerClosed-door technical briefings are available to mobile network operators and to lawfully authorised organisations — including law-enforcement, defence and intelligence services — that have obtained S1AP or NGAP signalling from one or more operators. A commissioned 90-day technical evaluation can be run against your own S1AP or NGAP — scoped and charged.
Interdiction options are offered only to qualified government, defence and authorised operator programmes.
To request a briefing, a commissioned evaluation, or a conversation about national deployment, email contact@melrosenetworks.com.
Supports LTE EPC (S1AP)
Supports 5G NSA networks achored on LTE EPC (S1AP)
Supports the latest 5G Standalone networks (NGAP)
Request information.
Global 24x7.
