# Jamming and Spoofing Techniques for Drone Neutralization: An Experimental Study
## 3 System Design and Methodology
### GNSS BPSK Jamming  
The spectrum of the transmitted signal for the BPSK jamming implementation is shown in Figure 8.  
The measured output power is \(-5.6\) dBm. To calculate the total EIRP, the amplifier gain (30 dB) and the antenna gain (12 dBi) were considered, resulting in a final EIRP of approximately 36.4 dBm. Table 2 presents jamming effectiveness results, where the distance (D) is the separation between the jammer and the UAV. Figure 8: GNSS BPSK Jamming signal spectrum. The frequency on the X-axis ranges from approximately 1.5714 GHz to 1.5795 GHz. The BPSK modulation is slightly more efficient than barrage jamming for GNSS, particularly over longer distances and with lower power. This efficiency stems from several factors:  
* Power Density: BPSK signals concentrate energy within a narrow frequency band, matching the frequency used by GNSS systems. Higher power density improves jamming effectiveness, especially over distance. * Modulation Similarity: BPSK modulation closely resembles GNSS signal characteristics, complicating the receiver's ability to differentiate between real and jamming signals, as it relies on correlation techniques to detect modulation patterns and achieve significant processing gain. All spoofing implementations were tested using an Android device as the receiver for spoofed GNSS signals. We successfully simulated a spoofing attack by programming the SDR to transmit false geospatial data. The Android device, using the GPS Test app [39], confirmed the effectiveness of spoofing by displaying incorrect coordinates. * **Static Spoofing to a Random Position** This method involved spoofing to a random location, specifically Tokyo, Japan, to mislead the operator without impacting the drone's behavior. * **Static Spoofing to a No-Fly Zone (NFZ)** The previous approach was extended by selecting a location in a designated no-fly zone--Francisco Sa Carneiro Airport in Porto, Portugal. This significantly affected DJI drones, which activated protective measures, including on-screen warnings and a countdown to automatic landing (Figure 9). \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Drone/Distance (D)** & **80 m** & **100 m** & **120 m** & **130 m** & **140 m** \\ \hline DJI Mini 3 & ✓ & ✓ & ✓ & ✓ & ✗ \\ DJI Mini 3 Pro & ✓ & ✓ & ✓ & ✓ & ✗ \\ Autel Evo Nano+ & ✓ & ✓ & ✓ & ✓ & ✗ \\ Husban Zino Mini Pro & ✓ & ✓ & ✓ & ✓ & ✓ \\ ZLL SG 108 & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Effectiveness of BPSK jamming at varying distances. (✗) shows ineffective jamming; (✗) indicates successful jamming. Figure 9: Spoofing into a No-Fly Zone (controller display). * **Dynamic Spoofing with Altitude Variation** To enhance deception, a CSV file with 3000 points was created, each defined by latitude, longitude, and height. This dynamic spoofing confused the drone and increased collision risks, with varying responses across drone models. DJI drones remained stable, while others, like the ZLL SG 108 and Autel Evo Nano+, exhibited erratic behaviors. * **Dynamic Spoofing to an NFZ with Altitude Set to Zero*
* In this method, a constant altitude of zero was maintained to trick the drone into misinterpreting its position. This tactic resulted in premature landing attempts and increased the risk of collision. The jamming of legitimate GNSS signals, followed by the transmission of spoofed signals, proved particularly effective against DJI drones. The responses to dynamic spoofing varied significantly among different drone models:
* **DJI Mini 3 and Mini 3 Pro**: Both drones exhibited stable behavior while hovering but displayed great instability in motion, losing control and veering off course. They initiated a countdown for automatic landing upon being spoofed into a No-Fly Zone (NFZ). * **Autel Evo Nano+**: This drone showed total instability, losing its way and climbing uncontrollably before landing erratically. It triggered an automatic landing response.