Aerospace and Electronic Systems Magazine August 2017 - 68

An Approach to Detect GNSS Spoofing
Table 1.

Summary of Spoofing Detection Metrics
Detector

Effectiveness

Complexity

AGC/Var

High power interference

Low, available in most receivers, predespreading

PSD

High power jammer

Low-Medium, implementation at the predespreading
stage

SPCA

Cyclo-stationarity signal structure

Medium, needs modification to current receiver
architecture at predespreading stage

C/N0

All types of interference

Available and effective metric in postdespreading

SQM

Correlation distortion

Low, already available in some receivers

Note: PSD is power spectral density.

Table 2.

Spoofing Detection Architecture
Case

Var

SPCA

SQM

C/N0

Status

Clean data

CW/Noise

Chirp/ nonoverlapped
spoofing

0/1

Multipath

0/1

Overlappedspoofing

a receiver is proposed for classification, as summarized in Table 2.
In this paper the C/N0 metric detects spoofing signals if C/N0 values
pass a predefined threshold. Here it is assumed that the detection
threshold of each metric is calculated based on statistics of the clean
data set and intersection of different metrics outputs results in reduced probability of false alarm. In Table 2, 1 and 0 define whether
the test statistic value for each metric is above the threshold or not.
In case 1 none of the metrics detect abnormal activities, hence the
receiver is operating with clean data. In case 2 the interference detection flag based on variance analysis is set. However, the SPCA
and SQM metrics are not affected. In this case, the receiver is most
probably affected by a CW or a wideband noise jammer. It should
be noted that in the presence of all types of interfering signals, C/
N0 values are affected. In the presence of CW, noise, and chirp jammers, the C/N0 values decrease and hence do not affect the C/N0
metric proposed for the spoofing detection method that detects a
spoofing attack if C/N0 is above the nominal GNSS signal level
near ground. However, constructive and destructive multipath and
spoofing signals may increase C/N0 values and raise the spoofing
flag. Case 3 considers a scenario where the variance and SPCA
metric values are set whereas the SQM and C/N0 metrics are not
affected. This case resembles the chirp jammer or a nonoverlapped
spoofing attack. In the nonoverlapped spoofing attack, since there
is no interaction between authentic and spoofing correlation peaks,
68

the SQM metrics are not affected. A possible approach to classify
chirp jammers from nonoverlapped matched-power spoofing signals is to search in the cross-ambiguity function for extra correlation peaks above the acquisition threshold. Case 4 considers multipath scenarios where the constructive and destructive effect of a
multipath signal with the desired signal raises the SQM and C/N0
detection flags. Case 5 correctly detects a spoofing attack when all
the detection flags are raised.
The above procedure is one of many possible approaches to
correctly identify spoofing signals. Other spoofing and interference scenarios and detection metrics can be added to this table. In
the following sections real and simulated data are used to evaluate
the performance of the proposed strategy.

DATA ANALYSES
The goal of this section is to analyse the sensitivity of various detection metrics in the presence of different interference signals and
to validate the proposed method summarized in Table 2 for correct
spoofing detection. In order to detect a spoofing event, all detection
metrics discussed beforehand should be triggered. In this regard, data
set 3 (DS3) of the TEXBAT was utilized [25] as baseline. This data
set is a complex baseband data sampled at 25 mega samples per seconds with a 16-bit quantization. DS3 represents the matched power
spoofing scenario where the mean power of spoofing PRNs is 1.3
dB higher than that of the authentic signals. Matched power spoofing attacks are potentially more difficult to detect by received signal
strength spoofing detection methods since considerable C/N0 variations might not be detected for spoofed PRNs. The first 120 s of this
data set is clean (only authentic signal) and a spoofing attack starts
after that. The performance of the detection metrics in the presence of
interfering signals, namely wideband noise, CW interference, chirp,
multipath, and spoofing, are considered here. The GNSS signal affected by spoofing interference for data analysis in the rest of this paper refers to that part of DS3 that is contaminated by spoofing (after
120 s from the beginning of DS3). The clean data set refers to the first
120 s of DS3. To generate interference signals, a dedicated interference software simulator generated various interference signals and
added those to the clean part of DS3. For instance, to analyze the
effect of CW on the detection metrics CW samples were generated

IEEE A&E SYSTEMS MAGAZINE

AUGUST 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine August 2017