On GPS spoofing of aerial platforms: a review of threats, challenges, methodologies, and future research directions

Survey’s rationale and methodology

Considering the growing research interests and practical contributions towards GPS spoofing of cyber-physical systems, a requirement exists to comprehensively analyze the emerging threat landscape and logically group these threats based on diverse spoofing techniques, multifaceted attack variables, evolving attack objectives, and corresponding countermeasures. Existing surveys on GPS spoofing (Jafarnia-Jahromi et al., 2012; Günther, 2014; Sathyamoorthy, 2015; Krishna & Murphy, 2017) are outdated and do not fully cover the state-of-the-art. Moreover, these efforts focus only on a confined subset of the holistic threat landscape posed by GPS spoofing. In particular, existing surveys on threats to aerial platforms, such as presented by Nassi et al. (2019), are generic in nature and do not cover the details of GPS spoofing threats. Moreover, the available literature also lack a proposal to comprehensively classify existing techniques in the form of a taxonomy with an aim to facilitate and steer further research in focused domains. This effort seeks to conduct a detailed review of UAVs’ dependency over GPS and present a cohesive and novel taxonomy of GPS threat variables, goals, and trade-offs, while focusing on aerial platforms.

The overall survey approach followed by this work is summarized in Fig. 1. Our survey follows a semi-systematic methodology (Snyder, 2019), which explores and narrows-down the relevant literature in multiple phases. The first phase of the literature review focuses on a breadth search within the broad domains of GPS security threats, in general and spoofing threats, in particular. In parallel, this phase categorizes drones with reference to their dependencies over GPS as this factor further assists in evaluating threat levels, applicable techniques, and impact of GPS spoofing attacks over drones. While the prime focus of our survey revolves around drone-specific spoofing attacks, we have also covered the breadth of similar efforts against non-aerial platforms to serve as a ready reference and perform comparative analysis of variation in attack parameters in both of these scenarios. Therefore, segregation of existing GPS spoofing attempts against non-aerial platforms is also performed during Phase-I. Phase-II conducts a depth search to shortlist and group existing literature within the domain of GPS spoofing. During this phase, we conduct a comprehensive analysis of existing research contributions based on the techniques deployed for GPS spoofing, including attack attributes, goals, and consequences. The analyses performed in Phase-II is formalized as a taxonomy in Phase-III, which structures the inherent relationships among complex spoofing parameters and logically aligns them for better understanding. The inferences drawn after evaluating the existing literature in line with the proposed taxonomy are summarized in Phase-IV with pointers to open research problems and future directions.

Targeted audience

The analyses presented by this paper can benefit a wider research and development community, working in the domain of GPS-driven GNC applications, both for offensive and defensive purposes. A better understanding of existing GPS spoofing threats, as classified by our work, can help in neutralizing rogue UAVs as well as defending friendly UAVs against spoofing attacks.

Paper organization

The rest of the article is organized as follows. In ‘Background’, we present an overview of the GNSS in general and GPS, in particular. ‘Drones GNC Dependency and Allied Threats’ provides a discussion on the dependency of drones over GPS. We analyze the GPS based threats to the dependent systems, specifically UAVs, in ‘GPS Threat Landscape’. ‘Taxonomy of GPS Spoofing Attacks’ presents a novel taxonomy of GPS spoofing attacks based on spoofer placement, stealthiness, attack technique, and objective of the attacker. Challenges and limitations of GPS spoofing of static targets as compared to moving and aerial platforms are featured in ‘Spoofing Challanges’. ‘Open Problems and Future Research Directions’ discusses some of the open problems identified by this work to steer future research directions. Finally, ‘Conclusion’ concludes the paper.

Global Navigation Satellite System (GNSS)

GNSS is an umbrella term used for satellite Positioning, Navigation and Time (PNT), provided by satellite signals transmitted from space. To avoid dependency, several countries operate their independent GNSS systems with varying degrees of coverage and operational capabilities, including GPS by the USA, GLONASS by Russia, Galileo by the European Space Agency, and BeiDou Navigation Satellite System (BDS) by China. The four major systems have distinct carrier frequencies and they also employ different modulation schemes (Maksutov et al., 2019). As an example, some of the GLONASS signals use Frequency Division Multiple Access (FDMA) modulation scheme, while the GPS uses Code Division Multiple Access (CDMA). However, the newer versions of the GLONASS are also using CDMA as a modulation scheme. Despite having individual characteristics, all these systems deploy a similar principle of operation and are designed to serve a common goal, which is broadcasting a radio frequency signal with a precise time-stamp, enabling the users to receive and decode these signals to determine their position (Ioannides, Pany & Gibbons, 2016). A GNSS receiver calculates its position and time by the principle of “trilateration. To have a 3-dimensional location-fix and time synchronization, navigational data from at least four satellites in the constellation is needed (Larcom & Liu, 2013). All the currently operational GNSS systems including GPS offer no encryption or source authentication for services available for public use (Ioannides, Pany & Gibbons, 2016), making them equally susceptible to attacks discussed later in ‘GPS Threat Landscape’. Recently, some GNSS service providers have introduced spoof resistant services, like Galileo’s Open Source Navigation Message Authentication (OSNMA), which enables authentication of navigational data on Galileo. NMA validates the received GNSS signal, making it robust against GNSS spoofing attacks. However, wide scale implementation of this authentication service would require updating the firmware of existing Galileo receivers. Another limitation is that NMA does not currently offer authentication service for the ranging measurements (Gutierrez, 2020).

Global positioning system (GPS)

Originally known as the NAVSTAR, GPS was launched in 1978 only for the US military. However, later in 1994, GPS services were made fully available to the rest of the world. GPS has emerged as the de-facto GNSS standard due to its global coverage, wide adoption and acceptability.

GPS transmission

The signal generation and modulation process followed by the GPS Space segment is illustrated in Fig. 3. The GPS satellites generate a central L-band frequency (F₀) of 10.23 MHz, using its on-board atomic clock. This base frequency is multiplied by 154 and 120 to generate the two carrier frequencies, L1 at 1575.42 MHz and L2 at 1227.60 MHz, which are subsequently modulated by Coarse Acquisition Code (C/A) and Precise (P) ranging codes: a combination of the data message and a unique code, to produce a spread spectrum signal of 2.046 MHz and 20.046 MHz bandwidth respectively (Tamazin, Karaim & Noureldin, 2018). Each satellite has a unique Pseudo-Random Noise (PRN) code that is nearly orthogonal to each other, which helps the receiver to differentiate between each satellite in the GPS constellation, improve Signal to Noise Ratio (SNR), ensure accurate ranging, and enhance robustness against signal interference (Jan Van Sickle, 2021).

The P(Y) is an encrypted signal for the military, with a claimed accuracy of few centimetres. The C/A signal has an accuracy of 4.9 meters and is freely available for public use without any embedded encryption or authentication (NCO Space-Based PNT, USA, 2021a). However, its accuracy and availability is affected by various factors, such as the urban canyon, trees, building and other obstacles. GPS transmits the following types of data (Schmidt et al., 2016):

• A ranging code, enabling the receiver for computing PVT solution.

• Ephemeris data containing location information of individual satellites.

• Almanac data having the orbits, locations and status information for all the satellites in the constellation.

The navigation message, which is a key component of the transmitted signal contains information regarding the ephemeris, almanac and clock bias parameter (Karaim et al., 2013).

Drone’s operational modes

Modern-day UAVs leverage a wide range of sensors, including GNSS, for their positioning, orientation, path profiling, guidance, and navigation. Apart from GNSS, some of the other sensors which are typically leveraged by drones/missiles include Inertial Measurement Unit (IMU), TERrain COntour Matching (TERCOM), accelerometer, magnetometer, gyroscope, and barometer. However, these non-GNSS based GNC systems are considered beyond the scope of our work. Among different GNSS, GPS is the most widely deployed system due to its wide acceptability and free global coverage. Drone’s dependency over GPS is subjected to the level of autonomy, targeted application, and flight mode. The various “Flight Modes” of modern drones, such as ArduPilot Dev Team (2020), can be grouped under three broader operational categories: Manual, Semi-Autonomous Assisted, and Autonomous. Table 1 maps key flight modes of drones with corresponding operational mode, each having a varying dependency over GPS-guidance and therefore, presents different level of threat exposure. A brief introduction of these operational modes is given below (Mulas, 2016; Hassanalian & Abdelkefi, 2017).

Mode-specific UAV threat landscape

UAVs in manual mode, being unsusceptible to GPS-based threats, are vulnerable to RF link attacks (Pleban, Band & Creutzburg, 2014; Costello, 2017; Dey et al., 2018; Arteaga et al., 2019; Nunez, Tran & Katangur, 2019; Yihunie, Singh & Bhatia, 2020). Such cyber-attacks primarily utilize drone’s C2 links and implementation-specific software, hardware, and networking vulnerabilities. Manesh & Kaabouch (2019) surveyed the cyber-attacks on drones and proposed three broad categories of these attacks as: (1) Data Interception, (2) Data Manipulation, and (3) Denial of Service. These attacks attribute to C2 link, Automatic Dependent Surveillance–Broadcast (ADS-B) and Navigation data received by the drone. Some of the network/C2 link based attacks are briefly discussed below:-

• Compromised Network Ports: The vulnerable network ports like FTP (Port 21) and Telnet (Port 23) can be used for gaining access to the software root directories of various consumer drones such as DJI Phantom 4, Parrot Bebop 2 and AR Drone 2.0, allowing the attacker to cause physical damage to the drone (Pleban, Band & Creutzburg, 2014; Arteaga et al., 2019). Here, the network ports may be regarded as software level vulnerable entry points to inject attack vectors and compromise the system.

• Denial of Service (DoS): Arteaga et al. (2019) discussed that flooding of WiFi based C2 links with certain specific packages may result in DoS, thus causing disruption of manual control over drones.

• De-authenticating Controller: A de-authentication attack aims to disconnect the established link between the controller and the drone by snooping into the communication link and then sending multiple de-authentication packets. Several research efforts (Dey et al., 2018; Nunez, Tran & Katangur, 2019; Yihunie, Singh & Bhatia, 2020) presented the effectiveness of de-authentication attacks against Parrot’s Bebop 2, Mambo FPV and AR Parrot 2.0 drones using aircrack-ng (https://www.aircrack-ng.org/): an open source penetration testing tool, resulting in hijacking of the drone. Furthermore, Maldrone, an airborne malicious drone that uses another such open source software package SkyJack (https://samy.pl/skyjack/), utilizes similar technique for independently launching network de-authentication attacks for taking control over the target.

• Spoofing IP and MAC Addresses: This network cyber-attack is also applicable to C2 links of drones. Costello (2017) demonstrated this attack against Parrot AR Drone 2.0 by creating the network IP alias and spoofing MAC address of the primary controller, gaining complete control of the target.

In semi-autonomous assisted mode, drones have added dependency over the GPS and are prone to both C2 link and GPS-based attacks. Compromise of any of these technologies by an attacker may lead to complete control of the targeted drone. GPS-dependent flight modes, such as follow, loiter, and RTL are mostly independent of the user input through C2 link and take reference primarily from the GPS. Finally, the autonomous mode operations of drone are susceptible to GPS-driven attacks only since the mission profiling and execution in this mode rely only upon GPS-based guidance and control.

Jamming

Jamming is the generation and transmission of enough power signal in the direction of a target that may cause the GPS receiver of the victim unable to track the original GPS signal (Gerdan, Coombe & Takac, 1995). It is a very common and highly undesirable real threat. Westbrook (2019) discussed about new geographies of conflict due to the prevailing use of military-grade GPS jamming equipment by both state and non-state actors as an offensive tool of electronic warfare. Owing to the GPS signal being very weak and well below the background RF noise level measured by the receiver (Silva, 2017; Van den Bergh & Pollin, 2019), it can be affected by the ionospheric attenuation and other factors such as the path followed by the satellite’s transmissions to the receiver and unlicensed use of the GPS band. The jamming of a GPS signal depends upon various parameters such as the power of the original signal and distance of the jamming signal generator from the GPS receiver etc. There are two main characteristics of the jamming signal, the “central frequency” and “Jamming to Signal ratio (J∕S)” measured in dB. Jamming signal overpowers the signal strength of the authentic signal, described by “Carrier to Noise Density Ratio (C∕N_o)”, which is a fundamental signal quality parameter for a GPS receiver (Hofmann-Wellenhof, Lichtenegger & Wasle, 2008). When the jamming equipment is brought closer to the GPS receiver, the power of the jamming signal increases, thus reducing the effective signal strength of the original signal (Silva, 2017).

Regarding UAVs, with a firmware-coded safety mode, an attacker can force a drone to land when both the GPS signal and C2 link are jammed (Tedeschi, Oligeri & Di Pietro, 2020). In 2012, a small UAV resulted in a crash due to GPS jamming, costing a human life (Krishna & Murphy, 2017). In the literature, several works explored the effects of jamming on UAVs. Sathyamoorthy et al. (2020) evaluated the effect of GPS jamming signal on two different UAVs using different jamming signal power levels. The authors concluded that the military GPS signal shows robustness against the jamming signal, while the civil GPS signal is more susceptible to jamming. Further detailed discussion of jamming and related RF interference affecting the GPS signal have been explored by Fernandez-Hernandez et al. (2019) and Gerdan, Coombe & Takac (1995). In particular, Fernandez-Hernandez et al. (2019) categorized the GPS jamming threats into four types based on objectivity of exposure and sophistication of attack; whereas, Gerdan, Coombe & Takac (1995) presented three different case studies of the adverse effects of jamming on GPS signal’s acquisition. Furthermore, Medina et al. (2019) explored the effects of GNSS jamming, including GPS, from a maritime navigation’s perspective.

GPS jamming can be performed using a diverse range of hardware (Karit, 2017), while employing a variety of jamming methods and techniques. Elezi et al. (2019) investigated multiple jamming methods through software simulations and concluded that Spot Noise Jammers, being highly effective against the GPS L1 band, caused the highest Bit Error Rate (BER).

For mitigating the effects of jamming on UAV, Tedeschi, Oligeri & Di Pietro (2020) presented an anti-jamming navigational algorithm by leveraging the jamming signal for localization of the source through Received Signal Strength (RSS). The proposed approach requires considerable software and hardware upgradations for implementing anti-jamming features, including an on-board SDR for jammer’s localization and a custom-built firmware. Moreover, the offered solution is not effective against mobile or adaptive jammer. Seferoglu & Turk (2019) investigated specific waveforms of some commercially available GPS jammers and presented discussion into anti-jamming solutions.

Spoofing

Compared to GPS jamming, the spoofing threat is often pronounced as more dangerous as a spoofer can lead the target to produce erroneous PVT solution or even gain complete control over GPS-driven drone’s trajectory by re-radiating or fabricating counterfeited GPS signals (Horton & Ranganathan, 2018).

GPS spoofing is a more challenging and technology-intensive operation as compared to brute-force jamming since a failed spoofing attempt can still yield the desired or unintentional jamming effects as its byproduct. In a basic spoofing attack type termed as “Meaconing”, the attacker simply captures the authentic GPS signals and re-transmit them towards the target. Also, an attacker could orchestrate a more advanced attack by constructing a fake GPS signal containing malicious information. Such attacks are termed as “Fabrication”.

Humphreys et al. (2008) groups the GPS spoofing attacks into three categories as (a) Simplistic, (b) Intermediate and (c) Sophisticated, based upon the complexity of the attack and the used hardware. Simplistic GPS spoofing is broadcasting arbitrary spoofed GPS signal without catering for the state of the targeted receiver. An intermediate GPS spoofing attack is centred on pre-surveyed information about the target such as publicly available parameters of authentic GPS signal being received by the victim receiver at the time of the attack. Lastly, a sophisticated attack uses multiple coordinated phase-locked intermediate spoofers to evade spoofing detection protocols of the target receiver.

The lack of any authentication mechanism makes the GPS receiver unable to distinguish between the authentic and malicious signal. Also, because of its open accessibility and publicly available technical parameters such as C/A code modulation, the Civil GPS can easily be mimicked using a signal simulator or low-cost open source equipment. On the contrary, replication of authentic P(Y) code used by the US Department of Defense (DoD) is technically infeasible due to its classified signal structure and limited information about the employed encryption technique.

A GPS spoofing attack can target to manipulate the PVT calculations at receiver end, either causing disturbances/deviations in time measurements or inducing errors in location measurements, as discussed in ensuing paragraphs.

Location spoofing

Fundamentally, a GPS spoofing attack results in manipulating the target’s GPS based location calculations by inducing an inaccurate position fix, as depicted pictorially in Fig. 4. As covered in section ‘Drones GNC Dependency and Allied Threats, drones rely on GPS for navigation and positioning in different modes. This dependency makes them vulnerable to location spoofing attacks. With the ever-increasing acceptability and adoption of autonomous GPS-driven traffic management systems, such as NEXT GENeration air-traffic system (NEXTGEN) by the USA, GPS location spoofing threats are becoming even more realistic, having a detrimental impact on the safety of such systems (Schmidt et al., 2016). In the recent past, several research efforts have successfully demonstrated the applicability of GPS location spoofing against commercially available drones. In an indoor environment Arteaga et al. (2019), successfully spoofed the location of 3DR Solo drone using an SDR device running an open source script. Similarly, Dey et al. (2018) and Horton & Ranganathan (2018) demonstrated that even the sophisticated consumer drones from DJI are susceptible to simplistic spoofing attacks and can be easily tricked by fabricated GPS signal in absence of the authentic GPS signal. Also, spoofing the location of a drone can result in diversion from the actual course, crashing, hijacking, or even gaining full control of the target, forcing it to land at a place of attacker’s choice. Ma et al. (2020) demonstrated that drone in autonomous mode can be lured to a pre-defined destination by executing a GPS course deviation attack. Using GPS spoofing as a defensive tool against intruding GPS dependent drones, He & Liu et al. (2019); He & Qiao et al. (2019) demonstrated path deviation attacks by inducing velocity drifts in loiter mode of the drone.

Apart from aerial platforms, GPS is also used extensively in other areas for tracking and location information e.g., shipping, trains, cargo trucks, and taxis. Commercial truck drivers can use GPS based location spoofing to follow unauthorized routes or assist in fraudulent theft of truck consignments or the truck itself (Schmidt et al., 2016). A similar off-board attack setting was demonstrated by Warner & Johnston (2002), simulating falsified location information reported by cargo trucks. Zeng et al. (2017) demonstrated a location spoofing attack in a road navigation scenario using an SDR based spoofing device. Zeng et al. (2018) generated hundreds of ghost road routes in Boston and Manhattan, USA, that could be used to divert, endanger, or even hijack the victim vehicle.

Device placement

The spoofing hardware, coupled with the algorithm used for GPS spoofing, jointly determine the attack’s effectiveness. Researchers have demonstrated spoofing using a diverse range of devices, ranging from Commercial Of The Shelf (COTS) based low-cost equipment to custom-built sophisticated spoofing systems. The selection of an appropriate spoofing hardware depends on a variety of factors, including the relative location and velocity of victim receiver, affordable cost, link-budget analysis (requirement of dedicated signal amplifiers), terrain (requirement of a clear line of sight), attack directivity (to minimize collateral damage), and embedded anti-spoofing capabilities of the target. Based upon these key parameters, spoofer’s placement can be classified into Off-board and On-board spoofers, as discussed below.

Off-board

Spoofing devices that are kept at a distance from the target. Off-board spoofers can be both “Static” or “Mobile”.

Static spoofer.

Static spoofer refers to the spoofing equipment that is non-portable and usually ground fixed. Generally, static GPS spoofers include GPS transmitters that are bulky, immobile, non-tunable and hardware-based. However, because of their static nature, these spoofers can afford high power amplifiers, which can help them generate strong spoofing signals to compromise distant receivers as well. A diverse range of static GPS emulators/spoofers are available in the market which can be graded based on their capabilities, such as the number of satellite signals which can be generated simultaneously, level of programming and control offered over signal generation, and multipath modeling/compensation features. As an example, the static spoofing hardware (WelNavigate GS72) used by Warner & Johnston (2002) was able to simulate only 10 satellites signals at a time as compared to the currently available high-end simulators that can simulate up to 64 simultaneous signals and multiple GNSS systems e.g., the Orolia GSG-5/6 series GPS simulators (https://www.orolia.com/products/gnss-simulation/gpsgnss-simulators).

Mobile spoofer.

Technological advancements in recent years have facilitated the hardware-specific equipment capabilities to be achieved by flexible and user-friendly software modules, thus significantly reducing the SWaP-C parameters, resulting in low cost and user-friendliness. The SDRs, such as HackRF One, BladeRF and USRP mini are portable palm-size frequency tunable devices that are capable of generating GPS spoofing signals. Due to their mobility and ease of use, SDRs are now widely being deployed for GPS emulations and offensive transmissions. A number of recent research efforts (Shepard et al. (2012); Dey et al. (2018); Horton & Ranganathan (2018); Arteaga et al. (2019); He & Qiao et al. (2019); He & Liu et al. (2019); Ma et al. (2020)) have demonstrated GPS spoofing attacks against several drones using low-cost SDR equipment and open source scripts. Moreover, practical demonstrations of GPS location spoofing attacks against non-aerial platforms using commonly available SDR devices have been put forward (Huang & Yang (2015), Wang, Chen & Pan (2015); Silva (2017), Zeng et al. (2017), Horton & Ranganathan (2018), Zeng et al. (2018), Goavec-Merou, Friedt & Meyer (2019) and Gaspar et al. (2020); Rustamov et al. (2020)). Similarly, GPS based time spoofing attacks using SDRs have been demonstrated by Shepard et al. (2012); Wang, Chen & Pan (2015); Karit (2017).

Using an off-board spoofer against a moving target have its own challenges. The key challenge is to consistently and accurately maintain the desired signal strengths and phase angle required to spoof a fast moving/flying receiver. As depicted in Fig. 6A, the variation in distance (Δd) between the target receiver and the off-board spoofer is a function of difference in their individual velocities and time. These distance variations induce abrupt fluctuations in RSS at the victim GPS receiver, which can be used to filter out the spoofed GPS signals.

Stealthiness

Based on the stealthiness and strategy of the attack, GPS spoofing attacks can be divided into two broad classes:-

• Overt: The spoofer does not attempt to obscure the attack.

• Covert: The spoofer seeks to evade detection by transmitting smartly-crafted spoofing signals, which closely match the actual satellite signals in terms of output power and other parameters. By doing so, the spoofer prevents triggering of spoofing detection alarm by the victim.

In an overt spoofing attack, the victim GPS receiver loses lock on the authentic GPS signal before switching to the over-powered spoof signal. The strategy of jam-then-spoof is adopted in such overt scenarios, which leads into abnormally high SNR followed by an abrupt jump in PVT solution calculated by the victim (Chapman, 2017). The overt spoofing also termed as Hard spoofing (Noh et al., 2019) can be easily detected due to signal interruptions in the initial phase and abnormally high SNR (Gao et al., 2013). Some rudimentary anti-spoofing checks can be implemented to detect such types of GPS spoofing attacks by analyzing the position solution and GPS signal’s strength; however, most civil drones still lack these basic defenses due to simplistic and security unaware designs (Humphreys et al., 2008). Compared to the overt attack, a covert spoofing attack is an advanced level and sophisticated operation. In a covert attack, drifts in velocity and positioning values are induced in a concealed manner to enforce the target to follow a spoofed path that may result in capturing the target. Su et al. (2016) proposed a greedy strategy of covertly spoofing UAVs, causing them to deviate from the intended flight paths. The proposed approach assumed a capability to generate code and phase-aligned spoofed signal with reference to the authentic GPS signal. It subsequently applied the minimum malicious deviation of the target as an expanding location range circle over time without triggering the detection alarm. The experimental results by Tippenhauer et al. (2011) presented a set of threshold parameters to successfully execute covert spoofing against advanced GPS receivers. The authors concluded that for seamless lock take over by a spoofer, a minimum of 2 dB power advantage is desired, while a maximum of 80 nsec of time offset relative to the authentic signal and 500 m location offset is to be ensured to remain undetected. Peng et al. (2019) concluded that for a covert attack, the spoofing signal must have a maximum power advantage of 3 dB, while a maximum carrier frequency offset of 50 Hz can be afforded. Another approach towards stealthy spoofing was proposed by Gao et al. (2013), which presented two different two-step trajectory spoofing strategies. In the first step, the attacker maintained very low power for the spoofing signal and carefully aligned the code phase of the transmitted signal similar to the authentic signal. In the second step, the spoofer attempted to isolate the tracking point induced by the spoofing signal from that of the genuine signal. Psiaki & Humphreys (2016) argued that attacker may adopt advanced spoofing forms such as nulling and multi-antenna spoofers, for covert spoofing and defeating various defences deployed by the victim GPS receiver. In nulling, two simultaneous signals including a true spoofed signal and a negative authentic signal are transmitted so that the negative signal cancels the authentic signal due to carrier phase shift. Similarly, a multi-antenna spoofer, with single or multiple transmitters, can deceive some advanced anti-spoofing countermeasures by implementing independent delay variations, multiple steerable gains, and scattered/controlled direction of arrival of spoofed signal.

Attack Technique

The technique deployed for GPS spoofing depends upon several factors such as spoofer’s hardware capabilities, algorithm’s sophistication, and the information available with the spoofer about victim’s parameters, such as its real-time location, velocity, antenna placement, and anti-spoofing features. Based on the attack technique used, GPS spoofing attacks can be classified as:-

End-goal

The GPS based spoofing attacks against moving targets, specifically UAVs, can also be categorized based on the attacker’s objective. An attacker may seek diverse end-goals from spoofing attempts, such as distraction, destruction, endangering, and apprehension of the victim’s platform (Giray, 2013; Zeng et al., 2018). Achievement of the attacker’s end-goal largely depends upon the spoofer’s capabilities vis-a-vis victim’s anti-spoofing features. A spoofer can attack a GPS-guided aerial platform to achieve the following end-goals:-

• Distraction: Randomly location spoof the target with an aim to prevent or delay it from reaching its destination.

• Destruction: Endangering the target by setting it on a collision course, either towards an aerial obstacle or hitting the ground through manipulation of its height parameters.

• Hijacking: Gaining a temporary control of its target to usurp the victim.

• Apprehension: Directing the victim to a pre-defined destination and then forcing it to safely land inside a friendly zone for capturing the drone or its payload.

Various types of similar spoofing attacks against drones can be found in He et al. (2019); Shepard et al. (2012); Ma et al. (2020); Horton & Ranganathan (2018). In He et al. (2019) a low-cost capturing attack technique against a drone in RTL mode was presented. A simplistic location spoofing attack can be deployed in RTL mode, causing the victim to retrieve, distract, or even suffer damage/destruction. Also, a GPS-time spoofing attack may also lead to distraction and destruction in case of UAVs and smart-grid systems. A hijacking attack against a GPS dependent mini-drone was demonstrated in Shepard et al. (2012) by gaining an interim control over the victim. Ma et al. (2020), managed to lure a DJI Phantom 3 SE drone to a pre-designated spoofed location at a distance of about 50 m from its actual destination. Similarly, Noh et al. (2019) classified various consumer drones based on their GPS fail-safe mechanisms and presented three different GPS spoofing-based hijacking strategies: (a) inducing drift in a specific direction, (b) manipulation of the trajectory using a path-following algorithm, and (c) combination of (a) and (b) through covert spoofing. Furthermore, all the above-stated attack objectives can also be achieved against ground-based targets such as GPS-driven autonomous vehicles. As an example, Zeng et al. (2018) demonstrated spoofing attacks against a road navigation system to achieve different objectives such as Diversion, Distraction, and Apprehension.

Relative position of the spoofer

The effectiveness of a GPS spoofing attack, besides other factors, relies heavily on the relative position of the spoofer with reference to the victim receiver. This factor alone induces the peculiar challenges of spoofing a ground-based target in comparison to an airborne platform. Spoofing of a ground-based receiver requires establishing a consistent and clear line of sight with the victim, which becomes difficult to manage, particularly against a moving vehicle. Ground spoofing also requires sophisticated algorithms to compute alternate routes (in case of complex and congested road networks) to effectively achieve the Diversion or Distraction goals, without getting detected. As an example, Zeng et al. (2018) proposed novel diversion algorithms for ground-based spoofing scenarios, which also catered for practical road turnings/branches at the city level to make them effective/covert. This challenge is not particularly relevant for spoofing of aerial platforms as they can be flexibly Diverted/Distracted in the open 3D flying environment. Moreover, the desired line of sight required for the spoofing attack is also easier to establish for aerial platforms due to lesser obstructions in free space. Another worth-mentioning challenge for a ground spoofing scenario under a dense user environment is maintaining the desired directivity towards the intended receiver(s) to avoid collateral damage to other receivers operating nearby. This limitation may also be relevant for airborne scenarios when only a given drone is to be spoofed within a swarm or when friendly airborne assets are operating in close vicinity to the targeted hostile drone.

Spoofer’s distance variations

UAVs typically fly at considerably high altitudes and operate over a wide range of speeds, reaching as high as the speed of sound. These flight profiles significantly add to the complexity of ground-based spoofing attempts. The rapidly changing distances between the airborne target and ground-based spoofer can cause an abrupt fluctuation in the strength of the spoofer’s signal as received by the victim, as per the free space square law: ${\displaystyle Pr=Pt∕4\pi d^2}$

Where Pr is the received power, Pt is the power transmitted by the system and d is the distance between the two antennae. As the above formula suggests, the received power varies inversely with the square of the distance between the two transceivers. For the spoofing attempt to go undetected against modern-day sophisticated receivers, the transmitter and receiver must maintain a fix distance or power ratio. For a drone, the distance between the on-board GPS receiver and GPS satellites is insignificantly varying as the satellites are hundreds of kilometers above, so the power remains relatively constant. Therefore, for a successful spoofing attack against an airborne platform, particularly if operating beyond a controlled territory, maintaining a constant signal strength is one of the core challenges. Many research efforts (Jafarnia-Jahromi et al., 2012; Schmidt et al., 2016; Mathew, 2019) endorse that spoofing a mobile GPS receiver with sustained/constant power suffers this practical limitation due to abrupt distance variations between the spoofer and victim GPS receiver.

Spoof resistant receivers

Besides the relative position of spoofer, the anti-spoofing capabilities of the victim receiver also impact the effectiveness of the attack. These spoofing countermeasures have been extensively discussed in literature (Key, 1995; Humphreys et al., 2008; Wesson, Shepard & Humphreys, 2012; Habib, Maqbool & Mohsin, 2019) and warrants careful analysis of the targeted receiver to customize the corresponding spoofing parameters. Ranganathan, Ólafsdóttir & Capkun (2016) presented a spoof resistant GPS Receiver capable of receiving both strong and weak GPS signals and tracking any auxiliary peaks to detect sophisticated spoofing attempts capable of seamless lock takeover of GPS receiver. Arthur (2019) proposed an Artificial Intelligence (AI) based Intrusion Detection System (IDS) against GPS jamming and spoofing attacks on UAVs. Similarly, another AI-based supervised machine learning method was proposed by Manesh et al. (2019) for the detection of counterfeited GPS signals. This approach leveraged different GPS signal parameters as input features for the neural network, including satellite number, SNR, pseudo-range, doppler shift, and carrier phase shift and tried different combinations of these features to analyze the accuracy and false alarm rate of achieved results. Furthermore, Eldosouky, Ferdowsi & Saad (2019) proposed a framework for modeling the optimal flight route of a UAV as a defence mechanism to mitigate the effects of a GPS spoofing attack on UAVs in autonomous mode. Naeem et al. (2021) presented a novel obfuscation-based approach to safeguard location parameters against GNSS spoofing by concealing actual location coordinates or intentionally deceiving a known adversary by sharing wrong coordinates, thus averting eavesdropping of UAV’s actual trajectory which is an important information needed for covert spoofing attacks. Furthermore, Oligeri et al. (2019) presented a GPS spoofing detection and mitigation mechanism by leveraging broadcast signals of reference cellular network for validation of location measured through GPS infrastructure. The proposed solution is feasible for GPS devices with cellular connectivity such as smartphones and road navigation systems and is not applicable over UAVs.

Multi-GNSS receivers

Multi-GNSS receivers are capable of providing accurate positioning and navigation solution by simultaneously utilizing two or more GNSS systems i.e., GPS, GLONASS, and BDS etc. For example, GN-87 is a Multi-GNSS receiver, capable of concurrently receiving signals from GPS, Galileo, and GLONASS (FURUNO Electric CO., 2019). It can switch its operations to another GNSS system in case of attempted jamming and spoofing attack or unavailability of the GPS signal, making it challenging for the spoofer to deprive or manipulate the UAV’s GNSS-dependent services. Currently, a number of high-end UAVs in the market are equipped with multi-GNSS receivers (DJI, 2020).

Angle of Arrival (AoA) of signal

GPS antenna is typically mounted on top of a UAV to have a clear line of sight with GPS satellites. A ground-based spoofer will find it hard to direct its transmissions towards the victim’s antenna. Another potent anti-spoofing measure for UAVs is to filter out fake GPS signals or ground reflections by equipping the on-board GPS receiver with Direction Finding (DF) capabilities. Since many spoofers generate multi-satellite signals from a same source, such signals received from a single location can be filtered out or rejected by the direction finding system. A successful spoofing attack under such a scenario would require an exact location of on-board GPS antennae and corresponding direction finding algorithm used by the victim to generate precise delays and phase shifts.

Montgomery (2011) demonstrated the effectiveness of AoA technique as a GPS spoofing countermeasure and claimed its effectiveness against sophisticated spoofing attacks. In the case of a group of drones, considering the required phase angle for multiple victims, the spoofer is restricted to fewer spoof location choices with the increase in the number of subjects (Tippenhauer et al., 2011).