As unmanned aerial vehicles (UAVs) become increasingly prevalent, ensuring their communications security is crucial. This paper introduces a novel mutual authentication and key agreement scheme combining physical unclonable function (PUF) and machine learning (ML) to address the vulnerability of PUF modeling attacks and improve UAV communication security. We define a novel security model that allows for real-time generation of challenge-response pairs (CRPs) without storing predefined data, thereby mitigating the risk of key exposure and reducing susceptibility to modeling attacks. The proposed scheme integrates PUF in UAVs and ML models in ground stations (GS) to predict PUF responses, enabling secure mutual authentication without complex calculations and pre-stored data. Formal verification through the AVISPA tool confirms our scheme’s resilience against a range of network attacks. Comparative analysis shows that our method not only strengthens the security but also reduces the communication and computational overhead, making it ideal for dynamic environments.