Two-Dimensional Signal Quality Monitoring For Spoofing ......dimensional (2D) time-frequency analyses have been implemented to enhance spoofing detection performance and reliability

NAVITEC2016, ESA/ESTEC, Noordwijk, 14-16 Dec. 2016 Page 1 of 12

Two-Dimensional Signal Quality Monitoring For Spoofing Detection

NAVITEC 2016

14-16 December 2016

ESA/ESTEC, Noordwijk, The Netherlands

Ali Pirsiavash (1)

, Ali Broumandan (1)

and Gérard Lachapelle (1)

(1) PLAN group

Schulich School of Engineering, University of Calgary, 2500 University Dr, NW, Calgary, Canada

Email: {ali.pirsiavash, abrouman, lachapel}@ucalgary.ca

Abstract: Signal quality monitoring (SQM) techniques are investigated to detect spoofing attacks on GNSS signals. Two-

dimensional (2D) time-frequency analyses have been implemented to enhance spoofing detection performance and reliability.

After modeling the SQM test metrics in the two domains, statistical analysis is performed to set up a proper detection

threshold for a reliable false alarm probability. Various test scenarios are then investigated to evaluate the proposed method

performance. Results show the advantage and effectiveness of the proposed method in improving the performance of reliable

spoofing detection under various conditions.

INTRODUCTION

Signal Quality Monitoring (SQM) methods are used to detect distortions and anomalies in GNSS signals by utilizing

additional monitoring correlators to recognize abnormally sharp, flat or asymmetric correlation peaks in the tracking

output. References [1-3] performed SQM in real-time reception of GPS signals to detect distorted PRN code waveforms

(evil wave forms - EWF) resulting from a failure of signal generation procedure at the satellites. By exploiting early and

late correlators, SQM metrics such as “Delta” and “Ratio” metrics were defined and investigated to monitor EWF

distortions on the correlation peak. Reference [4] and [5] exploited the concept of combining early-late correlators to

define symmetric and asymmetric criteria in detecting distortion caused by multipath. Recently, SQM methods are

applied to spoofing detection arguing that spoofing signal cause similar anomalies in receiver tracking loops [2]. By

monitoring the outputs of early, late and prompt correlators, [6] applied ratio test metric to detect spoofing attacks. In

this work, after an analysis on the correlation peak distortions, the ratio metric was defined as early plus late divided by

prompt correlator. This metric was then used to identify flat or abnormally sharp correlation peaks resulting from

spoofing attacks. The methodology was based on alerting the target receiver when the test metric exceeds a pre-defined

threshold. Using the phase and magnitude of early and late correlators, [7] used early late phase (ELP) and magnitude

difference (MD) SQM metrics, besides the Delta and Ratio metrics for spoofing detection. Different metrics

performance were compared to detect spoofing attacks in the presence of other sources of errors such as multipath.

Reference [8] employed the ratio test combined with some extra pairs of correlators located 2 and 4 chips forward and

backward of the prompt correlator. These extra correlators, called extra early and extra late correlators, were used to

distinguish spoofing attacks from other irregular interference by detecting unexpected peaks coming in or out of the

authentic correlation peak. Reference [9] investigated spoofing detection techniques based on amplitude analysis of

early, late and prompt correlators as well as extra early and late ones in a vector based tracking receiver. The

distribution of each correlator output in the code delay domain was continuously monitored and an alarm was sent to

the receiver when the distribution considerably differed from that of the authentic signal. Reference [10] and [11] then

developed the concept of using extra early-late test metrics for SQM-based spoofing detection on a tracking receiver.

Reference [12] investigated the effect of different factors on spoofing detection performance using SQM metrics such

as the number of correlators in multi-correlator mode, SNR, etc. Reference [13] worked on evaluating the effect of

interaction between authentic and spoofing signals on correlator outputs of a typical Galileo receiver. Different code

domain based SQM metrics were used to detect a distorted correlation peak during a spoofing attack.

In the literature, all spoofing detection methods have focused on the code-delay (CD) domain. However, as will be seen

in this paper, monitoring in the Doppler frequency (DF) domain improves spoofing detection performance and

reliability. Moreover, it is possible for a spoofer to interfere with the authentic correlation peak in the code or Doppler

domains. Nevertheless, there has not been promising research on spoofing detection using correlator outputs in the

Doppler domain. Motivated by this concept, this paper investigates two-dimensional (2D) spoofing detection on GNSS

signals by incorporating correlator metrics in both the code delay and Doppler frequency domains. The detection

process for each domain has similar complexity since both use an equal number of correlators in their definitions.

Detection performance depends on the spoofing scenario and how the interfering signal disturbs the symmetry of the


authentic correlation peak. Therefore, to improve the performance of reliable spoofing detection under various

scenarios, a 2D-SQM metric is proposed. Simulation results show improved detection reliability at the expense of

doubling complexity for a given probability of false alarm. Following a discussion of different spoofing scenarios, basic

formulations are provided to model correlation properties in both code and Doppler domain. A code-based early-minus-

late metric is defined; the slow-minus-fast metric is introduced for Doppler domain monitoring. A statistical analysis is

also performed to set up a proper detection threshold for a reliable false alarm probability. Various test scenarios are

then investigated to illustrate the necessity and effectiveness of the proposed method to improve the reliability of

correct detection under various conditions.

SPOOFING SCENARIOS

From a receiver point of view, spoofing attacks can be categorized as overlapped and non-overlapped scenarios. A non-

overlapped spoofing attack is not an effective way to mislead a receiver since it can be easily detected by several

detection metrics at the pre-despreading and post-despreading level. These techniques include variance analysis and

monitoring the number of correlator peaks above a pre-defined threshold. A non-overlapped spoofing signal can be

distinguished and removed using successive spoofing cancelation approach developed for spoofing classification and

mitigation [14]. In an overlapped scenario, the correlation peaks of the spoofer and authentic signals interfere with each

other, resulting in distorted correlation peaks. A clear example of this scenario is a receiver-based spoofing attack where

the spoofer can track satellite signals and mimic them to mislead a target receiver. Such a spoofer can generate a low

power fake correlation peak (for each PRN) with more and less aligned code delay and Doppler frequency with respect

to the authentic peak; the power of the spoofing signal is increase to overcome the GNSS signal and the fake correlation

peak is then dragged to mislead the target receiver [15, 16]. However, when the fake peak comes out of the authentic

one the symmetry of the correlation peak is disturbed. Moreover, due to practical limitations, there are misalignments

between spoofer and receiver in terms of phase, frequency and power resulting in distortions and fluctuations in

overlapped correlation peaks. These fluctuations can be monitored in both code-delay (CD) and Doppler frequency

(DF) domains, which is the main subject discussed herein. In the literature all spoofing detection methods have focused

on code domain. However, as will be shown in this research a spoofer is able to interfere with the authentic correlation

peak in both domains. Therefore, to improve the reliability of spoofing detection in all spoofing cases, a 2D-SQM

approach is investigated herein.

SIGNAL MODEL

The received GNSS signal can be modeled as a combination of digitized signals corresponding to different PRNs as

,(2 ( ) )

1

( ) ( ) ( ) ( )IF d l s l

Lj f f nT

s l l s l l s l fe s

l

r nT C d nT c nT e nT

(1)

where l is the PRN code index, L is the number of satellites, lC is the power of the received signal from the

thl

satellite, ld is the navigation data and

lc is the spreading code used to modulate the navigation data; l , ,d lf and

l

are code delay, Doppler frequency and carrier phase introduced by the communication channel; IFf is the IF frequency

and 1/s sf T is sampling frequency. ( )fe snT is front-end complex zero mean Gaussian noise. For each PRN a

reference tracking correlator multiplies the received signal by a corresponding PRN replica and the samples are

integrated over a coherent integration time period. The output of the thl channel at the

thk coherent integration epoch

(time instant skNT ) is given by [17]

1ˆ ˆ(2 ( ) )

( 1)

1ˆ[ ] ( ) ( ) ( ) IF l s l

kNj f f nT

l l s s l s l

n k N

y k y kNT r nT c nT eN

(2)

where N is the number of samples in the coherent integration process. Using the sum of geometric series, (2) can be

rewritten as [17]

0 02 1 10

0

0

sin( )( ) ( ) ( )

sin( )

sj f k N Ts

s s

s

f NTy kNT CdR e kNT

N f T

(3)


where the index l , which refers to the thl PRN, is omitted for simplicity. For BPSK signaling [17],

0

0

0

0

1 ,

( )

0,

c

c

c

for TTR

for T

(4)

0ˆ,

0ˆ

df f f and 0

ˆ are code, frequency and phase offsets between the received and the replica

signal generated by the reference tracking correlator. cT is the chip duration and

sNT is the coherent integration time

which is also noted byIT . consists of noise and residual cross correlation terms with approximately zero-mean

Gaussian in-phase (I) and quadrature-phase (Q) components. The in-phase component of the tracking correlator output

is

0

0 0 0 0 0 0

0

sin( , ) Re ( ) cos 1

sin

s I I I

s s k f

s

f NTI f y kNT CR f N T CR R f

N f T

(5)

where 0 02 1k sf k NT . I is the in-phase zero-mean Gaussian noise whose variance is approximately

2

0 0 / 2 IN T (see Appendix A). The effect of binary data is neglected for the sake of simplicity. Neglecting the effect

of phase offset, (5) shows that the correlation output in the code domain (where the frequency offset0f is assumed to

be constant) is a symmetric triangular function of code offset 0 whose width is 2

cT . In the DF domain, (where the

code offset 0 is considered constant), the envelope of the correlation output is a symmetric Sinc function of

frequency offset 0f whose main lobe has a 2 / IT bandwidth. These two domains and their corresponding symmetric

properties is used in the discussion in the sequel.

SQM METRICS

Two types of correlators are taken into account to define SQM metrics. First is the reference or tracking correlators

whose corresponding code, Doppler and phase offsets at the thk integration epoch, noted by

0 , 0f and k . These

parameters are a function of the receiver tracking performance. Second is the monitoring correlators whose outputs are

defined based on their code and Doppler distance from the reference tracking correlators. The in-phase output of the thi

monitoring correlator can be defined as

, 0 0,i i

ic b i c

I

bI I c T f

T

(6)

where i cc T and /i Ib T denotes the spacing of the monitoring correlator from the reference prompt (determined by

tracking correlators). Moreover, as a part of monitoring definition, in the case of a non-zero relative frequency offset

between the monitoring and prompt correlators (for example when 0ib is assumed to create the so-called fast or slow

correlators), the phase of each monitoring correlator is aligned with the reference prompt at each integration epoch. This

consideration prevents the relative phase (between prompt and the monitoring correlator) from being accumulated over

time, required for robust monitoring.

SQM Metrics in Code Delay Domain

These algorithms monitor the correlation peak in the code delay domain. Amongst all, a conventional Delta metric is

usually considered in SQM techniques due to its theoretical and practical simplicity [1-4]. The Delta metric is a

symmetric indicator designed to detect asymmetric correlation peaks. This SQM test statistic is defined based on the

difference of either in-phase or absolute value of early minus late correlator outputs which could be normalized by the

prompt correlator or not. In a non-coherent receiver, combination of two I and Q branches (i.e. absolute term) can be

exploited for signal monitoring [8, 18]. However, combining the I and Q correlators by summing their squared values


introduces a squaring loss which makes it noisier and less sensitive [19]. Herein, the I branch is considered and the

performance of the detection system is evaluated over coherent intervals when the receiver is in the PLL state. The in-

phase Delta metric in code delay domain is defined as

,0 ,0 0 0 0 0, ,i i

cd

i c c i c i cm I I I c T f I c T f (7)

Under clean data, when tracking loops are locked and the received signal is tracked in PLL mode, the code, frequency

and phase offsets between received signal and the replica, generated by the reference tracking correlator, can be

approximated around zero (0 0, , 0kf ). Therefore, (7) is rewritten as

,0 ,0,0 ,0i i

cd I I

i i c i c i c i c c cm I c T I c T C R c T R c T (8)

Since .R is symmetric under clean data assumption, (8) reduces to

,0 ,0i i

cd I I

i c cm (9)

which is a zero-mean random variable whose variance is a function of 2

0 ( 2

0 0 / 2 IN T ) and the correlator spacing.

In this work, different correlator spacings are considered for distancesid between symmetric early and late correlators of

0.4, 1.4, 2, 4 chips. 2id and 4 are considered as too early/late correlators to distinguish spoofing signal from other

sources of correlation distortion such as multipath [8-10].

SQM in Doppler Frequency Domain

As discussed before, a spoofing signal can also impose distorting effects on Doppler frequency, which is not effectively

detectable using CD-SQM metrics. In this case, test metrics can be defined and performed on the DF domain to

improve the reliability and probability of spoofing detection. To this end, correlators can be considered with faster and

slower Doppler shifts with respect to the reference prompt correlator. By the same methodology introduced in CD-

SQM, the DF-SQM metric can be defined as the difference of slow-minus-fast correlator outputs as

0 0 0 00, 0,, / , /

i i

df

i i I i Ib bm I I I f b T I f b T

(10)

Under clean data when the received signal is tracked by locked delay and frequency loops (0 0, , 0kf ), one

obtains

0, 0,0, / 0, / / /i i

df I I I I

i i I i I f i I f i I b bm I b T I b T C R b T R b T (11)

Assuming tracking a clean data set, the monitoring slow and fast correlators 0k , .I

fR constitutes a symmetric

function resulting in

0, 0,i i

df I I

i b bm (12)

which is a zero-mean random variable whose variance is a function of 2

0 and the correlator spacing. Exploiting the

absolute terms of correlator outputs instead of the real values is another approach to monitor the quality of the

correlation peak. Table 1 summarizes the test metrics considered here for both domains.

Table 1. CD and DF-SQM Metrics

Code Delay (CD) Domain Doppler Frequency (DF) Domain

1 0.2,0 0.2,0

cdm I I 3 1,0 1,0

cdm I I 1 0, 0.2 0, 0.2

dfm I I 3 0, 1 0, 1

dfm I I

2 0.7,0 0.7,0

cdm I I 4 2,0 2,0

cdm I I 2 0, 0.7 0, 0.7

dfm I I 4 0, 2 0, 2

dfm I I


STATISTICAL ANALYSIS OF SQM METRICS

GNSS spoofing detection can be considered as a general maximizing procedure of likelihood ratio by setting an

appropriate threshold for each PRN [13]. In order to set an appropriate detection threshold statistical behavior of

detection metrics under clean data should be analyzed. According to (5), the first and second order statistics of in-phase

outputs for the thi correlator are defined as follows:

,c bi i

I

i c f ijICR c T R f

(13)

,

2 2

0 0 / 2c bi i

IIN T (14)

The covariance between two in-phase outputs of monitoring correlator thi and

thj is also calculated as

, ,

2 0

0,

sin( )( ) ( ) cos( ( 1) )

2 sin( )c b c bi i j j

ij sI

ij f ij ij ij sI II ij s

f NTNR R f R f N T

T N f T

(15)

where ij and ijf are the delay and Doppler difference between the two in-phase correlators (Proof in Appendix A).

According to (7) and (10), CD and DF-SQM metrics are the differences between two correlated normal random

variables. Therefore, in both domains, the SQM metrics are normally distributed as [20]

,0 ,0 ,0 ,0 ,0 ,0

2 2 2 2 2

0,( , ), 0, 2 2 1 2cd cd cd cd

i i i c c i c c c ci i i i i i

cd

i i cm m m I I m I I I Im N R c T

(16)

With the same methodology the SQM metrics statistics in the DF domain become

0, 0, 0, 0, 0, 0,

2 2 2 2 2

0,( , ), 0, 2 2 1 2cd cd cd df

i i i ib b b b b bi i i i i i

df i

i fm m m I I I I I ImI

bm N R

T

(17)

Having the mean and variance of SQM, the appropriate threshold can be calculated for a given probability of false

alarm. However, the statistical moments are calculated here based on theoretical analysis with simplifying

approximations and assumptions. Therefore, the metric statistics and consequently detection threshold should be

calibrated based on practical observations. By setting the appropriate threshold, the SQM metrics can be exploited to

detect distorted correlation peaks caused by the spoofer. In practical applications, there are other factors that may affect

the variance of SQM metrics. For instance, if the receiver tracking procedure is distorted for any reason (e.g. high

acceleration), it may affect the performance of the SQM metrics and cause false alarms. In addition, when SQM is used

as a spoofing detector, multipath may affect performance. Therefore, in monitoring the quality of GNSS signals, in

addition to the theoretical analysis, the expected values and detection thresholds should be tuned based on the quality of

tracking operation, the purpose of detection and site-dependent factors and environmental conditions.

TEST SCENARIO AND DATA ANALYSIS

The effectiveness of the proposed method was examined by performing SQM tests on different spoofing scenarios. In

order to generate a spoofing signal, authentic data was collected with a LOS antenna, down-converted and sampled

using a National Instrument (NI) sampling front-end. The authentic signals were then acquired and tracked in a software

receiver and the spoofing signals were generated mimicking collected authentic Doppler frequency, code delay,

amplitude of authentic signals and other parameters. The block diagram of data collection and spoofing generation is

shown in Fig. 1. A spoofing attack was generated on the PRN 3 L1 C/A signal. For the first seven seconds, only the

authentic signal was acquired and tracked by the receiver. The coherent integration time was 20 ms. Fig. 2 shows the

probability of false alarms for CD, DF and 2D-SQM metrics. The theoretical variances for the SQM metrics were

extracted based on estimated noise variance using (16) and (17). These parameters were then calibrated by the observed

clean data set (first 7 s). The detection threshold for each case was set to twice that of the clean data standard deviation.

The probability of false alarm was then calculated as the number of epochs by which the metric outputs exceeds the

threshold, divided by their total number in the clean data set. 2D-SQM was also considered as the combination of two

approaches. As seen in Fig. 2, the false alarm probabilities for CD and DF-SQM metrics are close to the theoretical


false alarm probability for a normal distribution, which is about 0.05. The false alarm probability of 2D-SQM is slightly

higher than that of other SQM metrics based on the inclusion-exclusion principle [20]. At t = 7 s, a spoofing signal with

a 3 dB power advantage and almost aligned code delay, Doppler frequency and phase offset was added to the authentic

signal. The spoofing signal deviated from the authentic correlation peak in three different scenarios as discussed below.

Fixed Code Spoofing Scenario

In this scenario, the spoofer deviated from the Doppler domain by changing the relative Doppler frequency linearly

from 0 to 154 Hz over 60 s according to Fig. 3. During the spoofing attack, the relative code delay remained

approximately zero to evaluate the effect of spoofing on DF-SQM metrics. Fig. 4 shows C/N0 and Doppler

measurements values for epochs when the receiver operated in PLL mode. Before the spoofing attack, the receiver was

tracking authentic signals with a C/N0 value of about 48 dB-Hz. When the spoofer interfered with the authentic

correlation peak at 7 s, the receiver lost its carrier tracking lock. The spoofer took control of tracking loops due to its

dominant power and increased C/N0 values by about 3 dB. During the spoofing attack, the C/N0 metric had also some

fluctuations due to interaction of the spoofing and authentic signals. Doppler measurements, shown in Fig. 4b, also

show that the receiver was spoofed where its trend was changed after the spoofing attack from a downward tendency to

an upward one. During the spoofing attack, the symmetry of the correlation peak was disturbed by the spoofer and

resulted in fluctuations in monitoring metrics. Because the deviation occurred in the Doppler domain, more fluctuations

were expected in the DF metrics rather than the CD ones. To test this, the SQM metric outputs were evaluated in both

domains. For better comparison, each metric output was normalized by its standard deviation extracted from the

corresponding clean data set. Fig. 5 shows the SQM metric outputs for the epochs where the receiver was in PLL mode.

During the spoofing attack, the DF-SQM metrics fluctuated while the CD-SQM metrics were not affected. One general

observation is that for DF-SQM metrics with monitoring correlators located on the main lobe of the Sinc function,

wider correlator spacing results in larger SQM variation envelopes. One reason for this is that the correlator with larger

spacing has a steeper slope that is more sensitive to correlation peak distortion (Compare Fig. 5a, 5b and 5c for different

correlator spacings). For the correlators located on the nulls of the Sinc function (Fig. 5c and 5d), the magnitude of the

variation envelopes for CD and DF metrics is almost the same due to the equal correlator slopes.

Fig. 1. Spoofing generation procedure Fig. 2. Probability of False Alarm for SQM metrics

Fig. 3. Relative code delay and Doppler Frequency over spoofing time period – fixed code spoofing scenario


Fig. 4. C/N0 and Doppler measurements for fixed code spoofing scenario

Fig. 5. Comparison between CD and DF-SQM metrics for the fixed code spoofing scenario for various SQM metrics

Fixed Doppler Spoofing Scenario

In this scenario, the spoofer deviated from the code domain by changing the relative delay linearly from 0 to 3.7 chips

during 60 s according to Fig. 6. During the spoofing attack, the relative phase and Doppler values of spoofing and

authentic signals were zero to evaluate the effect of spoofing on CD-SQM metrics. During the spoofing attack, the

receiver remained in PLL mode for almost all epochs. Fig. 7 shows estimated C/N0 values for this scenario. Before the

spoofing attack, the C/N0 values were about 48 dB-Hz. As shown, the maximum C/N0 variation occurred at 7 s from

the beginning of the data set; then, C/N0 value variations and means decreased as the spoofer and authentic signals

separated from each other. In this spoofing scenario as shown in Fig. 8, the CD-SQM metric outputs have deviated from

their nominal values while the DF-SQM metric outputs were not affected significantly. In general, spoofing signals

affect tracking correlators, which in turn affect the SQM metric outputs. In other words, the monitoring correlators are

defined based on their distance from the prompt determined by tracking correlators in the DLL structure, which can be

biased due to the spoofing attack. Therefore, the variation profile of SMQ metrics depends on both monitoring and

tracking correlator spacing.


Fig. 6. Relative code delay and Doppler Frequency over

the spoofing time period, fixed Doppler spoofing

scenario

Fig. 7. C/N0 Metric for fixed Doppler spoofing scenario

Fig. 8. Comparison between CD and DF-SQM metrics for fixed Doppler spoofing scenario

Consistent Spoofing Scenario

In this scenario, the spoofer changed the relative Doppler frequency linearly from 0 to 154 Hz during the spoofing

attack. The relative code Doppler was then generated consistent with the corresponding carrier Doppler using a second

order polynomial according to Fig. 9. Fig. 10 shows C/N0 and Doppler measurements verifying the fact that the receiver

was spoofed. When the spoofer was added to the authentic correlation peak at 7 s, the receiver lost phase lock for about

10 s. At 17 s, the receiver started to operate in PLL mode tracking spoofing signals and the C/N0 values increased by 3

dB (Fig. 10a). During the spoofing attack, the C/N0 metric had also some variations due to the interaction of authentic

and spoofing signals. Doppler measurements also show that the receiver was spoofed where its trend changed after the

spoofing attack. Fig. 11 shows the CD and DF-SQM metric outputs over time. Since the deviation occurred in both

domains, fluctuations are observable in both. Note that all figures only show the epochs where the receiver operated in

PLL mode. Herein, in addition to the location of the monitoring correlators and tracking parameters, the variation

magnitude and profile of the SQM metric outputs were affected by relative spoofer-authentic signals parameters. For

instance, consider the SQM metric 4 with 2 chips spacing between monitoring correlators and prompt on each side of

the CD domain and a 100 Hz Doppler distance on each side of the DF domain. When the relative code delay and

Doppler frequency between spoofer and authentic signal reached the aforementioned spacing values, two correlation

peaks were fairly separated from each other in two domains and consequently the SQM metrics were less affected by

deviating signals (Fig. 11d).


Fig. 9. Relative code delay and Doppler Frequency over spoofing time period – consistent spoofing scenario

Fig. 10. C/N0 and Doppler measurement for consistent spoofing scenario

Fig. 11. Comparison between CD and DF-SQM metrics for consistent spoofing scenario

The probability of threshold excess was considered as a metric to quantify and evaluate the detection performance. To

this end, the number of epochs the metric outputs exceeded a pre-defined threshold was counted and divided by the total

number of epochs during the spoofing interval. For the sake of simplicity, the entire 60 s of spoofing attack (7 s < t < 67

s) was considered as the effective spoofing interval. The probability of false alarm was also calculated during a clean

data set. The receiver operating characteristic (ROC) was plotted in Fig. 12 as the probability of threshold excess versus

the false alarm probability. This figure compares different SQM metric ROC in the CD and DF domain for all three

spoofing scenarios. As expected, for a defined false alarm probability, in the fixed code spoofing scenario and for all

metrics, the DF-SQM exceeded the detection threshold with a higher probability compared to CD-SQM (Fig. 12a). In

the fixed Doppler scenario, CD-SQM resulted in a higher performance compared to the other approach (Fig. 12b) while

in the consistent scenario; both approaches had similar and complementary performance (Fig. 12c). 2D-SQM was also

considered in Fig. 12. Comparing all scenarios, it can be concluded that to improve the reliability of correct detection,

2D-SQM can be used effectively in all cases at the cost of twice the complexity.


Fig. 12. Receiver operating characteristic (ROC) for different SQM metrics and different spoofing scenarios

Note that in Fig. 12, the numbers have been calculated based on a rough assumption of the effective spoofing interval.

Although this figure provides an illustrative comparison of CD and DF-SQM approaches, to compare different metrics,

the probability of detection should be investigated based on Monte Carlo analysis of different definitions of detector

(alternate hypothesis) and effective spoofing intervals. Moreover, the variation profile could be analyzed as a function

of different factors like correlator spacing, receiver tracking parameters and spoofing speed and patterns. These topics

will be investigated in future.

CONCLUSIONS AND FUTURE WORKS

A two-dimensional (2D) signal quality monitoring (SQM) method was developed. The conventional code-delay (CD)

SQM was compared with the proposed DF-SQM performed in the Doppler frequency domain. Both methods have

similar complexity since both use an equal number of correlators in their definitions. Three different spoofing scenarios,

namely fixed code, fixed Doppler and consistent scenarios were considered. The outcomes show that the spoofing

detection performance is different for the CD and DF SQM approaches depending on the spoofing scenario. Therefore,

to improve the performance of reliable correct detection in all cases, a 2D-SQM as the combination of two approaches

can be implemented. Data analysis shows a higher probability of threshold excess for 2D-SQM at the cost of twice the

complexity and a slightly higher false alarm probability. The performance of the proposed 2D-SQM can be further

investigated as a function of correlator spacing, receiver tracking parameters and other parameters. This technique is

also applicable to other sources of correlation distortion such as multipath.

REFERENCES

[1] A. Mitelman, R. E. Phelts, D. Akos, S. Pullen, and P. Enge, “A Real-time Signal Quality Monitor for GPS Augmentation Systems,” In Proceedings of ION GPS 2000, Salt Lake City, UT, 19-22 September 2000, pp. 862-871.

[2] R. E. Phelts, D. M. Akos, and P. Enge, “Robust Signal Quality Monitoring and Detection of Evil Waveforms,” In Proceedings of ION GPS 2000, Salt Lake City, UT, 19-22 September 2000, pp. 1180-1190.

[3] R. E. Phelts, T. Walter, and P. Enge, “Toward Real-time SQM for WAAS: Improved Detection Techniques,” In Proceedings of ION GPS/GNSS 2003, Portland, OR, 9-12 September, 2003, pp. 2739-2749.

[4] M. Irsigler, Multipath Propagation, Mitigation and Monitoring in the Light of Galileo and the Modernized GPS, PhD Thesis, Bundeswehr University Munich, Germany, 2008.


[5] M. Fantino, A. Molino, P. Mulassano, M. Nicola, and M. Rao, “Signal Quality Monitoring: Correlation Mask Based on Ratio Test Metrics for Multipath Detection,” In the Proc. of International Global Navigation Satellite Systems Society, IGNSS Symposium, Surfers Paradise, Australia, December 2009, paper 79.

[6] A. Cavaleri, B. Motella, M. Pini, and M. Fantino, “Detection of Spoofed GPS Signals at Code and Carrier Tracking Level,” In Proceedings of Satellite Navigation Technologies and European Workshop on GNSS Signals and Signal Processing, Noordwijk, Netherlands, 8-10 December 2010, 6 pages.

[7] K. Wesson, D. Shepard, J. Bhatti, and T. Humphreys, “An Evaluation of the Vestigial Signal Defence for Civil GPS Anti-spoofing,” In Proceedings of the ION GNSS 2011, Portland, OR, 21–23 September 2011, 11 pages.

[8] M. Pini, M. Fantino, A. Cavaleri, S. Ugazio, and L. Presti, “Signal Quality Monitoring Applied to Spoofing Detection,” In Proceedings ION GNSS 2011, Portland, OR, 20-23 September 2011, pp. 1888–1896.

[9] A. Jafarnia-Jahromi, T. Lin, A. Broumandan, J. Nielsen, and G. Lachapelle, “Detection and Mitigation of Spoofing Attacks on a Vector-Based Tracking GPS Receiver,” ION ITM 2012, Newport Beach, CA, 30 January - 1 February 2012, pp. 790–800.

[10] M. T. Gamba, B. Motella, and M. Pini, “Statistical Test Applied to Detect Distortions of GNSS Signals” In International Conference on Localization and GNSS (ICL-GNSS), Turin, Italy, 25-27 June 2013, pp. 1-6.

[11] E. G. Manfredini, F. Dovis, and B. Motella, “Validation of a Signal Quality Monitoring Technique over a Set of Spoofed Scenarios” NAVITEC 2014, Noordwijk, The Netherlands, December 2014, pp. 1-7.

[12] Y. Yang, H. Li, and M. Lu, “Performance Assessment of Signal Quality Monitoring Based GNSS Spoofing Detection Techniques,” In China Satellite Navigation Conference (CSNC) 2015 Proceedings, Springer Berlin Heidelberg, 2015. vol. 1, pp. 783-793.

[13] A. Jafarnia-Jahromi, A. Broumandan, S. Daneshmand, G. Lachapelle, and Rigas T. Ioannides, “Galileo Signal Authenticity Verification Using Signal Quality Monitoring Methods,” International Conference on Localization and GNSS (ICL-GNSS), Barcelona, Spain, 28-30 June 2016, 8 pages.

[14] A. Broumandan, A. Jafarnia-Jahromi, S. Daneshmand, and G. Lachapelle, “Overview of Spatial Processing Approaches for GNSS Structural Interference Detection and Mitigation,” In Proceedings of the IEEE104, 2016, no. 6, pp. 1246-1257.

[15] P. Y. Montgomery, T. E. Humphreysand, and B. M. Ledvina, “Receiver-autonomous Spoofing Detection: Experimental Results of a Multi-antenna Receiver Defense against a Portable Civil GPS Spoofer,” In Proceedings of the ION International Technical Meeting, Anaheim, CA, 26-28 January 2009, pp. 124-130.

[16] M. L. Psiaki and T. E. Humphreys, “GNSS spoofing and detection,” In Proceedings of the IEEE, 2016, vol. 104, issue: 6, pp 1258-1270,.

[17] A. Jafarnia-Jahromi, GNSS Signal Authenticity Verification in the Presence of Structural Interference, PhD Thesis, September 2013, Department of Geomatics Engineering, University of Calgary, Calgary, Canada.

[18] J. Huang, L. Lo Presti, B. Motella, and M. Pini, “GNSS Spoofing Detection: Theoretical Analysis and Performance of the Ratio Test Metric in Open Sky,” ICT Express 2, no. 1, pp. 37-40, 2016.

[19] M. A. Fortin, Robustness Techniques For Global Navigation Satellite Systems (GNSS) Receivers, PhD Thesis, , November 2015, École de technologie supérieure (ÉTS), Montreal, Quebec, Canada.

[20] A. Papoulis and S. U. Pillai, Probability, random variables, and stochastic processes, Tata McGraw-Hill Europe, 4

th edition, 2002.

APPENDIX A: COVARIANCE BETWEEN MONITORING CORRELATOR OUTPUTS

The complex noise component of a typical correlator before summation operation (accumulator) can be considered

as a discrete random variable/process ,i ic b as

, , , , ,( ) (0), ( ), ..., (( 1) )i i i i i i i i i i

T

c b s c b c b c b c bnT Ts n Ts η (A.1)

Based on the definition of the monitoring correlator, if the phase of each monitoring correlator is aligned with the

reference prompt correlator at each integration epoch, the noise output after accumulator can be modeled as follows:

, , , , ,

1 1 1 1(0) ( ) ... (( 1) ) , [ , , ..., ]

i i i i i i i i i ic b c b c b c b c bTs n TsN N N N

Aη A (A.2)

Therefore, the covariance between correlator thi and thj can be calculated based on the law of error propagation as

, , , ,

, , , , , ,, ,I Ii i j j i i j j i i j jc b c bj c b c bi i j i i j j

T T TT T T

c b c b c b c b c b c bc E E E

η η

Aη η A A η η A AC A (A.3)

http://www.ismb.it/en/biblio?f%5bauthor%5d=12



http://ieeexplore.ieee.org/xpl/tocresult.jsp?isnumber=7471392

https://en.wikipedia.org/wiki/Montreal

https://en.wikipedia.org/wiki/Quebec

https://en.wikipedia.org/wiki/Canada


, ,

, ,

, ,

,

, ,

(0) (0) 0 0

0 (1) (1) 0

0 0 ( 1) ( 1)

i i j j

i i j j

c b c bi i j j

i i j j

c b c b

c b c b

c b c b

E

E

E N N

η ηC (A.4)

, ,

1

, ,2,0

1( ) ( )

i i j jc b c bji i j

N

c b c b

n

c E n nN

(A.5)

Since the accumulator is a low pass filter, it passes the low frequency components. The covariance of two correlator

outputs can be rewritten as

, ,

1( )2

, ,2,0

1ˆ ˆ( ) ( ) ( ) ij s

c b c bji i j

Nj f nT

fe s k s k i k s k j

n

c E nT c nT c nT eN

(A.6)

where , ,ˆ ˆ

ij k i k jf f f is the frequency difference correlators thi and

thj . Because

( )

, ,ˆ ˆ( ) ( ) ij sj f nT

k s k i k s k jc nT c nT e

is deterministic, (A.6) can be rewritten as

, ,

1( )2

, ,2,0

1ˆ ˆ( ) ( ) ( ) ij s

c b c bji i j

Nj f nT

fe s k s k i k s k j

n

c E nT c nT c nT eN

(A.7)

2( )fe sE nT is the variance of sampled front-end noise equal to 0 / 2 sN T :

, ,

1( )0

, ,2,0

ˆ ˆ( ) ( )2

ij s

c b c bji i j

Nj f nT

k s k i k s k j

ns

Nc c nT c nT e

T N

(A.8)

Using the sum of geometric series, (A.8) can be calculated as

, ,

( 1)0

,

sin( )( )

2 sin( )

ij s

c b c bji i j

j f N Tij s

ij

I ij s

f NTNc R e

T N f T

(A.9)

where , ,ˆ ˆ

ij k i k j . Note that in (A.9), the in-phase component relates to the covariance of two I (or Q) branches

and the quadrature phase component means the covariance between I and Q branches of correlators thi and

thj as

follows:

, , , ,

0

, ,

sin( )( ) cos( ( 1) )

2 sin( )I I Q Qc b c bj c b c bji i j i i j

ij s

ij ij s

I ij s

f NTNc c R f N T

T N f T

(A.10)

, ,

0

,

sin( )( ) sin( ( 1) )

2 sin( )QI

c b c bji i j

ij s

ij ij s

I ij s

f NTNc R f N T

T N f T

(A.11)

From the above equations, the variance of each in-phase or quadrature phase output (noise) can be calculated by setting

0ii and 0iif :

, ,

2 2 200

2I Qc b c bi i i i

I

N

T (A.12)

Documents

Two-Dimensional Signal Quality Monitoring For Spoofing ......dimensional (2D) time-frequency analyses have been implemented to enhance spoofing detection performance and reliability