Aerospace and Electronic Systems Magazine August 2017 - 72

An Approach to Detect GNSS Spoofing

Figure 8.

SQM metric outputs for the entire DS3.

Figure 9.

Data collection environments (GoogleMaps).

case. However, as shown in Figure 7(b) the SQM metric outputs
exceed the threshold almost in most parts of the data for the long
multipath scenario.
Figure 8 shows the SQM outputs for the entire DS3 data
(spoofing attack starts at t = 120 s) for various PRNs. As shown
at epoch t = 120, when the spoofer starts to deviate its correlation
peaks from the authentic ones, the SQM metrics are not affected.
The spoofing remains undetected for about 30 s. As shown in
Figure 8 different PRNs have different detection times, with PRN
6 having the fastest detection time of 30 s from the start of the
spoofing attack. One possible reason for the difference in spoofing detection times of different PRNs is due to the different Doppler difference values between the spoofing and the authentic signals. As shown in Figure 8 the SQM metric is not sensitive when
the authentic spoofing delay difference is short, which was also
observed in the short-delay multipath case of Figure 7. In practical GNSS applications, short-range multipath mostly perturbs
typical GNSS signals, which does not affect SQM metrics. By
increasing multipath distance, the multipath signal power fades
away and becomes ineffective. However, for a high power spoofer to be effective, it should gradually take control of correlation
peaks and eventually take it out of the authentic signals to avoid
possible interaction between authentic and spoofing signals. The
spoofing signals should sweep away the entire delay range (one
chip) of an authentic signal, thereby increasing the chance of de72

tection with SQM metrics in the spoofing case. Another feature
that can be used to separate spoofing from multipath distortion is
the number of affected PRNs.

MEASUREMENT RESULTS
One of the main differentiating factors between spoofing and
multipath signals is the status of the predespreading metrics. In
the previous section, it was shown that in typical multipath environments the predespreading spoofing detection metrics, namely
time/spectral analysis and SPCA, are not affected whereas in a
spoofing scenario the metrics exceed the predefined threshold.
This is justified since in typical multipath environments only
some of the authentic signals are affected by low power multipath
signals and some of the satellite signals are blocked by surrounding obstructions. As a result, the total signal power does not increase compared with the open sky clean data set. To validate this
assumption, some GNSS signal sets at L1 band were collected in
various locations in Calgary. Data collection environments are
shown in Figure 9. The first and last data sets were collected in
open sky conditions in an empty parking lot and serve as clean
reference data sets. Another 13 data sets were collected in various
suburban, urban, and downtown locations. A NovAtel 702 GG

IEEE A&E SYSTEMS MAGAZINE

AUGUST 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine August 2017