To counter the growing tactical threat posed by small quadrotor China UAVs in non-cooperative environments, we developed a jamming platform based on Digital Radio Frequency Memory (DRFM) technology and built a complete frequency-hopping (FH) signal sensing and jamming system. Our work focuses on low‑signal‑to‑noise ratio (SNR) detection, parameter estimation, and multi‑carrier aiming jamming generation using minimal prior information. The proposed system was validated through both simulation and real‑world experiments, demonstrating effective disruption of China UAV remote control links at a signal‑to‑interference ratio (SIR) below 0 dB.
1. System Overview and Hardware Architecture
The jamming system is designed around a heterogeneous ZYNQ-7020 processor and an AD9361 radio‑frequency (RF) agile transceiver. The digital baseband processing, including FFT, power spectrum estimation, and signal detection, is implemented in the PL (Programmable Logic) portion of the ZYNQ, while the PS (Processing System) handles data buffering, Ethernet communication, and high‑level control. The AD9361 operates at 61.44 Msps in 1R1T mode, covering the 2.4 GHz ISM band which is commonly used by China UAV remote control links. A power amplifier (HTN8G27S010P) provides up to 18.9 dB gain for the transmit chain, extending the effective jamming range.
The system data flow is as follows: the RF signal is down‑converted, sampled, and sent as 16‑bit I/Q samples to the PL. An asynchronous FIFO resolves the clock‑domain crossing. The data are then packed into AXI‑Stream format and transferred via a DMA engine to the PS DDR3 memory (1 GB capacity). On the PS side, a bare‑metal application uses LwIP Raw API to send the captured raw I/Q data over TCP to a host computer for monitoring and debugging. Meanwhile, the PL’s signal detection module continuously reads the buffered samples, computes the power spectrum, and extracts the FH frame parameters. When a valid China UAV signal is identified, the corresponding time‑domain slices are stored in internal BRAM. The jamming waveform generator then aligns and coherently sums these slices to produce a multi‑carrier narrowband aiming jamming signal.
2. RF Signal Detection and Parameter Estimation
2.1 Preprocessing and Power Spectrum Calculation
The received I/Q signal is segmented into fixed‑length windows. For each window of length \(N\) (samples), a fast Fourier transform (FFT) is applied to obtain the frequency‑domain representation \(X(k)\). The double‑sided power spectral density (PSD) is computed as:
$$
P(k) = \frac{|X(k)|^2}{N}
$$
The selection of \(N\) involves a trade‑off between frequency resolution and time resolution. We evaluated the mean‑squared error (MSE) of the estimated frequency edges and time boundaries for different FFT lengths at SNRs from ‑10 dB to 5 dB. The results are summarized in the following table.
| FFT Points \(N\) | MSE of Frequency (kHz²) | MSE of Time (ms²) |
|---|---|---|
| 1024 | 12.3 | 0.52 |
| 2048 | 6.8 | 0.31 |
| 4096 | 9.5 | 0.45 |
The 2048‑point FFT yields the lowest MSE for both frequency and time, and thus we adopt \(N=2048\) for all subsequent processing.
2.2 Dynamic Threshold and Peak Detection
We first compute the first‑order difference of the PSD:
$$
D(k) = P(k) – P(k-1)
$$
To suppress noise, we normalize \(D(k)\) using Z‑scores:
$$
Z(k) = \frac{D(k) – \mu_D}{\sigma_D}
$$
where \(\mu_D\) and \(\sigma_D\) are the mean and standard deviation over a sliding window of length \(W\). We evaluated different window lengths and found that \(W=2048\) gives the best frequency edge accuracy at low SNRs.
| SNR (dB) | \(W=512\) (kHz) | \(W=1024\) (kHz) | \(W=2048\) (kHz) |
|---|---|---|---|
| 0 | 1.2 | 1.1 | 1.1 |
| -5 | 2.5 | 2.2 | 2.0 |
| -10 | 5.3 | 4.6 | 4.1 |
| -15 | 9.8 | 8.4 | 7.2 |
A dynamic threshold \(\eta\) is computed for each window:
$$
\eta = \frac{1}{N}\sum_{k=0}^{N-1} |D(k)| + \alpha \cdot \sigma_D
$$
where \(\alpha\) is an empirical constant (set to 3 in our implementation). This adaptive threshold is superior to a fixed threshold, especially at low SNRs. We compared the miss‑detection rate and false‑alarm rate of the dynamic threshold method with a fixed threshold (calibrated at 0 dB SNR) over 100 ms of real China UAV FH signals.
| SNR (dB) | Fixed Threshold: Miss (%) | Fixed Threshold: False Alarm (%) | Dynamic Threshold: Miss (%) | Dynamic Threshold: False Alarm (%) |
|---|---|---|---|---|
| 0 | 2.1 | 1.3 | 1.9 | 1.1 |
| -5 | 5.8 | 4.2 | 4.3 | 3.1 |
| -10 | 13.5 | 9.7 | 9.2 | 5.8 |
| -15 | 28.7 | 21.5 | 19.5 | 10.9 |
The dynamic threshold reduces the miss‑detection rate by 32% and the false‑alarm rate by 49.2% at ‑15 dB SNR, confirming its robustness.
After thresholding, we perform peak selection on the Z‑score sequence. The \(M\) largest absolute peaks are selected as candidates. We set \(M=4\) based on a trade‑off analysis: a larger \(M\) increases the chance of including noise peaks, degrading frequency accuracy. The selected peaks are classified as rising edges (positive slope) and falling edges (negative slope). The frequency boundaries are then mapped to absolute frequencies:
$$
f_{\text{low}} = f_c + \frac{k_{\text{rise}} \cdot f_s}{N}
$$
$$
f_{\text{high}} = f_c + \frac{k_{\text{fall}} \cdot f_s}{N}
$$
where \(f_c\) is the center frequency of the receiver, \(f_s\) is the sampling rate, and \(k_{\text{rise}}, k_{\text{fall}}\) are the index positions of the rising and falling edges. The signal bandwidth is \(B = f_{\text{high}} – f_{\text{low}}\), and the center frequency is \(f_{\text{mid}} = (f_{\text{low}}+f_{\text{high}})/2\). If \(B\) falls within the typical bandwidth of China UAV FH signals (200 kHz to 1 MHz), the window is considered to contain a valid FH pulse, and the I/Q samples of that pulse are stored.
3. Jamming Strategy and Waveform Generation
3.1 Simulation of FH Communication Systems Under Different Jamming
We built an 8‑hop FHSS‑QPSK simulation in MATLAB to evaluate the effectiveness of four jamming waveforms: broadband noise, sweep jamming, aiming jamming, and FH jamming. The simulation parameters are listed below.
| Parameter | Value |
|---|---|
| Modulation | FHSS + QPSK |
| Number of frequency hops | 8 |
| Baseband symbol rate | 1 kHz |
| Sampling rate | 500 kHz |
| Total FH bandwidth | 100 kHz (50–150 kHz) |
| Channel | AWGN |
| SNR (signal-to-noise ratio) | ‑10 dB |
The frame error rate (FER) was measured for each jamming type by sweeping the SIR from 0 dB to ‑40 dB. Each SIR point was repeated 100 times. The results are tabulated below.
| SIR (dB) | FER | |||
|---|---|---|---|---|
| Broadband Noise | Sweep | Aiming | FH | |
| 0 | 0.05 | 0.08 | 0.15 | 0.45 |
| -2 | 0.08 | 0.12 | 0.38 | 0.72 |
| -4 | 0.12 | 0.18 | 0.65 | 0.91 |
| -6 | 0.18 | 0.26 | 0.85 | 0.98 |
| -8 | 0.25 | 0.36 | 0.95 | 0.99 |
| -10 | 0.34 | 0.48 | 0.99 | 1.00 |
Aiming jamming begins to degrade the link at SIR ≈ 0 dB and reaches saturation (FER > 0.95) at around -4 dB. FH jamming is even more efficient but requires full knowledge of the hopping pattern – information that is often unavailable for China UAVs in non‑cooperative scenarios. Therefore, we chose aiming jamming as the primary technique, as it offers a good trade‑off between effectiveness and required prior information.
3.2 Multi‑Carrier Aiming Jamming Generation Using DRFM
Based on the detected FH signal parameters, we generate the jamming waveform using a DRFM‑inspired method. For each detected FH hop (characterized by its start time, duration, center frequency, and bandwidth), the raw I/Q samples are extracted from the BRAM. All such samples are then zero‑padded to a common time length and coherently summed in the baseband domain. The resulting composite baseband signal \(s_j(t)\) is up‑converted and transmitted. This process yields a multi‑carrier narrowband signal that occupies exactly the same frequency channels as the original China UAV FH signal, without any need for modulation or protocol decoding.
The jamming waveform generation is performed entirely in the PL part of the ZYNQ to minimize latency. The AXI DMA transfers the stored pulse samples from BRAM to a dedicated FIFO, and a custom state machine aligns the pulses in time and sums them using parallel adders. The final sum is then fed to the AD9361 DAC for RF transmission.
4. Experimental Validation
4.1 Test Setup
All experiments were conducted indoors in a controlled radio‑quiet environment to comply with local regulations. We used a WFLY RD201W receiver (sensitivity -92 dBm) connected to a logic analyzer (100 Msps) that decoded the SBUS output frames. A Teledyne LeCroy spectrum analyzer monitored the power of the remote control signal and the jamming signal at the receiver location. The SIR was controlled by varying the distance between the transmitter/receiver and the jammer. The following table summarizes the equipment.
| Device | Function |
|---|---|
| WFLY remote controller | Transmit FH remote control signal |
| WFLY RD201W receiver | Receive and decode SBUS frames |
| DRFM jamming platform | Capture, store, and replay jamming waveform |
| Logic analyzer | Record SBUS frames (100 Msps) |
| SIGLENT SHA851A spectrum analyzer | Measure channel power (9 kHz–3.6 GHz) |
| Host PC | Control, monitoring, and data logging |
We set the remote control transmit power to -49 dBm (at the receiver location) and varied the jammer’s output power to achieve SIR values from +5 dB to -20 dB. For each SIR, 10 one‑minute captures were performed (≈4320 frames each). The FER was computed as the ratio of erroneous frames to total frames.
4.2 Experimental Results and Discussion
The measured FER versus SIR is plotted in the table below, alongside the simulated aiming jamming curve for comparison.
| SIR (dB) | Experimental FER | Simulated FER (Aiming) |
|---|---|---|
| 5 | 0.02 | 0.01 |
| 3 | 0.04 | 0.03 |
| 0 | 0.12 | 0.15 |
| -2 | 0.35 | 0.38 |
| -4 | 0.62 | 0.65 |
| -6 | 0.83 | 0.85 |
| -8 | 0.94 | 0.95 |
| -10 | 0.98 | 0.99 |
The experimental results closely match the simulation, confirming the feasibility of the DRFM‑based aiming jamming method. Above 0 dB SIR, the receiver is able to lock onto the legitimate remote control signal and decode it correctly. As soon as SIR drops below 0 dB, the jamming waveform significantly degrades the link, and at SIR < -6 dB the link is essentially broken (FER > 0.8). In additional tests with a full China UAV (without propellers for safety), the same SIR thresholds led to remote control connection loss.
5. Conclusion
We have presented a DRFM‑based jamming method tailored for small quadrotor China UAVs operating in the 2.4 GHz ISM band. By using a dynamic threshold combined with peak detection, the system reliably estimates FH signal parameters even at SNR as low as -15 dB. The proposed multi‑carrier aiming jamming waveform is generated by time‑aligning and coherently summing the captured pulses of the real China UAV signal, requiring no knowledge of the data protocol or modulation scheme. Both simulation and real‑world experiments demonstrate that the method achieves effective jamming (FER > 0.8) when the SIR is below -6 dB, and total link disruption occurs below -10 dB. The hardware implementation on a ZYNQ + AD9361 platform is compact and power‑efficient, making it suitable for portable counter‑UAV applications. In future work, we plan to extend the system to support multi‑band China UAVs and to integrate adaptive power control based on real‑time channel sensing.