Spoofing Signals Research Articles

Blind Spoofing GNSS Constellation Detection Using a Multi-Antenna Snapshot Receiver.

Spoofing of global navigation satellite system (GNSS) signals threatens positioning systems. A counter-method is to detect the presence of spoofed signals, followed by a warning to the user. In this paper, a multi-antenna snapshot receiver is presented to detect the presence of a spoofing attack. The spatial similarities of the array steering vectors are analyzed, and different metrics are used to establish possible detector functions. These include subset methods, Eigen-decomposition, and clustering algorithms. The results generated within controlled spoofing conditions show that a spoofed constellation of GNSS satellites can be successfully detected. The derived system-level detectors increase performance in comparison to pair-wise methods. A controlled test setup achieved perfect detection; however, in real-world cases, the performance would not be as ideal. Some detection metrics and features for blind spoofing detecting, with an array of antennas, are identified, which opens the field for future advanced multi-detector developments.

Global navigation satellite system spoofing‐detection technique based on the Doppler ripple caused by vertical reciprocating motion

The menace of spoofing is overshadowing the civilian use of the global satellite navigation system. Many anti-spoofing approaches have been intensively researched in the literature, among which the spoofing-detection ones are the most thoroughly investigated. In this study, the authors propose a novel spoofing-detection method, which jointly utilises the carrier Doppler frequency caused by the vertical reciprocating motion of the receiving antenna and the navigational information conveyed by the received signals. This specific motion pattern would make the Doppler measurement of each signal fluctuate like water ripples, of which the amplitude should be proportional to the sine of the corresponding satellite's elevation. Singular value decomposition is deployed to simultaneously estimate the speed variation of the receiving antenna and the relative amplitudes of the Doppler fluctuations. Then, the proportionality between relative amplitudes and the elevation sines is checked to detect the spoofing signal, which would probably break the proportionality. The proposed method is experimentally verified and validated. They also analyse the detection performance both theoretically and numerically. Moreover, several motion deviations are assessed both theoretically and practically.

A GPS Spoofing Generator Using an Open Sourced Vector Tracking-Based Receiver.

Spoofing can seriously threaten the use of the Global Positioning System (GPS) in critical applications such as positioning and navigation of autonomous vehicles. Research into spoofing generation will contribute to assessment of the threat of possible spoofing attacks and help in the development of anti-spoofing methods. However, the recent commercial off-the-shelf (COTS) spoofing generators are expensive and the technology implementation is complicated. To address the above problem and promote the GPS safety-critical applications, a spoofing generator using a vector tracking-based software-defined receiver is proposed in this contribution. The spoofing generator aims to modify the raw signals by cancelling the actual signal component and adding the spoofing signal component. The connections between the spreading code and carrier, and the states of the victim receiver are established through vector tracking. The actual signal can be predicted effectively, and the spoofing signal will be generated with the spoofing trajectory at the same time. The experimental test results show that the spoofing attack signal can effectively mislead the victim receiver to the designed trajectory. Neither the tracking channels nor the positioning observations have abnormal changes during this processing period. The recent anti-spoofing methods cannot detect this internal spoofing easily. The proposed spoofing generator can cover all open-sky satellites with a high quality of concealment. With the superiority of programmability and diversity, it is believed that the proposed method based on an open source software-defined receiver has a great value for anti-spoofing research of different GNSS signals.

GNSS Navigation Threats Management on-Board of Aircraft

This paper proposes low-complexity measures to be deployed on most aircraft to enable the management of Global Navigation Satellite Systems (GNSS) interference, and in particularly of jamming and spoofing threats, in order to reach the Flightpath2050 safety and security targets. It is known that, if there is a jamming interference and GNSS navigation is lost, a disruption will be caused, requiring the likely intervention of Air Traffic Control. Also, the presence of a spoofing signal is a serious security threat with a potentially catastrophic impact on the safety of the aircraft and on any other ground infrastructure. Through our jamming and spoofing detection and localization stages, based on minimal additional infrastructure, we will reduce the time required to detect and localize an interfering source and, therefore, the time required to mitigate it and restore the nominal traffic operations. Our solutions will also improve the safety of the Air Traffic Management system. Moreover, the deployment of our solution, with its capability of localizing an interfering device, could be a deterrent to any agent interested in intentionally generating a jamming or spoofing signal, and so will reduce the likelihood of this type of interference events.

A Two-Stage Interference Suppression Scheme Based on Antenna Array for GNSS Jamming and Spoofing.

Jamming and spoofing are the two main types of intentional interference for global navigation satellite system (GNSS) receivers. Due to the entirely different signal characteristics they have, a few techniques can deal with them simultaneously. This paper proposes a two-stage interference suppression scheme based on antenna arrays, which can detect and mitigate jamming and spoofing before the despreading of GNSS receivers. First, a subspace projection was adopted to eliminate the high-power jamming signals. The output signal is still a multi-dimensional vector so that the spatial processing technique can be used in the next stage. Then, the cyclostationarity of GNSS signals were fully excavated to reduce or even remove the noise component in the spatial correlation matrix. Thus, the signal subspace, including information of the power and the directions-of-arrival (DOAs) of the GNSS signals, can be obtained. Next, a novel cyclic correlation eigenvalue test (CCET) algorithm was proposed to detect the presence of a spoofing attack, and the cyclic music signal classification (Cyclic MUSIC) algorithm was employed to estimate the DOAs of all the navigation signals. Finally, this study employed a subspace projection again to eliminate the spoofing signals and provide a higher gain for authentic satellite signals through beamforming. All the operations were performed on the raw digital baseband signal so that they did not introduce additional computational complexity to the GNSS receiver. The simulation results show that the proposed scheme not only suppresses jamming and spoofing effectively but also maximizes the power of the authentic signals. Nonetheless, the estimated DOA of spoofing signals may be helpful for the interference source positioning in some applications.

Spoofing Mitigation Using Double Stationary Wavelet Transform in Civil GPS Receivers

In this paper, the Wavelet Transform (WT) is used to eliminate the influence of spoofing on the stationary Global Positioning System (GPS) receivers. Having no access to the authentic data, signal processing is only applied to the received spoofing signals. Pseudo-range is one of the most important influenced parameters under spoofing attack. Therefore, by reducing its deviations, spoofing reduction is possible. In this way, the pseudo-range difference between two observations is passed to the Statistic Wavelet Transform (SWT) at the first level. By de-noising in the next step and omission of noise, pseudo-range deviations due to a spoofing attack can be extracted. After that, measured pseudo-range of received signal is corrected. In the next step, the SWT is applied to the position coordinates. In this point, other irrational deviations because of spoofing threat can be compensated. For validation of the suggested algorithm, four different data sets are investigated. By applying bior 3.7 at level 3 and rbio 4.4 at level 9 as the first and the second WT respectively, we could mitigate spoofing more than 81% within a tolerance of 10% and an average of 86%. The test results show that the proposed technique supremely improves the performance of the GPS receiver and attenuates the effects of spoofing.

GPS Multireceiver Joint Direct Time Estimation and Spoofer Localization

We propose a novel algorithm for the joint estimation of spoofer location (LS) and GPS time using multireceiver direct time estimation (MRDTE). To achieve this, we utilize the geometry and known positions of multiple static GPS receivers distributed within the power substation. The direct time estimation computes the most likely clock parameters by evaluating a range of multipeak vector correlations, each of which is constructed via different pregenerated clock candidates. Next, we compare the time-delayed similarity in the identified peaks across the receivers to detect and distinguish the spoofing signals. Later, we localize the spoofer and estimate the GPS time using our joint particle and Kalman filter. Furthermore, we characterize the probability of spoofing detection and false alarm using Neyman Pearson decision rule. Later, we formulate the theoretical Cramér Rao lower bound for estimating the localization accuracy of the spoofer. We validate the robustness of our LS-MRDTE by subjecting the authentic open-sky GPS signals to various simulated spoofing attack scenarios. Our experimental results demonstrate precise localization of the spoofer while simultaneously estimating the GPS time to within the accuracy specified by the power community (IEEE C37.118 standard for synchrophasors).

Correction of Phasor Measurements Independent of Transmission Line Parameters

Phase angle measurements from phasor measurement unit (PMU) data are sensitive to several issues, such as timing error, global positioning system (GPS) signal spoofing attack, transducer sensitivities and latency, and phasor computation algorithms. In some applications, highly accurate phase angle values are essential. In this paper, two methods are developed for correcting the phase angle difference (PAD) between the PMUs at both ends of a line. The method is based on the assumption that the line parameters are unchanged during the measurement period. The proposed scheme does not require knowing the parameters of the transmission line connecting the two PMUs, and uses multi-point measurements to estimate possible PAD bias. An additional benefit of the methods is that the parameters of the transmission line can also be calculated.

Dual-antenna GNSS spoofing detection method based on Doppler frequency difference of arrival

Recent years have witnessed the emergence of portable global navigation satellite spoofing devices. A variety of anti-spoofing techniques have been dedicated to detecting the presence of spoofing signals, most of which solely utilize either signal characteristics or navigational information. However, since the GNSS system is under continuous monitoring and control, there is a subtle consistency between the signal and the navigational information in authentic GNSS signals, which the spoofing signal can hardly counterfeit. Here, we present a new dual-antenna spoofing detection technique based on this consistency. The essence of this method is the precise estimations of the frequency difference of arrival between a pair of fixed antennas from both the carrier phase observations and the navigational information. When there is no spoofing signal, the observation should be consistent with the prediction. Otherwise, spoofing signals would probably break the consistency because of the geometric and motion discrepancies between GNSS satellites and the spoofing device(s). Theoretically, since the proposed method does not make any presumptions about the spoofer, it can detect moving spoofers and multi-antenna spoofers. We analyze the optimal detection method in three different situations, and the corresponding detection performances are both theoretically and numerically investigated. We also intensively conduct experiments with various configurations to prove the detection capabilities against various spoofing techniques and strategies.

A Combined Antijamming and Antispoofing Algorithm for GPS Arrays

The Global Positioning System (GPS), with its accurate positioning and timing information, has become a commonly used navigation instrument for many applications. However, it is susceptible to intentional interference such as jamming and spoofing. The conventional antijamming GPS receiver fails to work in a combined jamming and spoofing attack scenario. To solve the problem, a combined antijamming and antispoofing algorithm for a GPS receiver based on an antenna array is proposed. In this method, the jamming is eliminated by subspace projection, and then a compressed sensing framework is adopted to obtain the direction of arrival (DOA) of the despreading satellite navigation signal and detect the spoofing signal. According to the DOA of the authentic and spoofing signals, the receiver uses adaptive multibeamforming to concurrently achieve the undistorted reception of the authentic satellite signal and the suppression of the spoofing. We analyse three aspects of algorithmic performance: the antenna array direction diagram, the spoofing detection and the acquisition results. The simulation results and their analysis preliminarily show that the proposed method can detect and suppress GPS jamming and spoofing effectively.

Multi-peak and power cooperative detection algorithm to detect forwarded spoofing interference signals of BOC modulation receivers

In this paper, the multi-peak and power cooperative detection algorithm is proposed to detect forwarded spoofing interference signals of satellite navigation BOC modulation receivers without considering suppression interference. The theoretical value and the simulation value of the ROC curve of the multi-peak and power cooperative detection algorithm can be obtained by the numerical calculation and the experimental simulation. It can be seen from the simulation that with the increase of the number of accumulations after the receiver correlation value and the power intensity of the spoofing signal relative to the real signal, the detection probability of the proposed algorithm is higher. When the power of the spoofing signal is 3 dB greater than that of the real signal, the detection probability can be more than 90% under the condition that the false alarm probability is 5%. While when the power of the spoofing signal is 4 dB greater than that of the real signal, the detection probability can be more than 95% under the condition that the false alarm probability is 0.7%. Given that it only needs to add the module to the software receiver to detect spoofing signals, the algorithm proposed in this paper is of practical significance.

Spoofing Attack Results Determination in Code Domain Using a Spoofing Process Equation.

When a user receiver is tracking an authentic signal, a spoofing signal can be transmitted to the user antenna. The question is under what conditions does the tracking point of the receiver move from the authentic signal to the spoofing signal? In this study, we develop a spoofing process equation (SPE) that can be used to calculate the tracking point of the delay lock loop (DLL) at regular chip intervals for the entire spoofing process. The condition for a successful spoofing signal is analyzed using the SPE. To derive the SPE, parameters, such as the signal strength, sweep velocity, loop filter order, and DLL bandwidth are considered. The success or failure of a spoofing attack is determined for a specific spoofing signal using the SPE. In addition, a correlation between each parameter for a successful spoofing attack could be obtained through the SPE. The simulation results show that the SPE performance is largely consistent with that of general DLL methods, even though the computational load of SPE is very low.

Speech spoofing countermeasures based on source voice analysis and machine learning techniques

Automatic speaker verification (ASV) [7] systems are susceptible to malicious attacks. It discredit the performance of a standard ASV system by increasing its false acceptance rates. This paper presents a new countermeasure for the protection of automatic speaker verification systems from spoofed signals. The new countermeasure is based on the analysis of a sequence of acoustic feature vectors using the glottal inverse filtering. In the proposed method, speech is decomposed into a glottal source signal and model the vocal tract filter through glottal inverse filtering. The IAIF desriptors are constructed and are used as features. Support Vector Machines (SVM) classifier and Extreme learning machine (ELM) are used to classify the obtained features as genuine or spoofed. It is hoped that the proposed method can help to detect the genuine speech from the spoofed one.

Toward a spoof-tolerant PMU network architecture

Formulation of and solution to an architecture design/upgrade problem for a PMU network overlaid on a transmission circuit are presented. The design/upgrade aims to cost-effectively enhance the phasor observability of the transmission circuit in the face of GPS signal spoofing attacks on the PMU network. Synchrophasor availability, defined at each bus as the fraction of time on average its voltage synchrophasor is correctly present for real-time usage, now takes into account of possible altered phasor data caused by spoofing, in addition to loss of PMU data caused by communication interruptions considered in our previous work. Achieved synchrophasor availability profiles of a PMU network constructed with and without imposing a spoofing-tolerant criterion for the 68-bus test system are compared to reveal the cost and benefit of spoofing-tolerance. The tolerance sought is achieved through two new developments. (1) Stochastic models for computing synchrophasor availability as a part of the network design/upgrade algorithm now include event arrival rates associated with spoofing induced data alteration and data recovery at every PMU node. (2) A practicable and scalable real-time isolation scheme is proposed using detection consensus of the neighboring partitions of a suspected PMU in a normally observable transmission circuit. Upon isolation of a spoofed PMU, its real-time function is accommodated through inference using analytic redundancy provided by a partial circuit model bordered by some intact neighboring PMUs. Detection, isolation, and inference are tested on the 68-bus system and shown guaranteed success for any single spoofed PMUs. Though promising test results are observed for simultaneous spoofing attacks on multiple PMUs, more cost-effective isolation and inference schemes are desirable.

Formation Algorithms and Properties of Binary Quasi-Orthogonal Code Sequence of Modern Satellite Systems

Increased number of threats to user interface of navigation signals, mainly in the form of suppression of navigation signals by jamming as well as navigation signal spoofing by false signals, assumes development of counter measures including improvement of structure security of navigation signals on the basis of stochastic use of code sequences which are ranging codes. This article proves the required number of unique discrete code sequences which can improve structure security of navigation signal in global navigation satellite system upon their stochastic use. Properties of discrete quasi-orthogonal code sequences are estimated which are used and proposed for use in global navigation satellite systems with channel code division, they are compared with optimum values of code balancing, number of element series and lower bounds of maximum lateral peaks of aperiodic auto-correlation function and maximum peaks of aperiodic mutual-correlation function. The experimental results show that the minimum values of the considered correlation functions of discrete quasi-orthogonal code sequences of known global navigation satellite systems exceed the lower bound by 3–6 times. The performances of code balancing and element series of discrete quasi-orthogonal code sequences of the known global navigation satellite systems satisfy in average the allowable intervals. The number of source lines of discrete quasi-orthogonal code sequences of the known global navigation satellite systems is significantly lower than their umber required for improvement of structure security of navigation signal based on their stochastic use. On the basis of the revealed drawbacks of the known discrete quasi-orthogonal code sequences, the necessity to develop new methods is substantiated allowing to obtain their required number together with statistic properties comparable with the best values of discrete quasi-orthogonal code sequences applied as navigation signals in global navigation satellite systems.

Efficient spoofing identification using baseline vector information of multiple receivers

In a spoofing environment, a Global Navigation Satellite System (GNSS) receiver must employ anti-spoofing techniques for obtaining a normal navigation solution from the GNSS signal. We propose a new method for identifying spoofing signals using the norm of the difference of baseline vectors (NDB) obtained from multiple receivers. The main focuses of this research are to reduce the initial time required to identify the spoofing signal and to mitigate the physical constraints on multiple antennas placement. First, the multi-correlators of each receiver track both GNSS and spoofing signals simultaneously and classify them into two signal groups. Then, the baseline vectors are generated from the double-differenced carrier phase measurements of the classified signal groups, and the NDB is calculated. If the target positions of the spoofing signal groups are almost the same, the NDB has a fairly small value when the base position of the selected baseline vectors is calculated from one of the GNSS groups and the rover positions of the baseline vectors are calculated from each spoofing group of the multiple receivers. Using the NDB, a hypothesis is established, and a hypothesis test is conducted for identifying the spoofing signal. The performance of the proposed test statistics is analyzed with respect to the distance between the GPS antennas and the tuning parameter. Our experimental results show that the proposed method effectively performs spoofing identification with a short baseline. Additionally, the method exhibits a very low probability of fault detection and fast response time. This means that the immediate anti-spoofing can work properly in spoofing environments.

Low‐complexity GNSS anti‐spoofing technique based on Doppler frequency difference monitoring

Single-antenna global navigation satellite system (GNSS) spoofing, where all spoofing signals are broadcast by the same antenna, is a great threat to mass market location-based services. This study proposes an anti-spoofing technique based on Doppler frequency difference (DFD) monitoring against single-antenna spoofing, which requires only a standalone receiver with a single antenna. When the receiver moves randomly, the DFD between two authentic satellite signals is non-linear in time domain, whereas between two single-antenna spoofing signals is linear. This study deduces the DFD model and converts the problem of spoofing detection into a sequence linearity detection problem. The hypothesis based on DFD is given, and the statistic is constructed by the method of sequence block processing. This technique has low complexity because it only requires the knowledge of the Doppler frequency without additional information. The detection performance is verified by simulations and real data experiments. The simulation results show that the detection probability can exceed 99.99% easily at 0.001% false alarm probability when the receiver's motion state changes sufficiently. The real data experiments show that the proposed technique can effectively detect GNSS spoofing and distinguish spoofing signals from authentic signals.

A New Approach to Estimate True Position of Unmanned Aerial Vehicles in an INS/GPS Integration System in GPS Spoofing Attack Conditions

This paper presents a new approach to estimate the true position of an unmanned aerial vehicle (UAV) in the conditions of spoofing attacks on global positioning system (GPS) receivers. This approach consists of two phases, the spoofing detection phase which is accomplished by hypothesis test and the trajectory estimation phase which is carried out by applying the adapted particle filters to the integrated inertial navigation system (INS) and GPS. Due to nonlinearity and unfavorable impacts of spoofing signals on GPS receivers, deviation in position calculation is modeled as a cumulative uniform error. This paper also presents a procedure of applying adapted particle swarm optimization filter (PSOF) to the INS/GPS integration system as an estimator to compensate spoofing attacks. Due to memory based nature of PSOF and benefits of each particle’s experiences, application of PSOF algorithm in the INS/GPS integration system leads to more precise positioning compared with general particle filter (PF) and adaptive unscented particle filer (AUPF) in the GPS spoofing attack scenarios. Simulation results show that the adapted PSOF algorithm is more reliable and accurate in estimating the true position of UAV in the condition of spoofing attacks. The validation of the proposed method is done by root mean square error (RMSE) test.

Satellite Spoofing Identification Method Based on Radio Frequency Feature Extraction

The interference and spoofing for satellite navigation systems pose great challenges to the safety of satellite communications. Radio fingerprint based physical layer security technique is an effective approach to solve these problems. According to the characteristics of satellite communication, this paper presents a spatial radio fingerprint extraction method based on constellation figure. The K-mean clustering algorithm is adopted to extract the radio fingerprint features related to the spatial distribution characteristics of satellites from constellation figure to identify the spoofing signals. From theoretical analysis, the spatial RF fingerprint features are extracted from the actual satellite signal and the spoofing identification is achieved based on the forged signals generated by the universal software radio peripheral (USRP) to verify the validity and practicality of the proposed method. The proposed method can identify spoofing targets without demodulating the satellite signal and can be used alone or in combination with existing spoofing target identification methods to increase the recognition rate.

Combating the Control Signal Spoofing Attack in UAV Systems

Unmanned aerial vehicle (UAV) system is vulnerable to the control signal spoofing attack due to the openness of the wireless communications. In this correspondence, a physical layer approach is proposed to combat the control signal spoofing attack, i.e,. to determine whether the received control signal packet is from the ground control station (GCS) or a potential malicious attacker (MA), which does not need to share any secret key. We consider the worst case where the UAV does not have any prior knowledge about the MA. Utilizing the channel feature of the angles of arrival, the distance-based path loss, and the Rician-$\kappa$ factor, we construct a generalized log-likelihood radio (GLLR) test framework to handle the problem. Accurate approximations of the false alarm and successful detection rate are provided to efficiently evaluate the performance.