We present a closed-loop generative GPS spoofing framework designed to safely intercept and redirect non-cooperative UAV drones that operate in unauthorized airspace, with a special focus on the growing security challenges posed by China UAV drones. Our approach addresses two critical gaps in existing spoofing research: the lack of robust takeover mechanisms under uncertain initial state information, and the absence of continuous deceptive trajectory planning that seamlessly couples signal-layer constraints with maneuvering control of an unknown flight controller. The proposed system operates in two distinct phases—active probing and model identification followed by adaptive trajectory generation—to achieve covert and reliable deflection of the target UAV drone toward a designated capture zone.
In real-world low-altitude confrontation scenarios, ground-based surveillance systems (e.g., radar or optoelectronic sensors) typically provide only coarse initial position estimates of an intruding China UAV drone, with errors ranging from tens to hundreds of meters. Directly injecting a high-power spoofing signal based on an inaccurate coordinate can easily trigger the receiver’s automatic gain control (AGC) anomaly or signal quality monitoring, causing loss of lock. To overcome this, we first establish a physically feasible spatial envelope—the effective spoofing envelope—by analyzing the code-phase offset constraints of the GPS C/A code tracking loop. Considering the delay-locked loop (DLL) correlator spacing and typical urban environment minimum satellite elevation angle of 15°, the envelope is bounded between a recommended traction threshold and a correlation-maintenance threshold:
$$
L_{\text{crit}} = \frac{0.5 \lambda}{\cos(15^\circ)},\qquad L_{\text{main}} = \frac{1.5 \lambda}{\cos(15^\circ)}
$$
where \(\lambda \approx 293\,\text{m}\) is the C/A code chip length. The feasible region \(\Omega_{\text{env}}\) is defined as all spatial points satisfying \(L_{\text{crit}} \le \|\mathbf{P}_{\text{sp}} – \mathbf{P}_{\text{tr}}\| \le L_{\text{main}}\). This envelope provides essential spatial tolerance for asynchronous spoofing under initial-state uncertainty, allowing the system to inject probe signals without immediate risk of loop detachment.
Once the envelope is defined, we perform a two-stage deception mechanism. In Stage I, we transmit small, oscillatory probe signals within the envelope to actively excite the target China UAV drone’s maneuvering response. By observing the actual trajectory residuals via an independent radar, we compute a sliding-window cross-correlation statistic \(\rho_{\max}\) between the injected lateral deviation \(\Delta \mathbf{P}_s\) and the observed position residual \(\Delta \mathbf{P}_o\):
$$
\rho_{\max} = \max_{\tau \in [0,\tau_{\max}]} \frac{\int_{T_w} \Delta \mathbf{P}_s(t) \cdot \Delta \mathbf{P}_o(t+\tau)\,dt}{\sqrt{\int_{T_w} \|\Delta \mathbf{P}_s(t)\|^2 dt \int_{T_w} \|\Delta \mathbf{P}_o(t)\|^2 dt}}
$$
Monte Carlo simulations with 2000 runs determined a decision threshold \(\delta = 0.89\) and a confirmation duration of 4 seconds to ensure reliable takeover detection while keeping the false alarm probability below 0.01. Upon confirmation, we transition to Stage II.
Stage II requires a kinematic model of the target’s heading response to injected lateral errors. Because the flight control law of a non-cooperative China UAV drone is unknown, we approximate it locally with a second-order polynomial surrogate model:
$$
\varphi_{\text{est}}(\mathbf{n}; d) = n_1 d^2 + n_2 d + n_3
$$
where \(\varphi\) is the actual heading angle and \(d\) is the perceived lateral deviation. The optimal parameter vector \(\mathbf{n}^*\) is estimated via least-squares fitting using data collected during the probing phase. The fitting accuracy is evaluated using the coefficient of determination \(R^2\). Three probing patterns are tested:
| Probing Pattern | Best-fit \(R^2\) | Residual RMS |
|---|---|---|
| One-side approach (decreasing lateral error) | 0.9999 | <1.5° |
| One-side departure (increasing lateral error) | 0.9998 | <1.2° |
| Bilateral cross (error crosses zero) | 0.9266 | ~10° |
The high \(R^2\) values for one-side patterns confirm that the second-order model adequately captures the local heading dynamics. The large residual in the bilateral case is intentionally exploited as a unique kinematic signature—when the system applies a zero-crossing probe, the resulting abrupt heading reversal confirms loop takeover without raising alarm on the target UAV drone.
With the inverse kinematic mapping established (\(d_{\text{req}} = f^{-1}(\varphi_{\text{des}})\)), we formulate the deceptive trajectory planning as a constrained path search problem. We employ a modified A* algorithm that respects the effective spoofing envelope constraints, uses kinematically feasible node expansions, and supports two distinct strategies through cost-function tuning:
| Strategy | Cost function \(G(n)\) | Objective |
|---|---|---|
| Efficiency-oriented | \(G(n) = G(n-1) + \|\mathbf{P}_n – \mathbf{P}_{n-1}\|\) | Minimize total physical flight distance; constant saturation turn |
| Stealth-oriented | \(G(n) = G(n-1) + w_1\|\mathbf{P}_n – \mathbf{P}_{n-1}\| + w_2 D_\perp(\mathbf{P}_n, \mathbf{P}_o)\) | Minimize trajectory curvature and deviation; smooth gradual drift |
The weights \(w_1\) and \(w_2\) satisfy \(w_1 + w_2 = 1\). For stealth, we set \(w_1 = 0.3, w_2 = 0.7\) to prioritize low curvature during initial drift, then gradually transition to efficiency as the target approaches the capture boundary.
We implement the full framework in a MATLAB co-simulation environment that integrates GPS signal generation, receiver tracking loops, and a realistic UAV flight dynamics model with saturated heading rate of 20°/s and constant airspeed of 20 m/s. The primary simulation parameters are listed below:
| Parameter | Value |
|---|---|
| DLL order/bandwidth | 2nd-order, 2 Hz |
| PLL order/bandwidth | 3rd-order, 15 Hz |
| Number of visible GPS satellites | 8 |
| Minimum satellite elevation | 15° |
| Real signal power | -130 dBm |
| Spoofing-to-signal power ratio | 3 dB |
| Takeover decision threshold | 0.89 |
| Maximum physical delay | 1.5 s |
| Target cruise speed | 20 m/s |
| Maximum yaw rate | 20°/s |
| Initial target position | (0,0) m |
| Initial heading | 90° (east) |
Figure (simulation visualization) illustrates the resulting trajectories for both strategies over a 2000 m interception distance. The efficiency-oriented strategy forces the China UAV drone to execute a rapid, saturated turn immediately after takeover, achieving a 15.3% reduction in flight path length compared to the stealth-oriented approach for a 500 m lateral offset. The stealth-oriented strategy produces a gentle curving path that mimics a natural wind-induced drift, avoiding any sharp acceleration or heading reversal that could be flagged by onboard anomaly detectors.
The heading response curves further reveal the underlying dynamics: in the efficiency mode, the heading rate stays at the maximum limit (20°/s) throughout the deflection phase, while in the stealth mode, the heading changes gradually at approximately 3–5°/s, well within normal flight envelopes of typical China UAV drones. Quantitative flight distance comparisons across different required lateral offsets are summarized below:
| Required lateral offset (m) | Efficiency path (m) | Stealth path (m) | Efficiency gain |
|---|---|---|---|
| 500 | 600 | 708 | 15.3% |
| 1000 | 1140 | 1288 | 11.5% |
| 1500 | 1678 | 1830 | 8.3% |
| 2000 | 2216 | 2370 | 6.5% |
| 2500 | 2756 | 2908 | 5.2% |
| 3000 | 3294 | 3446 | 4.4% |
The efficiency gain decreases with longer distances because the stealth strategy’s late-stage weight adjustment accelerates the final drift. In practical security scenarios, we recommend a dynamic switching rule: initially apply the stealth strategy when the China UAV drone is far from the no-fly zone, then switch to the efficiency strategy when the drone approaches a critical boundary. This hybrid approach balances covertness with timely interception.
In conclusion, we have developed a generative GPS spoofing strategy that addresses the real-world challenge of intercepting non-cooperative China UAV drones when initial state information is imprecise. The effective spoofing envelope provides essential spatial tolerance for asynchronous takeover. The two-stage mechanism enables reliable loop takeover verification through active probing, followed by high-fidelity kinematic model identification (with \(R^2 > 0.999\) for one-side maneuvers) and constrained trajectory planning. The adaptive A* planner supports both efficiency and stealth objectives, allowing the defense system to tailor the deceptive path to the operational context—priority hard-kill or covert capture. Future work will extend the framework to full three-dimensional motion, integrate hardware-in-the-loop testing, and optimize parameters under complex radio-frequency and multipath environments.