Protecting The Sky
Protecting The Sky
Protecting The Sky
Whitepaper
Table of Contents
1
1.1
2.1
Introduction .................................................................................................. 5
2.2
2.3
Specifications ............................................................................................... 6
3.1
3.2
4.1
4.2
4.3
Jamming ...................................................................................................... 11
5.1
Summary................................................................................ 13
Reference............................................................................... 13
V02.00
Fig 1.
Illustration of a drone in the sky over Paris (SPIEGEL 4th Mar 2015)
Undeniably, surveillance technologies and applications have burgeoned during the last several decades.
The existence of drones adds a further dimension to surveillance, both in terms of capabilities and potential
threats. Beyond the well-known problems of data privacy, drone-based surveillance threatens another
vital human concern: behavioral privacy. As public concern continues to rise, policy and regulatory
responses become more necessary.
Clearly not all use of UAVs is threatening. Examples of the legal and beneficial use of drones include:
park ranger drones, drones for area mapping, search and rescue drones, drones for archaeological and
agriculture research, drones for detecting land mines, and ambulance drones. In addition, the use of
drones for recreational purposes has become extremely widespread.
V02.00
However, the number of incidents involving the irresponsible or illegal use of drones is growing fast. The
list below provides a typical cross-section of news items dealing with the use of civilian and commercial
drones. The types of drones mentioned can be easily bought and operated for criminal or even hostile
purposes.
V02.00
Drone type
Payload (g)
Speed (km/h)
Mini
600 - 3000
30 - 100
15 - 90
2000 - 3000
< 15
Micro
50 - 600
< 50
< 30
< 600
<2
< 50
< 20
Nano
V02.00
*mini drone is corresponding to fixed-wing aircraft UAV with weight around 5-6kg
< 0.1
2.3 Specifications
The table below provides a summary of the typical characteristics and specifications of drones available
on the market today. The implicit low-weight requirement of a drone has the natural consequence that
transmission power is limited and combined with the high frequencies used, which makes detection and
monitoring difficult. The use of frequency hopping and spread spectrum transmission systems is intended
to reduce the impact of interference, which makes detection and monitoring a challenge.
Parameter
Specification
Remarks
Frequency Band
Mainly used
433 MHz
Rarely used
Radio Controlled (RC) FHSS Systems (e.g. HOTT, FASST, MTransmission System Link, DSMX)
WLAN
Typical max.
2.4 GHz ISM band FHSS: up to approx.
communication
3 km
range between drone
and control station
WLAN: 500m
27.12 MHz, 35 MHz, 40.68 MHz: several The drones have to be in the visibility of the
km
controller. To see a typical drone with the naked
eye becomes difficult at approx. > 300m**
5.8 GHz: Line of Sight (LOS)
Positioning
GPS, Glonass
Spreading Mode
FHSS, DSSS
Modulation Type
Burst Length
0.5 ms - 5 ms
Hop Rate
Burst Bandwidth
Symbol Rate
Control Route
* The ISM (Industrial, Scientific and Medical) radio bands are the range of the radio spectrum reserved internationally for the use of RF (radio frequency)
energy for industrial, scientific and medical purposes other than telecommunications. The ISM band is the frequency band open for varied services,
which include Bluetooth, wireless LAN, IEEE 802.15.4-ZigBee, audio and video broadcasts, microwaves, remote controls and others. Most of the ISM
applications are operating between 2.4 and 2.485 GHz, which is commonly called 2.4GHz ISM band.
**First Person View (FPV) is the function that provides the user with a true pilots eye view via video camera on the drones and video display on a head
mounted display while flying the drones. In the case of FPV, the eye contact to the drone is not a limiting issue anymore. It is not so applicable for
WLAN controlled drones and in the band of 27.12MHz, 35MHz and 40.68MHz.
V02.00
Fig 2.
V02.00
Various field trials carried out by Rohde & Schwarz in monitoring, locating and jamming of radio controlled drones
Rohde & Schwarz Protecting the Sky
Benefit
Remarks
a)
immediately slowly
descend to the ground
b)
V02.00
4 FHSS Drones
4.1 Detection, Recognition and Analysis
The radio control connections to drones should be monitored in order to detect threats within an area of
interest. The target RC links are recognized by the monitoring operator in terms of modulation as well as
hop parameters (e.g. hop-length, hop-rate, modulation type, symbol rate). Monitoring of drones essentially
encompasses:
Detection of RC links in the surroundings
Separation of the targeted RC link from other signals within a dense signal scenario (WiFi, Bluetooth)
Measurement of the hop parameters
Identification of the specific type of RC link
A preliminary task is monitoring the relevant ISM bands with the aim of detecting all active RC in the
vicinity of the antenna. A wide bandwidth (i.e. planned performance up to 80 MHz) monitoring would be
beneficial in establishing a comprehensive list of all frequencies used by the RCs and ensuring a higher
probability of interception (POI). Detected signals can be analyzed online (e.g. if an immediate threat is
suspected) or recorded for later offline analysis in order to measure the hop parameters. This is a
prerequisite step if the profile for a new or unknown radio control transmission is to be determined.
The R&S multichannel Signal Analysis solution possesses a powerful short-time detector for automatic
detection and analysis of frequency-agile short-time signals in wideband signal scenarios. The detected
hops are automatically analyzed, sorted and matched to transmissions system profiles. A short-time signal
detector has been optimized to detect the hops in the 2.4GHz ISM band. The RC of the drone may be
immediately detected and identified as soon as it is switched on (even before take-off). Any required
countermeasures can therefore be deployed without delay. This unique capability offered by signal
analysis clearly superior to other solutions (i.e. radar, optical, acoustic).
User
defined
profile
Fig 3.
Short time detection with histogram result of hop parameters (i.e. duration, symbol rate, modulation etc.). The
recognition of different radio control links by using profile separation or automatic separation.
V02.00
The detected hops are further analyzed to determine the relevant technical parameters (e.g. duration,
bandwidth, level, modulation, symbol rate) of each individual hop. This enables the classification of the
short-time emissions. By displaying the results in statistical histograms, the operator receives a full
overview of all detectable RC links in a wideband signal scenario. Profile separation enables online
separation and recognition of both known and unknown RC transmitters. The separator filters and sorts
the hops according to their measured technical parameters, such as duration, modulation type and
modulation parameters. The user can define profiles of RC transmission systems with their relevant
technical parameters. For each cluster of hops, the separator will automatically compare and match the
user defined profiles which fit to the hop parameters. With the profile trigger functionality, automatic
processing workflows can be generated based on user defined rules. Once a target RC has been
identified, automatic alarming can be triggered and the operator will be instantly notified about the
existence of the targeted RC and is therefore forewarned of imminent drone activity within the area of
interest.
For analysis of unknown/new drone communication signals, it is necessary to use our detailed technical
analysis specialized for frequency-agile transmissions. It provides time/frequency domain signal analysis,
timing analysis and modulation analysis for determining technical parameters. New profiles for the
separation/recognition and the countermeasures processes can be defined from the measured
parameters.
Fig 4.
Direction finding result of RC that shows a drone RC in the direction of 183. The diagram in the center (RF-Azimuth)
shows the DF results for the individual hops coming from the same direction
V02.00
10
4.3 Jamming
Effective jamming of the RC link may have various consequences e.g. forcing it to the ground,
reprograming it to a fix position, causing its controlled landing or eventually leading to the activation of a
return-to-home mode. The key purpose of jamming is to create interruption or at least strong interference
of the targeted RC link in order to disable the opponents communications and disrupt any further hostile
actions. The highly effective R&S follower jammer needs much lower power than required by a wideband
jammer (e.g. a non-responsive barrage jammer). With this low power approach, jamming is possible from
about 2/3 distance to the remote control under line-of-site conditions.
Fig 5.
1/3
2/3
i.e. 300m
i.e. 600m
The key to success of RC jamming is equipped with prior comprehensive reconnaissance. A list of RC
links (FHSS) with potential threats is known to the user of the jamming system including their main
modulation parameters (e.g. hop set/frequencies, timing, hop rate, channel bandwidth, modulation type,
symbol rate). The jammer is especially tailored and useful towards counter drone application, where each
of the hops contains the RC information of the drone and all must be jammed.
Instead of a barrage jamming, which needs much higher transmitting power, the unique solution provided
by R&S is based on a follower jamming mode, where each single burst of the RC signal is jammed but
not the other legal signals. This allows the jamming of the targeted RC with almost no disturbance of other
communication signals within the same frequency band (e.g. WLAN/ WiFi communications). Timing is a
very critical criterion in drone jamming. Once the targeted RC link is detected within the realtime
bandwidth, the exciter response has to be fast enough to hit the hop while it is still on air. The R&S jamming
solution is able to detect and respond to a single active burst. Once the next hop is active, the system
detects it immediately within the 80 MHz realtime bandwidth and responds to it accordingly. All detected
emissions and each jamming transmission are displayed in statistic diagrams and can additionally be
observed in a RF spectrum.
Fig 6.
V02.00
Statistic tab: display of detected emissions and exciters activities; Spectrum tab: RF Spectrum with active FHSS signal
11
5 WLAN Drones
5.1 Detection, Recognition and Direction Finding
Some drones are controlled via a WLAN connection. In this case, the radio control cannot be detected by
analyzing the physical layer. It is necessary to analyze the WLAN protocol itself. Reading out the SSID of
a given WLAN connection is in many cases sufficient to distinguish a remote control from any other WLAN
connection. Solutions are available to track the azimuth of the drone (typically by combining a certain
number of directional WLAN antennas and perform a so called amplitude based direction finding).
Access points with fast movements may be a good hint for a drone, even if its SSID doesnt allow a clear
identification.
After a WLAN radio control link had been identified, two further options are available:
a) The first option is to interrupt the WLAN link that will force the drone to enter into its fail-safe mode.
This may result in a shut down of the rotors.
b) The second option is to broadcast RC commands on the identified WLAN (the drone being the access
point) and to take over the control of the drone. It is necessary to know the type of drone in order to
pre-program the command set necessary for this take-over procedure.
V02.00
12
6 Summary
With the rapidly increasing popularity in the use of civilian and commercial drones, there is an urgent need
for monitoring and countermeasures solution. Our aim is to provide an all-in-one solution for coping with
the increasing challenges and requirements in the field of radio controlled drone monitoring. The strategic
solution range from detection, recognition, analysis, direction finding to counter measuring of drones in a
very effective and efficient approach. The above mentioned solution, the WLAN drone monitoring is under
intensive investigation. For further information and about the availability, please contact the Rohde &
Schwarz local representatives.
7 Reference
[1] The drones military (2015) Available at: http://www.theguardian.com/world/drones (Accessed at 27th April 2015)
[2] Drones (2015) Available at: http://gizmodo.com/tag/drones (Accessed at 27th April 2015)
[3] Drones, pros-and-cons (2015) Available at: https://flipboard.com/@gitten4/ drones%3Apros-and-cons7sumklfdz (Accessed at 27th April 2015)
[4] Krueger, K (2015) 'World Cup of drones' offers $1m for innovative uses of unmanned aircraft. Available at:
http://www.theguardian.com/world/2015/ feb/06/world-cup-of-drones-dubai-unmanned-aircraft (Accessed at 27th
April 2015)
[5] Holenwinski, S. and Liz, L. (2012) The civilains impacts of the drones, Center for civilians in conflict, 83, pp. 118. (Accessed at 27th April 2015)
[6] Drone threats (2014) Available at: http://loganbanner.com/news/opinion/ 150094270/Drones:-Pro-and-Con
(Accessed at 27th April 2015)
[7] Tests, Vergleiche, Technik of Drones (2015) Available at: http://www.drohnen.de/ (Accessed at 27th April 2015)
[8] Humphreys, T (2015) Research Team Demonstrates First Successful GPS Spoofing of UAV. Available at:
http://www.ae.utexas.edu/news/features/todd-humphreys-research-team-demonstrates-first-successful-gpsspoofing-of-uav (Accessed at 27th April 2015)
[9] Wikipedia Unmanned aerial vehicle (2015) Available at: http://en.wikipedia.org/wiki/ Unmanned_aerial_vehicle
(Accessed at 27th April 2015)
[10] Wikipedia List of unmanned aerial vehicle (2015) Available at: http://en.wikipedia.
org/wiki/List_of_unmanned_aerial_vehicles (Accessed at 27th April 2015)
[11] UT Austin Researchers Successfully Spoof an $80 million Yacht at Sea (2013) Available at:
http://news.utexas.edu/2013/07/29/ut-austin-researchers-successfully-spoof-an-80-million-yacht-at-sea
(Accessed at 27th April 2015)
V02.00
13
Regional contact
Europe, Africa, Middle East
+49 89 4129 12345
customersupport@rohde-schwarz.com
North America
1 888 TEST RSA (1 888 837 87 72)
customer.support@rsa.rohde-schwarz.com
Latin America
+1 410 910 79 88
customersupport.la@rohde-schwarz.com
Asia Pacific
+65 65 13 04 88
customersupport.asia@rohde-schwarz.com
China
+86 800 810 82 28 |+86 400 650 58 96
customersupport.china@rohde-schwarz.com
Sustainable product design
PAD-T-M: 3573.7380.02/02.04/EN/
R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG;
Trade names are trademarks of the owners.