In recent years, the proliferation of unmanned aerial vehicles (UAVs) has brought significant security threats, driving the rapid development of anti‑UAV technologies. Among these, navigation drone spoofing has emerged as a highly effective countermeasure due to its stealth, cost‑efficiency, and dynamic controllability. Traditional drone spoofing techniques typically employ a single antenna to transmit spoofing signals. However, non‑cooperative UAVs equipped with array antennas are capable of identifying the direction of arrival (DoA) of incoming signals. Such UAVs can detect, recognize, and suppress spoofing signals arriving from a single direction, leading to a failure of the spoofing attack. To address this challenge, this paper presents a novel covert drone spoofing method specifically designed for anti‑jamming UAVs equipped with array antennas. The method leverages multiple cooperative UAVs carrying spoofing payloads to transmit mutually consistent signals from optimized directions, thereby making the spoofed signals almost indistinguishable from authentic satellite signals in terms of arrival angles. A hybrid clustering algorithm combining Density‑Based Spatial Clustering of Applications with Noise (DBSCAN) and K‑means is introduced to determine the optimal set of spoofing directions based on the actual distribution of navigation satellite signals. Experimental results demonstrate that the proposed multi‑directional drone spoofing approach can successfully penetrate the navigation link of a non‑cooperative UAV equipped with an array antenna, offering both stealth and feasibility.
1. Introduction
The rapid advancement of UAV technology has enabled their widespread use in both civilian and military domains. Consequently, the threat posed by malicious or errant UAVs has become a pressing concern. Drone spoofing, which involves transmitting counterfeit Global Navigation Satellite System (GNSS) signals to deceive a target UAV’s navigation receiver, has garnered considerable attention as a non‑kinetic and reversible countermeasure. Traditional drone spoofing systems rely on a single ground‑based or airborne transmitter that broadcasts falsified navigation signals. While effective against simple receivers, such systems are vulnerable to detection by modern UAVs equipped with array antennas that implement anti‑jamming algorithms. Array antennas can estimate the DoA of received signals and form nulls to suppress signals arriving from directions inconsistent with authentic satellites, thereby defeating single‑direction drone spoofing attempts.
To counter this capability, a novel covert drone spoofing strategy is required. The key idea is to distribute the spoofing transmission across multiple cooperative UAVs, each carrying a spoofing payload, such that the combined signals impinge on the target UAV from multiple directions that closely mimic the true satellite constellation. The number of cooperative UAVs must exceed the degrees of freedom of the target’s array antenna (typically the number of elements) to ensure that nulls cannot cancel all spoofing signals simultaneously. However, deploying a separate transmitter for each visible satellite is impractical due to cost and complexity. Therefore, a clustering approach is employed to group satellites with similar DoAs, and a single spoofing payload is used to emulate the signals of all satellites within a cluster. The optimal cluster centers determine the positions from which cooperative UAVs should transmit.
2. Problem Statement and System Model
Consider a non‑cooperative target UAV equipped with an array antenna of M elements. The target attempts to determine its position, velocity, and time using authentic GNSS signals. An attacker wishes to inject false signals that cause the target to compute an erroneous navigation solution. The target’s array antenna can estimate the DoA of each incoming signal and employ adaptive beamforming to suppress interference or spoofing sources that deviate from the expected satellite geometry.
Let the true satellite signals received by the target be represented as
$$
r(nT_s) = \sum_{h \in J_a} \sqrt{P^a_h} D^a_h(nT_s – \tau^a_h) c^a_h(nT_s – \tau^a_h) e^{j\phi^a_h + j2\pi f^a_h nT_s} + \sum_{m \in J_s} \sqrt{P^s_m} D^s_m(nT_s – \tau^s_m) c^s_m(nT_s – \tau^s_m) e^{j\phi^s_m + j2\pi f^s_m nT_s} + \eta(nT_s)
$$
where the superscripts a and s denote authentic and spoofed signals, respectively, P is power, D is navigation data, c is the PRN code, τ is code phase, φ is carrier phase, f is Doppler frequency, and η is additive white Gaussian noise. The spoofing transmission must be designed such that the target’s receiver cannot distinguish the spoofed signals from authentic ones based on DoA or other signal features.
The angular resolution of an array antenna is given by
$$
\phi = \frac{2\pi}{\lambda} d \sin\theta
$$
$$
d\theta = \frac{\lambda}{2\pi d \cos\theta} d\phi
$$
where d is the inter‑element spacing, λ is the carrier wavelength, and θ is the DoA. Phase measurement errors directly translate into DoA estimation errors. Hence, if the spoofing signals arrive from directions within the DoA estimation uncertainty of the authentic signals, the array may fail to discriminate them.
2.1 System Architecture
The proposed covert drone spoofing system comprises the following components:
| Component | Function |
|---|---|
| Central Control Unit (CCU) | Receives navigation satellite signals, computes satellite positions, executes clustering algorithm, generates spoofing strategies and control commands. |
| Detection Device | Detects and tracks the non‑cooperative target UAV (position, velocity, orientation). |
| Communication Module | Transmits commands from CCU to cooperative UAVs. |
| Cooperative UAVs (air‑based platforms) | Carry spoofing payloads; move to designated positions based on clustering output. |
| Spoofing Payload (Software‑Defined Radio) | Generates mutually consistent spoofed signals with appropriate code phase, Doppler, and navigation data. Core chips: AD9361 (RF) + ZYNQ7020 (baseband). Output power: 20 dBm. |
3. Hybrid Clustering Algorithm for Direction Imitation
The objective of clustering is to partition N visible satellites into K clusters (where K is the number of cooperative UAVs) such that the intra‑cluster DoA differences are minimized. The cluster centroids represent the optimal spoofing transmission directions. To overcome the limitations of individual K‑means and DBSCAN algorithms, a hybrid approach is proposed.
3.1 Coordinate Transformation and Distance Metric
Let the position of the non‑cooperative UAV be the origin of a local East‑North‑Up (ENU) coordinate system. For a satellite with azimuth β (measured from East, anticlockwise) and elevation α, its DoA is represented as a point xi = (βi, αi) in a 2D Cartesian plane (azimuth vs. elevation). The distance between two points must account for the cyclic nature of azimuth:
$$
d(x_i, x_j) = \sqrt{ [\min(|\beta_i – \beta_j|, 360 – |\beta_i – \beta_j|)]^2 + (\alpha_i – \alpha_j)^2 }
$$
3.2 Proposed Hybrid DBSCAN‑Kmeans Algorithm
The algorithm proceeds as follows:
- Receive satellite ephemeris and compute satellite positions in ENU coordinates relative to the target UAV.
- Project satellite directions onto the azimuth‑elevation plane.
- Set desired number of clusters K, azimuth threshold Th (maximum allowed azimuth spread within a cluster, e.g., 60°), initial DBSCAN parameters (Eps, MinPts).
- Apply DBSCAN clustering. If the resulting number of clusters ≠ K, adjust Eps using binary search and repeat until K clusters are obtained.
- Compute centroids of DBSCAN clusters.
- Use these centroids as initial seeds for K‑means clustering. Run K‑means on the same data.
- Calculate the average intra‑cluster distance d̄ for both clustering results. Retain the one with smaller d̄.
- For each cluster in the retained result, compute the maximum azimuth spread M. If M exceeds threshold Th, increase K and re‑run the hybrid process until the condition is satisfied.
Definitions:
$$ M = \max_j \{ \max_{i} d(\beta_{ji}, \beta_{jj’}) \} $$
$$ \bar{d} = \frac{1}{K} \sum_{k=1}^K \frac{1}{T_k} \sum_{q=1}^{T_k} \| x_q – z_k \| $$
where zk is the centroid of cluster k, and Tk is the number of points in cluster k.
3.3 Performance Comparison
An experiment was conducted using 390 GPS ephemeris datasets collected over 30 days (October 29 – November 27, 2023). The number of visible satellites ranged from 8 to 12. The azimuth threshold was set to 60°. The distribution of the minimal number of clusters required to meet the threshold is shown in Table 1.
| Number of Clusters | Frequency (out of 120 datasets) |
|---|---|
| 4 | 42 |
| 5 | 58 |
| 6 | 20 |
For a fixed K=5, the average intra‑cluster distance d̄ was computed for 120 datasets using K‑means, DBSCAN, and the hybrid algorithm. The results are summarized in Table 2.
| Algorithm | Mean d̄ | Median d̄ |
|---|---|---|
| K‑means | 64.72 | 63.93 |
| DBSCAN | 60.95 | 61.98 |
| Hybrid DBSCAN‑Kmeans | 41.51 | 41.24 |
The hybrid algorithm consistently achieves a smaller intra‑cluster distance, indicating higher similarity of DoA within each cluster. This directly improves the stealth of drone spoofing because the spoofed signals from each cooperative UAV more closely resemble the true satellite directions.
4. Cooperative UAV Deployment and Signal Generation
4.1 Deployment Strategy
After obtaining the K optimal directions (centroids), each cooperative UAV is instructed to fly to a position such that its line‑of‑sight to the target UAV coincides with the corresponding centroid. The positions are updated dynamically as the target moves. The number of cooperative UAVs K is chosen to exceed the number of array elements of the target (e.g., for a 4‑element array, K ≥ 4).
4.2 Self‑Consistent Spoofing Signal Generation
Each spoofing payload generates the PRN codes and navigation data for all satellites assigned to its cluster. Because the distances from different cooperative UAVs to the target are different, the code phases and Doppler shifts of the generated signals must be adjusted accordingly to maintain self‑consistency. The pseudo‑range for satellite i as perceived by the target is:
$$ \rho_i = \sqrt{(x_i – x_R)^2 + (y_i – y_R)^2 + (z_i – z_R)^2} + c t_i $$
where ti is the intentional time offset introduced by the spoofing system. All cooperative UAVs must share a common time reference (e.g., GPS‑disciplined oscillator) and coordinate the delays so that the target’s receiver obtains a consistent but false position solution. The CCU computes the required delays and sends them to each payload in real time.
5. Experimental Verification
Two field experiments were conducted to validate the proposed covert drone spoofing method.
5.1 Experiment 1: Single‑Direction Spoofing against Array Antenna
A single ground‑based spoofing payload transmitted signals toward a non‑cooperative UAV equipped with a 4‑element array antenna. The spoofed signal dynamic was set to 10 m/s. The array antenna receiver successfully formed nulls in the direction of the spoofing signal, suppressing it and preventing the target from being deceived. This confirms that traditional single‑directional drone spoofing is ineffective against array‑equipped targets.
5.2 Experiment 2: Multi‑UAV Cooperative Spoofing
Four cooperative UAVs (modified from Zuoyi FS450) carrying spoofing payloads were deployed. The target UAV (modified DJI Phantom 4 Pro) with a 4‑element array antenna and an integrated Ublox receiver was set to fly east at 2 m/s. The cooperative UAVs were positioned according to the output of the hybrid clustering algorithm. The spoofed signal dynamic was set to 5 m/s.
Before the spoofing payloads were activated, the target UAV flew steadily eastward at 2.01 m/s. After activation, the spoofing signals successfully penetrated the navigation link. The target’s receiver computed a false velocity of 5.15 m/s and the UAV changed course to fly westward, demonstrating successful drone spoofing.
Key experimental parameters are summarized in Table 3.
| Parameter | Value |
|---|---|
| Target UAV array elements | 4 |
| Number of cooperative UAVs | 4 |
| Cooperative UAV model | Modified Zuoyi FS450 |
| Spoofing payload output power | 20 dBm |
| Target UAV initial velocity | 2.01 m/s East |
| Induced false velocity | 5.15 m/s West |
| Target UAV chipset | Ublox receiver with array antenna |
| Clustering algorithm used | Hybrid DBSCAN‑Kmeans (K=4) |
6. Discussion
The proposed method addresses a critical vulnerability of traditional drone spoofing systems. By distributing the spoofing transmission across multiple airborne platforms, the signal DoAs become indistinguishable from those of authentic satellites, thereby nullifying the anti‑jamming capability of array antennas. The hybrid clustering algorithm plays a pivotal role in minimizing the angular deviation between spoofed and true signals, which is essential for covertness.
Several practical considerations must be addressed for field deployment:
- Real‑time operation: The CCU must update the positions of cooperative UAVs based on the target’s motion. The clustering algorithm can be executed periodically (e.g., every 1‑2 seconds) to adapt to changing satellite geometry.
- Communication latency: Control commands and synchronization data must be transmitted with minimal delay to maintain phase coherence among spoofing payloads.
- Power management: The output power of each payload must be calibrated to ensure that the combined signal power at the target is slightly higher than the authentic signals (typically 1–3 dB) to capture tracking loops without triggering power‑based spoofing detectors.
- Scalability: For targets equipped with larger arrays, the number of cooperative UAVs can be increased accordingly. The hybrid clustering algorithm remains effective as long as K exceeds the number of array elements.
7. Conclusion
This paper presented a covert drone spoofing method specifically designed for anti‑jamming UAVs that employ array antennas. The method leverages multiple cooperative UAVs as air‑based spoofing platforms, each transmitting signals from directions optimized by a novel hybrid DBSCAN‑Kmeans clustering algorithm. The algorithm groups visible satellites into clusters with minimal intra‑cluster angular spread, yielding quasi‑authentic DoAs for the spoofing emissions. Field experiments demonstrated that a single‑directional spoofing attack fails against array‑equipped targets, whereas the proposed multi‑directional approach successfully invades the navigation link and alters the target’s trajectory. The hybrid clustering algorithm outperformed both standalone K‑means and DBSCAN in terms of average intra‑cluster distance, confirming its suitability for this application. The proposed drone spoofing framework offers a stealthy, effective, and scalable countermeasure against modern UAVs with advanced anti‑jamming capabilities.