Aerospace and Electronic Systems Magazine August 2017 - 67

Broumandan, Siddakatte, and Lachapelle
where exp(.) represents an exponential function and j is the square
root of -1. Ns represents the number of samples over which the discrete Fourier transform (DFT) is calculated and k ranges from 0 to
Ns - 1. An interference signal would be detected if ΓPSD (subscript
PSD is power spectral density) exceeds a predefined detection
threshold. The detection threshold is assumed to be determined
based on a clean assessment window and a predetermined falsealarm probability.

Structural Power Content Analysis
A low complexity predespreading spoofing detection approach
that takes advantage of the cyclo-stationarity of GNSS signals in
order to detect excessive amount of structured signal power in the
received sample set was introduced in [7]. In this approach, the received raw signal samples are first filtered within the GNSS signal
bandwidth and then multiplied by their one-chip delayed version
in order to remove the effect of Doppler frequency. The resulting signal has a line spectrum since it is generated by multiplication of cyclo-stationary signals. In the next stage, the signal and
noise components are filtered by suitably designed comb filters.
A detection test statistic is calculated based on the filter outputs
and is then compared with a threshold in order to differentiate between the presence and absence of spoofing signals [22]. Since
each PRN signal is received from a different satellite with different
relative dynamics with respect to a user, their corresponding Doppler frequencies are different from each other. Therefore, in order
to concentrate all signal components on the same spectral lines and
facilitate spectral filtering, the Doppler shifts of the signals should
be removed. To this end, the sampled baseband signal components
are first multiplied by the complex conjugate of their one (or more)
chip delayed version. This operation removes the phase rotation
due to the Doppler frequency of received signals. It also removes
the navigation data bits and secondary codes and GNSS subcarriers
that are modulated on each spreading code. SPCA does not need
a clean data set for the spoofing detection threshold calibration.

POSTDESPREADING SPOOFING DETECTION METRICS

Signal Quality Monitoring
The interaction between authentic and spoofing signals causes distortion on the shape of the correlation function. SQM tests focus
on this feature in order to detect any asymmetry and/or abnormally
sharp or elevated correlation peaks due to the presence of undesired signals [21]. This metric is originally designed to monitor the
correlation peak quality affected by multipath signals. One of the
advantages of SQM tests is that they are not highly dependent on
training or a calibration process based on a clean dataset [8]. It is
assumed that the receiver is initially tracking authentic signals. A
symmetric ratio test is implemented to detect a spoofing attack [8].
The theoretical variance of the SQM metric is [11][12]
SQM =

2
=
σ SQM

−d

− I+d

)

I0
1 − R ( 2d )
TcC / N 0

(5)

(6)

where Id is the in-phase value of the correlator output spaced by d
chips from the prompt correlator. The variance of the SQM metric
is a function of C/N0 and should be considered in defining a proper
detection threshold. As mentioned previously, SQM metrics are
originally designed to monitor correlation peak quality. Hence, it
might be challenging to discriminate a spoofing attack from multipath interference by monitoring only one PRN. SQM becomes an
excellent spoofing detection tool in the matched power spoofing
scenario where all PRNs are affected by spoofing. Table 1 summarizes the detection metrics used in this research.

IMPROVING SPOOFING DETECTION PERFORMANCE

Effective C/N0 Analysis
Effective C/N0 analysis is a common signal strength monitoring
metric and is available in most commercial receivers. The effectiveness of this metric towards the classification of an interference
signal is investigated herein. Generally, three terms can affect the
effective C/N0. The first one corresponds to the noise component
due to thermal noise or other interference sources, the second refers to the cross correlation between spoofing signals and authentic
replica, and the third refers to the cross correlation caused by other
authentic signals. The cross-correlation term caused by high power
spoofing signals can become the dominant term, which is directly
proportional to the power level of spoofing signals. This term considerably reduces the effective C/N0 of authentic PRNs and leads
to saturation of spoofing C/N0 values. The upper limit of a GNSS
signal power level is known apriori. Hence, for a given receiver,
an upper limit for the C/N0 value can be defined. The spoofing detection metric based on C/N0 monitoring works based on this fact.
AUGUST 2017

An abnormally high C/N0 value can be an indication of a spoofing
attack. In addition, jamming signals also affect the effective C/N0
values by increasing the noise floor. A constructive multipath signal can cause a C/N0 value to exceed the spoofing detection threshold and result in a false alarm. Hence, this metric should be used in
conjunction with other spoofing detection metrics to reduce false
alarm probability.

Different detection metrics were introduced in the previous sections. All these metrics are effective in detecting spoofing attack.
However they are not individually capable of distinguishing spoofing from other interference sources. For instance, in the presence
of either spoofing or jamming signals, the variance analysis metric
detects additional power content in the GNSS frequency band.
Hence, when a spoofing detection flag using a variance metric is
raised, either a spoofing or jamming attack may have occurred. On
the other hand, other spoofing detection methods including postdespreading techniques detect spoofing attacks when the correlator
outputs deviate from their nominal values. However, the correlator
outputs can be distorted not only by the spoofing attacks but also by
other types of interfering signals such as multipath. This increases
the false-alarm spoofing detection probability. To correctly classify
interfering signals and reduce the false spoofing detection process,
the combination of different metrics at different operation layers of

IEEE A&E SYSTEMS MAGAZINE

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine August 2017