# A Review of Counter-UAS Technologies for Cooperative Defensive Teams of Drones
## 4 Neutralization Systems
### Electronic Neutralizers
#### 4.1.4 Neutralizers Exploiting Protocol-Based Attacks and Replay Attacks  
Some cyber-attacks try to exploit the vulnerabilities present in the protocols used in communication networks to perpetrate malicious actions. These attacks include denial-of-service (DoS) attacks, which consist in disabling a machine (or network), making it inaccessible to intended users. Wi-Fi de-authentication, which consists of disconnecting a user from the relative access point (WAP), and flooding, which consists of sending a large amount of traffic to the target in order to make it unable to process legitimate messages, belong to the above family. These attacks can also be aimed at drones. For example, as documented in [91], some commercial drones based on Wi-Fi communications that do not require authentication for network access have proved to be vulnerable to de-authentication and flooding towards the drone network interface controller (NIC). In particular, with de-authentication, it was possible to disconnect the commercial drone from its remote pilot in order to activate a security procedure and take advantage of the disconnection window to take control of it. Another cyber-attack used to disconnect a commercial drone from its controller is the address resolution protocol (ARP) cache poisoning attack, as shown in [94]. Many of these attacks can be prevented using a network access with authentication, but the basic idea can be used to implement a neutralizer to exploit this kind of attack. In other words, as in the spoofing case, it is possible analyze the protocols used by drones to determine some weaknesses, at one or more layers of the communication stack, to be used to carry out neutralization operations. It follows that this kind of neutralizer can be applicable and effective for commercial drones whose protocols are known. They are definitively not a robust solution if the above exploited weaknesses can be patched up by the users, however they could be applicable as a first neutralization technique for commercial drones used improperly but without illegal purpose.  
Other techniques useful to implement as neutralizers are replay attacks. According to the classification reported in [91], they can be included within the family of protocol-based attacks. They are based on the interception of a data transmission and its subsequent retransmission with a certain delay and can be used to hijack and disorient a drone. Examples are reported in [95; 96]. In the first case, a drone used by the police was hijacked by exploiting a replay of the control commands sent to the drone by the ground control station using the XBee 868 LP protocol. In the second case, it was possible to hijack amateur drones using the MAVLink protocol with replay attack. Therefore, even these kinds of attacks can be taken in account, but because they are very simple, eventual countermeasures adopted by the malicious drone(s) should be considered. For instance, the study reported in [97] showed a detection mechanism applicable to replay attacks based on the authentication of the pilot who controls the drone manually. The mechanism uses a classifier capable of recognizing the pilot's distinctive control style by exploiting data from on-board motion sensors.