GNSS repeater detection based on channel difference

Abstract

GNSS spoofing, generated by a repeater, is very similar to a true navigation signal, and is not easy to be detected. The statistical properties between satellite channel and spoofing channel are different. Motivated by this fact, we propose a GNSS spoofing detection method based on this difference. Assuming the repeater is located on the ground, the jamming channel is a Rayleigh channel. Navigation satellite channel can be modeled as a Lutz model, which has the “good” and “bad” states. These two states follow the Rice distribution and Rayleigh-Lognormal distribution, respectively. Three kinds of goodness-of-fit tests are applied to detect the GNSS spoofing and their performances are compared. Finally, the effectiveness of the proposed method is verified by simulations.

Keywords

Satellite navigation spoofing detection satellite channel model goodness-of-fit test

1. Introduction

Spoofing always happens when the repeater transmits a jamming signal which is very similar to a true navigation signal, thus the navigation receiver will miss the accurate navigation and position. Due to the weak satellite signal power and fully open civil code, the satellite signal is very easy to be jammed and deceived [1]. As far as a GNSS receiver is concerned, how to detect the presence of a spoofer and to realize in time that it has been deceived becomes a major issue in the research area of satellite communication systems. The existing satellite spoofing detection solutions can be classified into two categories: one is based on one or more of the regular parameters, including the carrier to noise ratio, the clock offset, the message encryption and authentication, etc. [2, 3, 4]; the other is dependent on auxiliary equipment, such as auxiliary antenna, reference receiver, inertial navigation system and so on [5, 6, 7]. However, the existing researches pay no attention to the statistical difference between the satellite channel and jamming channel. In case that the repeater is located on the ground, although the spoofing is realized to the same as the true navigation signal in terms of the information code, the spread spectrum code, the carrier frequency, etc. still shows a big difference between the statistical characteristics of jamming channel and the satellite navigation channel. This paper firstly proposes the GNSS repeater detection method based on the channel difference. To the best of the authors’ knowledge, this method has never been studied by existing publications.

The satellite navigation channel can be described by a Lutz model [8], which uses standards such as “good” and “bad” to denote the channel states between satellite and receiver on earth. In the “good” state, the satellite signal has direct component, which follows Rice distribution. And in the “bad” state, since no direct component exists, the satellite signal follows the combination of Rayleigh distribution and Lognormal distribution. We assume the jamming signal comes from a repeater located somewhere on the earth near the GNSS receiver without a line-of-sight (LOS) channel, so it has no direct component, and its envelope follows Rayleigh distribution. Accordingly the envelopes of satellite and jamming signals have different statistical properties. Based on this difference, meanwhile, considering that the goodness-of-fit test is very useful to detect the different signals with different cumulative distribution functions (CDF), we propose a GNSS spoofing detection method.

2. Channel models

2.1 The Lutz model of satellite channel

When the satellite channel is in the “good” state, only direct component exists and the multipath component is not shaded, so the envelope of the received signal will follow Rice distribution. The Rice distribution contains both direct and multipath components. When only multipath signal components exist, Rice distribution is simplified into Rayleigh distribution. The probability density function (PDF) [9] of Rice distribution is as follows

$\displaystyle f(r)=\frac{r}{\sigma_{1}^{2}}\exp\left(-\frac{r^{2}+z^{2}}{2% \sigma_{1}^{2}}\right)I_{0}\left({\frac{rz}{\sigma_{1}^{2}}}\right)$ (1)

where $\sigma_{1}^{2}$ is the variance of Rice distribution in the “good” state, and $z$ is the direct signal component.

When the satellite channel is in the “bad” state, we assume only multipath components exist and no direct component, meanwhile there exists shadow fading. In such case, the envelope of the received signal follows Rayleigh-Lognormal distribution, the corresponding PDF [9] is

$\displaystyle f(r)=\int_{0}^{\infty}{\frac{1}{u}f_{\textit{Ray}}\left(\frac{r}% {u}\right)f_{\textit{Log}}(u)du}$ (2)

where $f_{\textit{Ray}}(u)$ and $f_{\textit{Log}}(u)$ are Rayleigh distribution and Lognormal distribution, respectively. And their PDFs can be written as

$\displaystyle f_{\textit{Ray}}(u)=\frac{u}{\sigma_{R}^{2}}\exp\left({-\frac{u^% {2}}{2\sigma_{R}^{2}}}\right)$ (3)

and

$\displaystyle f_{\textit{Log}}(u)=\frac{1}{\sqrt{2\pi}\sigma_{L}u}\exp\left[{-% \frac{1}{2}\left({\frac{\ln u-\mu}{\sigma_{L}}}\right)^{2}}\right]$ (4)

where $\sigma_{R}^{2}$ is the variance of Rayleigh distribution, $\mu$ and $\sigma_{L}^{2}$ are the mean value and variance of Lognormal distribution.

2.2 The model of spoofing channel

We assume that the jamming signal comes from the repeater which is located on the ground and there is no LOS channel, thus the jamming channel has no direct component. The envelope of the spoofing signal follows Rayleigh distribution. Rayleigh distribution is a special case of Rice distribution. Its PDF [9] is

$\displaystyle f(r)=\frac{r}{\sigma_{R}^{2}}\exp\left({-\frac{r^{2}}{2\sigma_{R% }^{2}}}\right)$ (5)

where $\sigma_{R}^{2}$ is the variance.

Figure 1.

The flowchart of the goodness-of-fit test.

3. The spoofing detection based on goodness-of-fit test

Goodness-of-fit test is one kind of non-parametric tests, and it is useful to verify whether the overall set belongs to a specific distribution according to some samples. Firstly, a statistical model is chosen when using goodness-of-fit test. Then whether the samples conform to this model will be checked [10]. For the spoofing detection of the satellite navigation system, the detection problem of whether the jamming exists can be converted into a binary detection problem. That is, a spoofing is declared when the statistical distribution of the received samples is consistent with that of the spoofing. Otherwise, no spoofing exists. To solve this binary detection problem, the goodness-of-fit algorithm needs to compute the sample’s theoretical distribution function and empirical distribution function first, and then the test statistic is evaluated. Lastly, the test statistic is compared with a determined threshold to get the result. Figure 1 shows the flowchart of the goodness-of-fit test.

Now, the GNSS proofing detection problem can be presented as the following binary detection problem

$\displaystyle\begin{cases}H_{0}:F_{N}(\bm{x})=F(\bm{x})\\ H_{1}:F_{N}(\bm{x})\neq F(\bm{x})\\ \end{cases}$ (6)

where $H_{0}$ denotes that the empirical distribution of current received samples is equal to the CDF of the spoofing signal, and $H_{1}$ indicates that the empirical distribution of current received samples is not equal to the CDF of the spoofing signal. $F_{N}(x)$ indicates the empirical distribution function and $N$ is the samples’ number. $F(x)$ indicates the theoretical distribution function. Suppose $x_{1},\ldots,x_{N}$ is a set of samples for the overall sample $\bm{x}$ , and $\bm{x}$ obeys the probability distribution of $F(x)$ . Then, the samples are sorted in ascending order to get $x_{{}_{1}}^{\prime}\leqslant x_{2}^{\prime}\leqslant\ldots\leqslant x_{{}_{N}}% ^{\prime}$ . For any $x(-\infty<x<+\infty)$ , the function $F_{N}(x)$ is defined as [11]

$\displaystyle F_{N}(x)=\begin{cases}0,&x<x_{1}^{\prime}\\ {\displaystyle\frac{k}{N}},&x_{k}^{\prime}\leqslant x<x_{k+1}^{\prime},k=1,% \ldots,N-1\\ 1,&x\geqslant x_{N}^{\prime}\\ \end{cases}$ (7)

In Eq. (6), $F_{N}(x)$ is an unbiased estimator of $F(x)$ , and it is called $\bm{x}$ ’s empirical distribution function [12]. It is easy to see that $F_{N}(x)$ is the frequency of occurrence of $\{X\leqslant x\}$ event in $N$ repetitive independent experiments. When the number of experiments is increased, the frequency of the event is stabilized at the probability. When $N\to\infty$ , according to the $W$ . Glivenko theorem, the empirical distribution of the samples is more or less the same as their actual distribution. This theorem reveals the internal relationship between $F(x)$ and $F_{N}(x)$ , i.e., when the sample number is large enough, the maximum difference between them can be very small.

The satellite signal’s envelope follows different probability distribution under different states. However, the envelope of the jamming signal always follows Rayleigh distribution. So we can identify the spoofing by detecting whether the envelope of the received signal obeys Rayleigh distribution. We use cumulative distribution function (CDF) of the jamming signal to denote the theoretic distribution function of the goodness-of-fit test, which can be expressed as

$\displaystyle F(x)=1-\exp\left(-\frac{x^{2}}{2\hat{{\sigma}}_{R}^{2}}\right)$ (8)

where $\hat{{\sigma}}_{R}^{2}=\frac{1}{2N}\sum\nolimits_{i=1}^{N}{x_{i}^{2}}$ is the maximum likelihood estimation of the variance ${\sigma}_{R}^{2}$ of the Rayleigh distribution, and $x_{i}$ is a set of samples for the overall $\bm{x}$ .

Many kinds of goodness-of-fit test methods have been proposed, such as Kolmogorov-Smirnov (i.e. KS) test, Cramer-von Mises (i.e. CVM) test, and Anderson-Darling (i.e. AD) test, etc. [13]. All those methods are based on empirical distribution function. The AD test is the square difference type statistic. Compared with other test methods, it can obtain good performance for small samples. The test statistics of these three detection methods are given below.

3.1 KS test

The statistical definition of KS test [13] is

$\displaystyle D_{N}=\max\left\{{\left|{F(x_{i})-\frac{i-1}{N}}\right|,\left|{F% (x_{i})-\frac{i}{N}}\right|,i=1,2,\ldots,N}\right\}$ (9)

where $N$ is the samples’ number, $i$ is the sample number, and $F(x_{i})$ is the theoretical distribution function.

3.2 CVM test

The statistical definition of CVM test [14] is

$\displaystyle W^{2}=n\int_{-\infty}^{+\infty}{[F_{N}(x)-F(x)]^{2}dF(x)}$ (10)

where $N$ is the samples’ number, $F_{N}(x)$ is the empirical distribution function of $\bm{x}$ and $F(x)$ is the theoretical distribution function of $\bm{x}$ .

Meanwhile, [10] shows that, Eq. (10) can be subsituted by:

$\displaystyle W^{2}=\sum\limits_{{\rm i}=1}^{N}[z_{i}-(2i-1)/2N]^{2}+(1/12N),$ $\displaystyle z_{i}=F(x_{i})$ (11)

3.3 AD test

The statistical definition of AD test [15] is

$\displaystyle A_{N}^{2}=N\int_{-\infty}^{+\infty}[F_{N}(x)-F_{0}(x)]^{2}\frac{% dF_{0}(x)}{F_{0}(x)(1-F_{0}(x))}$ (12)

where $F_{N}(x)$ is the empirical distribution function of $x$ and $F_{0}(X)$ is the theoretical distribution function of $x$ .

In practical applications, since Eq. (12) involves complex computation, the [16] discretes this equation into

$\displaystyle A_{N}^{2}=-\frac{\sum\nolimits_{i=1}^{N}{(2i-1)(\ln z_{i}+\ln(1-% z_{N+1-i}))}}{N}-N,$ $\displaystyle z_{i}=F(x_{i})$ (13)

For the cases with unknown parameters, firstly we need to get the maximum likelihood estimation of parameters.

Figure 2.

The detection performance of three tests in the “good” state.

Figure 3.

The detection performance of three tests in the “good” state.

According to the discussion above, under significant level $\alpha$ , the goodness-of-fit test will accept or reject the original hypothesis $H_{0}$ by comparing three testing statistic $T(D_{N}),T(W^{2}),T(A_{N}^{2})$ and threshold value $\gamma$ respectively. The threshold value $\gamma$ which determines the spoofing is dominated by the following equation

$\displaystyle P_{r}\{T\geqslant\gamma|H_{0}\}=\alpha$ (14)

Based on the discussions above, the spoofing detection algorithm based on goodness-of-fit test includes the following steps:

(1) (1)

Given a false-alarm probability, the threshold value $\gamma$ is calculated according to Eq. (14).

(2)

Samples are sorted from the smallest to the largest, like $x_{1}\leqslant x_{2}\leqslant\ldots\leqslant x_{N}$ .

(3)

The test statistic $T$ is calculated using Eq. (9), (3.2) or (3.3).

(4)

If $T\geqslant\gamma$ , $H_{1}$ is true and the received signal is the real GNSS signal. If $T<\gamma$ , $H_{0}$ is true and accordingly the received signal is the jamming signal.

4. Detection performances

Assuming $A$ is the time percentage of shading, which reflects the user’s state in the communication, then the PDF of the received signal’s envelope $f_{s}(s)=(1-A)f_{s\_\textit{Rice}}(s)+Af_{s\_\textit{Rayl}\_LN}(s)$ is presented as:

$\displaystyle f_{s}(s)=(1-A)f_{s\_\textit{Rice}}(s)+Af_{s\_\textit{Rayl}\_LN}(s)$ (15)

where $p_{d}=(1-A)p_{d,\textit{good}}+Ap_{d,\textit{bad}}$ is the PDF of the received signal’s envelope in the “good” state, and $p_{d}=(1-A)p_{d,\textit{good}}+Ap_{d,bad}$ denotes the PDF in the “bad” state.

Considering Eq. (15) and the deception detection performance under above two states, the overall detection probability is as follows:

$\displaystyle p_{d}=(1-A)p_{d,\textit{good}}+Ap_{d,\textit{{bad}}}$ (16)

where $p_{d,\textit{good}}$ and $p_{d,\textit{bad}}$ denote the detection probabilities in the “good” and “bad” states respectively.

Figure 4.

The detection performance of AD test under different $A$ values.

5. Simulations

For all simulations, the parameters are set as: the noise variance, the samples’ number, , the value of JNR varies from 0 dB to 6 dB, the step is set as 0.5 dB, the false-alarm probability is fixed as $p_{f}=0.01$ , the respective Monte Carlo simulations are executed 10000 times.

Figure 2 shows the detection performance of three methods in the “good” state and same conditions. We observe that the KS test has better performance than other two tests. Its detection probability is higher than CVM test by 6.27%, and higher than AD test by 13.02%. Figure 3 shows the detection performance of three methods in the “bad” state. We can see that KS test is much more efficient than other two tests. Its detection probability is higher than AD test by 3.6%, and higher than CVM test by 8.2%. Meanwhile, we find that in the different sates, when SNR is fixed at 10 dB and jamming-to-noise-ratio (JNR) is set larger than 5 dB, the detection probabilities of all three goodness-of-fit tests are higher than 90%. Figure 4 is the AD test performance under different time percentage of shading $A$ values. We can see that the detection probability grows as the time percentage increases. The detection probability ofis larger than that of by 2.61%, meanwhile, it is higher than that of by 5.09%.

6. Conclusion

According to the statistical difference betweent the satellite channel and the spoofing channel, this paper proposes a novel GNSS repeater detection method by using three kinds of goodness-of-fit tests, which is realized by checking whether the received signal’s envelope follows Rayleigh distribution. The simulation results show that, when SNR is fixed as 10 dB and JNR is larger than 4 dB, all three test methods can achieve the detection probability which is higher than 90%. In the “good” state, the detection probability of KS test is higher than CVM test by 6.27% and higher than AD test by 13.02%. In the “bad” state, the detection probability of KS test is higher than AD test by 3.6% and larger than CVM test by 8.2%. In addition, for AD test, its detection probability increases as the time percentage of shading grows. In practical applications, GNSS receiver can read the state of satellite navigation channel according to the power of current received signal. If it is larger than the threshold value, the state is viewed as “good”. Otherwise, the state is “bad”.

Footnotes

Acknowledgments

This work was supported by the National Science Foundation of China (No. 61271214). And the authors would like to thank the anonymous reviewers very much for their helpful comments and valuable suggestions.

References

Jafarniajahromi

Broumandan

Nielsen

et al., GPS vulnerability to spoofing threats and a review of anti-spoofing techniques, International Journal of Navigation and Observation (2012), 1–14.

Zhang

Trinkle

and Qian

, Quickest detection of GPS spoofing attack, IEEE Military Communications Conference (2012).

Jiang

Zhang

Harding

B.J.

and Makela

J.J.

, Spoofing GPS receiver clock offset of phasor measurement units, IEEE Transactions on Power Systems 28(3) (2013), 3253–3261.

Humphreys

T.E.

, Detection strategy for cryptographic GNSS anti-spoofing, IEEE Transactions on Aerospace and Electronic Systems 49(2) (2013), 1073–1090.

Zhang

Wang

et al., GPS signal anti-jamming based on dual-polarized antenna array, 2011 IEEE International Conference on Signal Processing, Communications and Computing (2011).

Jin

M.H.

Han

Y.H.

Choi

H.H.

et al., GPS spoofing signal detection and compensation method in DGPS reference station, 2011 11th International Conference on Control, Automation and Systems (2011).

Khanafseh

Roshan

Langel

et al., GPS spoofing detection using RAIM with INS coupling, IEEE/ION Position, Location and Navigation Symposium-PLANS (2014).

Lutz

Cygan

Dippold

et al., The land mobile satellite communication channel-recording, statistics, and channel model, IEEE Transactions on Vehicular Technology 40(2) (1991), 375–385.

Xie

and Fang

, A general statistical channel model for mobile satellite systems, IEEE Transactions on Vehicular Technology 49(3) (2000), 744–752.

10.

Azim

A.W.

Khalid

S.S.

and Abrar

, Analysis of modulation classification techniques using goodness of fit testing, 2013 IEEE 9th International Conference on Emerging Technologies (2013).

11.

Anderson

T.W.

and Darling

D.A.

, A test of goodness of fit, Journal of the American Statistical Association 49(268) (1954), 765–769.

12.

Stephens

M.A.

, EDF statistics for goodness of fit and some comparisons, Journal of the American Statistical Association 69(347) (1974), 730–737.

13.

Zhu

Wang

et al., Reduced complexity SNR estimation via Kolmogorov-Smirnov test, IEEE Communications Letters 19(9) (2015), 1568–1571.

14.

Honda

Oka

and Ata

, Signal detection and modulation classification using a goodness of fit test, 2012 International Symposium on Information Theory and Its Applications (2012).

15.

Shen

Wang

Zhang

et al., Blind spectrum sensing for cognitive radio channels with noise uncertainty, IEEE Transaction on Wireless Communication 10(6) (2011), 1721–1724.

16.

Stephens

T.W.

, EDF statistics for goodness of fit and some comparisons, Journal of the American Statistical Association 69(347) (1974), 730–737.