# Towards the Detection of GPS Spoofing Attacks against Drones by Analyzing Camera's Video Stream
## 3 Proposed Method  
In this section, we describe the proposed method for the detection of GPS spoofing attacks on drones. Our method relies on data obtained from two sources: a drone's video stream and GPS measurements. It is based on the assumption that unlike GPS signals, the drone's video stream cannot be spoofed. To detect GPS spoofing attacks, our method correlates a drone's movement, calculated from the GPS signals, with the real-time video stream frames. Based on this correlation and a predefined correlation threshold, our method determines whether a GPS spoofing attack has occurred. The correlation between frames is based on brute-force matcher (BFMatcher, which is used to match the features of the first frame with another frame) [22], with the speeded-up robust features (SURF) [23] feature detector. The algorithm receives two frames and calculates their correlation. The output ranges from 0 to 100, with 100 assigned when the same frames are being compared and zero assigned when completely different frames are compared. The correlation decreases as the similarity between the images decreases. There are several other methods that can be used to calculate the correlation; for example, the authors of [24] compared the use of SURF, scale-invariant feature transform (SIFT), binary robust invariant scalable keypoints (BRISK), and oriented FAST and rotated BRIEF (ORB), and found that SURF was the fastest algorithm and provided good results. For this reason we choose to use BFMatcher with SURF in all of our experiments. The difference in the correlation between the first frame (\(frame_{i}\)) and the next n consecutive frames (\(frame_{i+1}\),..., \(frame_{i+n}\)) is continuously calculated. Based on the GPS measurements and the similarity correlation between the frames, a model, which is used to verify the location for the next q consecutive frames (\(frame_{i+n+1}\),..., \(frame_{i+n+q}\)), is created. For each of the next q consecutive frames (\(frame_{i+n+1}\),..., \(frame_{i+n+q}\)), the distance is predicted based on the frame's similarity correlation with the first frame. If the error, meaning the difference between the actual distance and the distance predicted by the model, is beyond a threshold, the model issues an alert that the GPS measurements do not correlate with the video stream (i.e., a GPS spoofing attack has taken place). In each flight, our method is applied for a specified period of time (from \(frame_{i}\) to \(frame_{i+n+q}\)). The similarity correlation between consecutive frames decreases as a function of the distance, so eventually there will be no correlation between the first and last frames, and a new model will be generated. Our method includes the following steps:  
1. After the drone takes off, frames along with their specific GPS locations are collected. For each second of flight, one frame and its GPS location are saved. Thus, after \(n\) seconds, we will have \(n\) frames (\(frame_{i}\) = the first frame in the time window, and \(frame_{i+n}\) = the \(n\)th frame in the time window);
2. The similarity correlation between \(frame_{i}\) and all other \(i+n\) frames is calculated. At the same time, the distance (based on the GPS measurements) between the location of \(frame_{i}\) and the location of all other \(i+n\) frames is calculated. This information is used to generate a graph presenting the correlation vs. distance (an example of such a graph is presented in Figure 1). This graph allows us to model the change in frame correlation against the GPS distance, which provides a suitable function for the prediction of the next point (\(f(correlation)=distance\)) on the graph;
3. The next \(frame_{i+n+1}\) and its GPS location are obtained, and the correlation between \(frame_{i}\) and \(frame_{i+n+1}\) (\(correlation\_i+n+1\)) and the distance between the GPS locations are calculated. Then, the model can predict \(predict\_distance\) from function \(f(correlation\_i+n+1)=predict\_distance\). We then have the actual and predicted distance between \(frame_{i}\) and \(frame_{i+n+1}\);
4.