How to Detect and Prevent GNSS Spoofing on Commercial Drones

Commercial drones rely on GNSS (GPS, GLONASS, Galileo, BeiDou) for positioning, navigation, and flight safety. But what happens when the signals your drone trusts are fake? GNSS spoofing is a sophisticated attack where false satellite signals are broadcast to trick a drone’s receiver into believing it is somewhere it is not — or that it is at a different altitude, speed, or time. This article explains how spoofing works, how to detect it, and how GNSS spoofing protection for drones using Septentrio’s AIM+ technology stops these attacks before they compromise your mission.

What Is GNSS Spoofing and How Is It Different from Jamming?

GNSS jamming overwhelms the receiver with noise, causing loss of lock. It is crude but easy to detect — the drone simply loses positioning. Spoofing is far more insidious. Instead of denying the signal, spoofing provides a false signal that the receiver locks onto as legitimate. The drone’s flight controller sees a “valid” position fix, velocity, and time — all of them fabricated by the attacker. A drone under spoofing will not drop into failsafe mode or return-to-home because it believes nothing is wrong. It simply follows the fake coordinates the attacker provides. This makes spoofing the primary threat for commercial UAV operations in sensitive environments such as powerline inspection, perimeter security, and critical infrastructure monitoring.

The technical mechanism involves a software-defined radio (SDR) generating civil GNSS signals at slightly higher power than the real satellites. By gradually increasing the false signal’s power and aligning it with real satellite timing, the attacker can “pull” the receiver off the real constellation without triggering a loss-of-lock event. The victim drone’s receiver transitions seamlessly from real to fake. Once locked to the spoofer, the attacker controls the drone’s reported position completely.

Why Commercial Drones Are Vulnerable to GNSS Spoofing

Most commercial drone platforms — including DJI, Autel, and Skydio — use civilian-grade GNSS receivers that were designed for consumer and prosumer use. These receivers lack:

• Authentication: Civil GPS signals have no cryptographic authentication (unlike the military P(Y) code). Any SDR can generate a valid-looking civil GPS L1 C/A signal.
• Spoofing detection: Consumer receivers do not monitor signal health metrics like AGC levels, signal power consistency, or cross-correlation anomalies.
• RAIM/FDE: Receiver Autonomous Integrity Monitoring and Fault Detection & Exclusion are rare in drone-grade GNSS modules.
• Multi-frequency diversity: Most drones use L1-only receivers, making them trivially spoofable with a single-band attack.

DJI’s AeroScope and GEO systems address geofencing and remote ID — not GNSS signal integrity. A determined attacker with an SDR (HackRF, USRP, or BladeRF) and open-source spoofing software can carry out a spoofing attack for under $500 of hardware.

How Septentrio AIM+ Detects and Mitigates GNSS Spoofing

Eview’s anti-jamming and anti-spoofing GNSS receivers are built on Septentrio’s AIM+ technology, which applies a multi-layered defense against both jamming and spoofing. AIM+ does not merely reject interference — it actively identifies, classifies, and mitigates threats at the signal-processing level.

1. Signal-Quality Monitoring (SQM)

AIM+ continuously monitors correlation-peak shape, carrier-to-noise density (C/N0) ratios, and code-carrier divergence on every tracked satellite. Spoofed signals produce correlation peaks that are narrower, noisier, or offset from the expected shape. SQM flags these anomalies in real time and alerts the flight controller before the spoofer can pull the receiver off the real signal. This detection occurs within milliseconds of the spoofer’s signal crossing the threshold.

2. Multi-Constellation, Multi-Frequency Comparison

AIM+ tracks GPS L1/L5, Galileo E1/E5a/E5b, GLONASS L1/L2, and BeiDou B1I/B2I simultaneously. A spoofer almost never replicates all constellations and all frequencies coherently. By cross-checking position solutions across independent frequency bands, AIM+ detects inconsistencies that indicate a spoofing attack. For example, if GPS L1 gives a position 200 meters from Galileo E1 while all other metrics are “normal,” the receiver knows something is wrong.

3. RAIM with Advanced Fault Detection and Exclusion

Eview’s GNSS receiver box implements Septentrio’s Receiver Autonomous Integrity Monitoring (RAIM) with Fault Detection and Exclusion (FDE). When the receiver detects that a subset of satellites is reporting inconsistent measurements, it excludes the faulty signals and computes the position using only the trusted constellation. This means a drone equipped with AIM+ can continue operating with full positioning accuracy even under an active spoofing attack — the receiver simply drops the fake signals and keeps flying on the real ones.

4. AGC and Front-End Monitoring

Spoofing attacks require broadcasting at elevated power to overcome the real satellite signals. AIM+ monitors the Automatic Gain Control (AGC) value in the RF front end. A sudden jump in AGC — without a corresponding change in antenna environment — is a strong indicator of spoofing or jamming. The receiver logs the event and can trigger a user-defined alert action.

Integrating Anti-Spoofing GNSS with DJI and Other Drone Platforms

Eview’s drone RTK GNSS solutions are designed for seamless integration with DJI Matrice, Mavic Enterprise, Autel EVO, and custom UAV platforms. The external anti-spoofing GNSS receiver communicates with the drone’s flight controller over a standard serial or Ethernet link, providing clean, authenticated RTK corrections and position data. The drone’s internal GNSS is either supplemented or replaced by the Eview receiver, which handles all interference detection and signal authentication.

For operators already using DJI drones for critical infrastructure monitoring, integrating an external anti-spoofing receiver is a practical field upgrade. No firmware modification of the drone is required — the receiver outputs standard NMEA and RTCM messages that any flight controller understands.

Practical Steps for Detecting GNSS Spoofing in the Field

Even without dedicated anti-spoofing hardware, drone operators can watch for these red flags:

• Position jumps without velocity change: If the drone reports a sudden 100-meter shift in position while airspeed is 0, spoofing is likely.
• Unusual time offsets: GPS time drift of more than one second relative to the internal RTC suggests a spoofing attack.
• Constant C/N0 across all satellites: Real GNSS signals show 6–10 dB variation between high- and low-elevation satellites. A spoofer broadcasting all signals at uniform power eliminates this natural variation.
• Loss of RTK corrections while base and rover are stationary: If the RTK fix drops without movement, interference or spoofing may be present.
• Fewer satellites than expected: A spoofer only transmits a limited satellite set (often 8–12 PRNs). If the receiver normally tracks 16+ but suddenly drops to 10, investigate.

Advanced operators can integrate a secondary independent GNSS receiver (such as a u-blox ZED-F9P) and cross-verify position solutions. Any persistent offset beyond 10 meters between the two receivers while both report “fixed” status is a strong spoofing indicator.

Why AIM+ Is the Gold Standard for Drone Anti-Spoofing

Septentrio’s AIM+ delivers 40–60 dB of interference rejection, compared to approximately 25 dB for typical u-blox or consumer-grade GNSS chipsets. This 15–35 dB margin is the difference between a drone that loses lock in a congested RF environment and one that continues positioning even when a spoofer is transmitting at close range. For UAV operations where GNSS reliability is mission-critical — powerline surveys, mining stockpile measurements, construction site mapping — AIM+-equipped receivers are the only practical defense against spoofing.

Additionally, AIM+ is firmware-upgradeable. As new spoofing techniques emerge, Septentrio releases updated detection algorithms that can be deployed in the field without replacing hardware. This future-proofs the investment for fleet operators managing dozens of drones across multiple sites.

Frequently Asked Questions

Need GNSS spoofing protection for your drone fleet? Contact Eview GNSS for technical specifications and integration support for your UAV platform.