# A Review of Counter-UAS Technologies for Cooperative Defensive Teams of Drones
## 4 Neutralization Systems
### Electronic Neutralizers
#### 4.1.3 Spoofing  
Spoofing consists of generating a plausible fake signal with enough strength to trick the malicious drone receiver into believing it is the legitimate signal. The signals under spoofingcan be related to some different applications or devices: remote control communications, payload data communications, GNSS, sensors. In order to perform spoofing, it is necessary to know the communication protocol stacks used (not only the physical layer) so that they can be reproduced. If the stacks are known it is possible to analyze them a priori, otherwise first it is necessary to determine them in some way. Therefore, spoofing is a complicated method and not always a successful one. In any case, at least in theory, by using spoofing techniques, it could be possible to take control of the malicious drone and make it move away from a protected area. Some examples are shown in [84; 85]. As mentioned above, a typical class of signals often involved in spoofing is represented by GNSS signals. In this specific case, it is possible to make the m-drone land, engage the autopilot, remain hovering or follow a desired path. Studies presenting methods for hijacking or disabling a drone using GNSS spoofing are reported in [86; 87; 88]. An interesting study is reported in [89], where the authors determined the necessary conditions for capturing a drone through GPS spoofing and examined a possible post-capture control system. Furthermore, two different strategies are depicted: overt spoofing and covert spoofing. In the first case, the spoofer (i.e., the spoofing-based neutralizer) does not hide its attempt to \"subjugate\" the target system and, therefore, does not align the forged signals with the legitimate ones. In particular, after a first phase in which it jams on the GPS receiver in order to force it to lose the lock and reacquire all the signals, it can take control, as long as the counterfeited signals have a power that satisfies two conditions: exceeding the receiver acquisition threshold and forcing the authentic GPS signals below the aforementioned threshold exploiting the receiver AGC (automatic gain controller) function. Experimental trials have shown that when the ratio between the counterfeit signal power (Pc) and the legitimate signal (Pl) is equal to 10 dB, the previous conditions are satisfied (as confirmed also in [90]). Instead, in the case of covert spoofing, the spoofer assumes that the GPS receiver and the navigation system are equipped with spoofing detection techniques, which must be evaded using appropriate counterfeit signals. Experimentally, it has been verified that if the spoofer can estimate the speed and position of the target drone with errors under certain thresholds (respectively below 10 m/s and 50 m), then it can reliably and covertly take control of the tracking loops of commercial receivers using small Pc over PI ratio (of the order of units of dB). Notice that covert spoofing can be generalized and applied to any type of communication, especially if it has been assumed that the malicious drone receiver is equipped with anti-spoofing technology. In these cases, the counterfeit signal should be correlated to the legitimate signal as much as possible and with a similar power level trend over time, so that it can be confused with the legitimate one. Rather than generating compatible counterfeit signals, GNNS spoofing can also be accomplished by meaconing ([10; 90]), a technique consisting in interception and retransmission (at higher power) of the original signal to the malicious drone's receiver. Whereas the GPS signal is encrypted, a technique similar to meaconing, called security code estimation and replay (SCER) ([10; 90]), can be used. It provides for the estimation of each symbol of the used coding by observing the signal received in the corresponding symbol period. The symbol estimation is continuously updated and is used simultaneously in the spoofing signal, trying to replicate the encoding as closely as possible.