## 2 Overview of Cyber Threats in EM
### Sensing Technologies
#### 2.2.1 Satellite-Based Sensing  
Polar-orbiting satellites provide good spatial resolution, but can update information on the same point only every few days because they fly in a low orbit. Geostationary satellites can provide updates every few minutes, but have lower spatial resolution as they fly at a much higher altitude. In EM, polar-orbiting satellites are used for operational planning and geostationary ones for the tracking of environmental changes and detection of impending natural disasters [15]. A satellite can host up to 5000 transponders for communication, each with the potential for permitting a cyber attack. Most satellites are custom built, which means that a cyber attack can only exploit a single system or very few systems. [PERSON] _et al_. have argued that opportunities for covert activity and hijacking increases as more countries begin operating satellites, because vulnerabilities can be introduced through software updates and the onboard computer can be reconfigured [54].  
The use of SDR in EM (Section 2.1.3) has provided potential attackers more options for compromising satellite communications and reducing the usability of GPS systems [27]. As EM systems make extensive use of GPS for geolocation, they are particularly vulnerable to spoofing attacks, where illegitimate signals deceive GPS receivers about their geographical coordinates. GPS spoofing can be more dangerous than jamming because the receiver remains unaware of the attack while false data are delivered to EM information management systems (Section 2.3) that depend heavily on GPS to coordinate operation planning and execution [51]. [PERSON] _et al_. have provided an analysis of GPSspoofing attacks with regard to their precision requirements [50] and [PERSON] _et al_. have presented a portable GPS civilian spoofer in [94]. The latter have argued that it is less straightforward to defeat most user-equipment-based spoofing countermeasures if they use cryptographic authentication.  
Unlike jamming, which can be quickly noticed by the victim, GPS spoofing is not easy to detect. [PERSON] _et al_. have observed that GPS spoofing systems tend to use signals of much greater strength than legitimate GPS signals [52]. Thus, monitoring the signal strength should provide an indication of whether they are legitimate or spoofed. Signal quality monitoring techniques can effectively detect the spoofing correlation peak that is approaching the authentic signal, but are not applicable where spoofing does not affect the shape of the correlation peak, when spoofed and authentic signals are closely aligned. A solution to this problem was recently presented in [51], where detection is achieved based on amplitude analysis of different correlator branches. Spoofing is not only detected, but also mitigated, with a vector based tracking receiver structure that bridges the authentic signal outage. A different technique designed specifically to detect GPS spoofing attacks that affect the time synchronisation of wireless networks has been presented in [53]. Initial simulation results for both approaches have been promising, but none has been tested in a real world system yet.