search

RUB-SysSec / DroneSecurity

DroneSecurity (NDSS 2023)
GNU Affero General Public License v3.0
944 stars 173 forks source link

DroneID Packet duration #25

Open SpongeBobaa opened 7 months ago

SpongeBobaa commented 7 months ago

Regarding the experimental results of my DJI Mavic Air 2, I continuously monitored the spectrum for more than ten minutes and did not seem to find a suitable DroneID burst signal. I have some thoughts below.

In your paper, it was mentioned that the DroneID data packet is broadcasted every 640ms, but the actual data frame is only 648 μs. Despite its high transmit frequency and bandwidth of 15.36MHz, it is approximately 600 μs of the duration makes it difficult to detect such signals in the spectrum. Is my analysis correct?

I also tried to record signals within a certain frequency band, such as (5755MHz-5805MHz), with a sampling bandwidth of 50M, but I was unable to successfully detect the corresponding DroneID signal.

Do you have any good suggestions?

nschllr commented 7 months ago

Hi,

Despite its high transmit frequency and bandwidth of 15.36MHz, it is approximately 600 μs of the duration makes it difficult to detect such signals in the spectrum. Is my analysis correct?

Correct, if you look manually into such a recording it might be hard to spot one of the packets if they are sent on the same band as the downlink. if you have a receiver which cannot record the entire band (e.g. 2.4Ghz) the packets might also are on an other band outside your recorded frequency.

You can try to set a fixed frequency range in the settings of the drone, so that it only uses the 2.4GHz band.

SpongeBobaa commented 7 months ago

Thanks for your reply

From what I have learned, the burst signal of DroneID is not a fixed frequency, it may be constantly changing, and the working channel of DroneID signal is separate from the image transmission and remote control channels. I can fix the transmission frequency of the drone, but how do I fix the frequency of the DroneID signal?

I did not detect the signal, so I am unable to determine the frequency of the DroneID burst signal.

SpongeBobaa commented 7 months ago

Will the DroneID signal be sent as soon as the drone starts running? Whether indoors or outdoors.

SpongeBobaa commented 7 months ago

I think I should have found some burst signals for DroneID. Is the data frame in the following graph correct?

DroneID_1

nschllr commented 7 months ago

From what I have learned, the burst signal of DroneID is not a fixed frequency, it may be constantly changing, and the working channel of DroneID signal is separate from the image transmission and remote control channels. I can fix the transmission frequency of the drone, but how do I fix the frequency of the DroneID signal?

Correct, the DroneID transmission changes its bands like the downlink, if there are some interference. But limiting the frequency range on the drone, also lowers your search space for the DroneID transmission.

I think I should have found some burst signals for DroneID. Is the data frame in the following graph correct?

Yes