A Network-based GNSS Structural Interference Detection,

Classification and Source Localization

Ali Broumandan, Ali Jafarnia-Jahromi, Saeed Daneshmand, Grard Lachapelle
Position, Location and Navigation (PLAN) Group
http://plan.geomatics.ucalgary.ca
Department of Geomatics Engineering
Schulich School of Engineering
University of Calgary
[email protected]

BIOGRAPHY process. This paper proposes a network-based anti-

spoofing receiver architecture that uses spatially
Ali Broumandan received his Ph.D. degree in the distributed receivers (operating within a radius of few
Geomatics Engineering from the University of Calgary. kms) connected to a Central Authenticity Verification
Since November 2013, he is working in the PLAN Group (CAV) unit. The essence of this method is that the CAV
as a senior research associate where his research focuses unit receives simultaneous measurements from adjacent
on GNSS interference mitigation utilizing single and receivers and detects a spoofing attack, classifies
multiple antenna processing. He has been involved in authentic and spoofing signals based on the measurements
several industrial research projects focusing on received and then localizes the spoofer source. Practical
spatial/temporal GNSS signal processing. consideration and limitation factors have been discussed.
Some experimental results are provided to demonstrate
Ali Jafarnia Jahromi received his Ph.D. in Geomatics the applicability of the proposed method.
Engineering from the University of Calgary in 2013. He
holds B.Sc. and M.Sc. degrees in Telecommunications
INTRODUCTION
Engineering. He is currently working as a Senior
A spoofing attack utilizing a set of synthesized GNSS
Research Associate/Post-Doctoral Fellow in the PLAN
signals is an effective way to provide fake position
Group. His research interests include signal processing in
estimates to a target receiver (Humphreys et al 2008).
GNSS applications, statistical signal processing and
Work on anti-spoofing methods has mainly focused on
receiver design.
specific features of spoofing signals that can separate
them from the authentic ones. In many practical spoofing
Saeed Daneshmand holds a Ph.D. degree in Geomatics
attacks, a spoofer generates multiple fake GNSS signals
Engineering from the University of Calgary. Since May
that provide a consistent navigation solution. Spoofing
2013 he has been a senior research associate/post-doctoral
signals are usually transmitted from a single antenna,
fellow in the PLAN Group. His research interests are in
therefore they all experience the same distortion (e.g.
the area of software receivers and signal processing for
attenuation, and multipath) due to the propagation channel
GNSS.
and thus are spatially correlated. This feature is used in
some research work to discriminate spoofing from the
Grard Lachapelle, Professor Emeritus, has been
spatially distributed authentic signals. McDowell (2007)
involved in a multitude of GNSS R&D projects since
and Montgomery et al (2009) have taken advantage of
1980, ranging from RTK positioning to indoor location
multiple GNSS antennas to detect spoofing PRNs based
and signal processing enhancements, first in industry and
on monitoring the phase difference between different
since 1988, at the University of Calgary
antenna elements. Nielsen et al (2011) have used the
pairwise correlation between different PRNs received by
ABSTRACT a moving receiver as a mean of detecting the spoofing
GNSS receivers are highly susceptible to structural signals being transmitted from a common direction.
interference sources such as spoofing and meaconing. Jafarnia et al (2013) have proposed a method based on
Recent spoofing detection and mitigation methods are monitoring the clock bias variations of a moving GNSS
mainly designed to detect and neutralize a spoofing attack receiver in order to discriminate between the authentic
based on a stand-alone GNSS receiver processing. and spoofed position solutions. Psiaki et al (2013) have
However, in many applications a communication link taken advantage of rapid oscillations of a receiver antenna
might exist among different receivers operating in the to discriminate spoofing signals based on their phase
vicinity of each other that can help the countermeasure variations; they have extended their spoofing detection

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 1/12
technique to the case of two closely spaced antenna one or several base stations. The essence of this method is
elements in Psiaki et al (2014). Spatial null-steering using that CAV receives simultaneous measurements from
antenna arrays is another countermeasure method against nearby receivers and detects a spoofing attack, classifies
spoofing signals and it can effectively discard spoofing authentic and spoofing signals and localizes the spoofer
and other types of interference (Daneshmand et al 2011, source. After spoofing detection, the proposed anti-
2012). spoofing architecture commences to classify the spoofing
and authentic signals. It should be noted that in contrary
Although the aforementioned methods can effectively
to the jammer case, the spoofing signal power is more or
counter specific spoofing scenarios, limited work has
less in the same range as that of the authentic signals. This
been reported toward proposing an anti-spoofing receiver
is justified as the spoofer can be easily recognized if the
structure that detects spoofing attacks, neutralizes them
spoofing signal power exceeds a certain threshold.
and provides a reliable position and navigation solution.
Therefore, in many cases, spoofing and authentic signals
Broumandan et al (2014) have proposed a robust anti-
should be detectable by a target receiver. However, in the
spoofing receiver architecture for moving GNSS
case of high power spoofing signals where the spoofing
receivers. The proposed architecture enables a stand-alone
signals mask the authentic ones, if a target receiver is
receiver to detect a spoofing attack, discriminate and
equipped with enough digital-to-analog bit resolution, the
classify the spoofing PRNs from the authentic ones and
proposed method of Broumandan et al (2014) can be used
eventually remove the spoofing signals from the digitized
to mitigate the high-power spoofing signals and retrieve
samples. Jafarnia et al (2015) has proposed a method
the authentic PRNs. Almost all of the proposed
using two spatially separated commercial receivers to
spoofing/authentic signal classification methods rely on
classify the spoofing and authentic signals. It has been
the single-source spoofing assumption. This means that
shown that spoofing/authentic signal classification is a
all of the spoofing PRNs are transmitted from a single
function of the antenna separation (baseline) length and
direction. Thus the spoofing signals are highly correlated
ordination.
in the spatial domain whereas authentic signals arrive
Work on spoofing detection and mitigation methods is from different angles. Montgomery et al (2009),
mainly designed to cancel out a spoofing attack based on McDowell (2007), Broumandan et al (2012) and Jafarnia
a stand-alone GNSS receiver. However, in many et al (2014) have proposed different methods relying on
applications there may be a communication link between spatial processing to discriminate authentic and spoofing
different receivers operating in the vicinity of each other, signals. Herein, an approach based on the carrier phase
or a GNSS receiver may communicate with one or several variation proposed by Jafarnia et al (2014) is used to
receiver base stations. This is similar to the network RTK classify the signals. It can be shown that the double
system architecture or Internet of things concept. The idea difference carrier phase observations in the spoofing case
of alleviation of spoofing attacks based on processing for a short baseline (about a km) are time-invariant,
several GNSS receiver observations has discussed in whereas in the case of authentic signals due to satellites
some recent research work; Swaszek and Hartnett (2014) motion the relative phase difference between antennas
have proposed a spoofing detection method utilizing varies with time. This is regardless of user or spoofer
commercial off the shelf GNSS receivers, by comparing motion. Hence, double difference carrier phase
the position solutions from multiple receivers located on observations over time is a mean to discriminate between
the same platform. The spoofing detection metric works spoofing and authentic signals. Thus, the CAV unit
based on the fact that the existence of a spoofer would monitors the phase difference among different receivers
make the statistical relationship of the observed positions for different PRNs to detect and classify the
different than it is during normal, non-spoofed operation. spoofing/authentic signals.
Heng et al (2014) introduces a signal authentication
After authentic/spoofing signal classification, CAV
architecture based on a network of cooperative GNSS
places the measurements in two groups, namely authentic
receivers. A receiver in the network correlates its received
and spoofing. The genuine location and time of each
military code with those received by other receivers so as
receiver can be determined using the measurements in the
to detect spoofing attacks. Scott (2010) has proposed a
authentic group. Hence, the receivers position, time as
jammer source localization based on crowdsourcing
well as the receiver clock biases can be extracted. The
approaches using a multitude of opportunistic cell phone
position solution of the spoofing signals provides fake
based Automatic Gain Control (AGC) gain observations.
position results that are almost the same for all receivers
This paper proposes a network-based anti-spoofing affected by the spoofing propagation. This is due to the
receiver architecture that uses spatially distributed fact that all PRNs received by a receiver are sharing the
receivers connected to a Central Authenticity Verification same propagation channel, hence the distance of a
(CAV) unit. This might be the case of driverless car receiver from the spoofer source does not change the
navigation systems where each car transmits navigation spoofing position solution. However, the clock bias
measurements to the CAV unit; or a network of estimate extracted from the spoofing signals is a function
distributed high precision receivers communicating with of the receiver-spoofer Euclidean distance and is used to

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 2/12
localize the spoofer source. In the following, different a spoofing attack in which case the spoofing detection
components of the proposed authenticity verification and method sets a spoofing flag. In the proposed architecture
spoofer localization unit is provided. after detecting a spoofing attack the receiver reports it to
the CAV unit. It is also possible that CAV detects a
spoofing attack based on analyzing the received
SPOOFING DETECTION
measurements from different receivers. In the case of a
The spoofing detection procedure can be performed at
spoofing attack, the CAV unit notifies other receivers
the receiver level where a stand-alone receiver detects a
operating in the affected area. Spoofing detection
spoofing attack, or in the network level where a CAV unit
reliability can be increased by incorporating several
detects the spoofing occurrence based on observations
reports from different receivers. After detecting all visible
from different receivers. Among different receiver-based
signals (both spoofing and authentic) which are above the
spoofing detection techniques, Automatic Gain Control
acquisition threshold, all the detected authentic and
(AGC) gain level or Analog-to-Digital Converter (ADC)
spoofing signals are tracked and the measurements are
samples variance monitoring (Akos 2012), and
sent to the CAV unit.
acquisition level spoofing detection can be named.
Jafarnia et al (2014) introduced a low complexity and
efficient spoofing detection technique based on a SPOOFING/AUTHENTIC CLASSIFICATION
structural power analysis of digitized samples. This After spoofing detection and reception of all
method monitors the total structural signal power content measurements (including the authentic and spoofing
of the received signals and detects the spoofing attack if signals) from spatially distributed receivers, the CAV unit
the total signal content exceeds a pre-defined threshold. In classifies authentic and spoofing PRNs. This part of the
the single-antenna spoofing attack, since the propagation research focuses on measurement classification for
distances from a spoofer to target receivers are common multiple carrier phase GNSS receivers operating in a
among all the PRNs, different spoofed receivers placed at limited region. Here it is assumed that the spoofer
different locations provide almost the same position and transmits all the PRNs from a single source. Hence, all of
velocity solutions. This can be a mean to detect a the transmitted signals have the same spatial signature.
spoofing attack at the network level. A network-based The carrier phase observation at the ith antenna for the lth
spoofing detection method may be implemented based on PRN signal can be written as (Misra & Enge 2006)
monitoring the position and velocity solutions of several
receivers and detect a spoofing attack based on the
correlation among the position and velocity solutions of

il k li k c tl k T i k
(1)
Nli I li k Trli k wi k
different receivers. l

Among many receiver-based spoofing detection

methods, three low computational complexity and where il[k] is the actual range between the lth satellite and
effective techniques including ADC samples variance ith receiver antenna. tl(k) and Ti(k) are the clock errors
monitoring, pre-correlation based structural power corresponding to the lth satellite and ith receiver. Iil[k] and
analysis and acquisition level detection are implemented Tril[k] are ionospheric and tropospheric delays. w[k] is the
and characterized in the spoofing detection module. The noise term including range errors, receiver noise and
ADC-based spoofing detection method monitors the multipath. c and are the light velocity in vacuum and the
variance of the digitized samples. In a case of an carrier wavelength of GNSS signal. Nil is an integer
abnormal variation of the digital samples variance, the number which corresponds to cycle ambiguity of the lth
method flags the presence of a possible interference PRN at ith antenna. k represents the measurement index.
source. This is a simple and effective way to detect high Assuming a short antenna baseline (about one km) and
power spoofing attacks. The structure of spoofing signals based on Equation 1, the carrier phase difference of ith and
is very similar to that of authentic GNSS signals. The jth receivers can be written as
presence of additional spoofing PRNs increases the power
il , j il lj li, j c T i, j Nli, j wi, j (2)
content of structural signals in the GNSS frequency band. l

This excessive amount of power can be detected prior to

the despreading process using the authenticity verification where Ti,j gives the temporal variations of the relative
method proposed by Jafarnia et al (2014). This method is clock bias between the two receivers. Nli,j is the
specifically useful for the cases when AGC gain difference between integer carrier cycle ambiguities of
information is not available. The acquisition level two receivers and this value is assumed to be constant
spoofing detection method searches all possible code within the observation interval. The effects of ionospheric
phases and carrier Doppler frequencies and detects all the and tropospheric delays have been neglected due to short
signals which are above the acquisition threshold. baseline assumption. li,j can be written as
Occurrence of two or more detectable signals associated
with a single PRN may indicate that the receiver is under

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 3/12
 mi , j t d aTi , j c m t linear model where Bm,l is considered as a nuisance

cos m t sin m t
parameter. A Generalized Likelihood Ratio Test (GLRT)
(3) detector selects H1 if (Kay 1998)
c m cos m t cos m t . T x m,l

sin m t
A A
1
A HT H 1 AT
T
b b (7)
ai,j represents the pointing vector from the i to the j th th
m ,l
m ,l

receiver in the ENU coordinate system, and cm is the 2
pointing vector towards the source of the mth PRN signal.
where m,l HT H HT xm,l is the maximum likelihood
1
m(t) and m(t) refer to the elevation and azimuth angles
of the mth PRN source. d is the spacing between these two estimate (MLE) of m ,l under H1 and is the detection
receivers. The double difference of the carrier phase
threshold. 2 is the variance of the noise process vector
measurements can be written as
which is assumed to be constant during the observation
im, ,jl im, j li , j mi , ,jl Nmi , ,jl wi , j interval. The asymptotic detection performance of this
m ,l (4) detector can be written as

It is assumed that spoofing PRNs are all transmitted from

a single terrestrial antenna and therefore they all have the q

PD Q 2 Q21 PFA
q
(8)
same azimuth and elevation angles with respect to the
antenna baseline. As such, for the case that m and l are
both spoofing signals, it can be written that which is an approximation where PD is the probability of
detection and PFA is the probability of false alarm.
mi , ,jl k mi , j k li , j k 0 (5)
Q 2 is the tail probability of the non-central chi-
q

Therefore, Equation 4 in the spoofing scenarios becomes squared distribution with non-centrality parameter of
and q degrees of freedom. Q21 represents the inverse
time invariant and this does not depend on the receiver
dynamics or relative clock drifts of receivers. However, q

for the case of authentic signals, Equation 5 does not hold of the tail probability of a central chi-squared distribution
since these signals are transmitted from different angles with q degrees of freedom. Herein, q=1 which is equal to
and their angles of arrival vary independently from each the number of rows in the matrix A. In this process, in
other. Therefore, spoofed PRNs can be distinguished from case that T xm,l exceeds the detection threshold at least
authentic ones based on the double difference of the
carrier phase measurements of two or more spatially one of the mth or lth PRN signals can be considered as
separated antennas. The carrier phase double differences authentic. If the test statistic does not exceed the detection
of spoofed PRNs have a zero-slope temporal variation threshold within the observation interval, both PRNs
whereas for the case of authentic signals a non-zero slope could be considered as potential spoofing signals.
is visible in the carrier phase double differences. This fact Considering observations of several receivers are
is the basis for authentic and spoofing PRN classification. available, the spoofing and authentic classification
The proposed classification method is an extension of that procedure can be modified to enhance the detection
proposed by Jafarnia et al (2015). Considering carrier procedure. Considering M carrier phase measurements
phase observations of two receivers, the authenticity from M spatially separated receivers, there will be
verification problem can be written as the following K M ! (M 2)!2! double difference observations and
hypotheses: test statistics to perform classification. This K
observations can be combined in different ways to make
H0 : xm,l n im, ,jl nTs Bm,l wm,l n the final decision. For instance one can weigh the
(6) individual double difference measurements based on the
H1 : xm,l n im, ,jl nTs Am,l n Bm,l wm,l n length of the baseline between the two antennas.
Considering a weighting vector W [w1 , w2 ,..., wK ] , the
where H 0 and H1 correspond to the absence and final test statistics to be compared with a defined
presence of authentic signals respectively. Ts is threshold can be shown as
observation interval and n represents the sample index.
Am,l and Bm,l represent the slope and bias of 1 K
im, ,jl nTs . w n is the discrete noise component.
T xm,l wk Tk xm,l (9)
K k 1
Herein, Am,l and Bm,l are the unknown parameters of the

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 4/12
 Authentic
SV.3
Authentic
SV.2 Authentic
SV.4
Authentic
SV.1

Central
Authenticity
Verification RX5
RX4
su5
Communication
P5
Link P4 su4

Ps
su3 Spoofer

su2 su1
RX3

P3

P2 RX2
P1 RX1

FIGURE 1- BLOCK DIAGRAM OF THE PROPOSED SYSTEM

In this paper, an equal gain combiner with W [1,1,...,1] ith receiver, a simplified model can be written as (Jafarnia
is used to provide a final decision. et al 2013)

SPOOFING SOURCE LOCALIZATION

One of the main differences between the spoofing and (10)
other types of wideband interference is that spoofing
signals contain range information that can be utilized to
localize the spoofing source. In the spoofing source where l is the fake range between the spoofer generated
localization, contrary to GNSS where there are several counterfeit position and the lth GNSS satellite, dt is the l
synchronized transmitters and only one receiver, there is
only one transmitter and several synchronized receivers. timing error corresponding to the lth counterfeit satellite,
Figure 1 shows a spoofing scenario where the spoofer dTui is the user clock error and su
i
is the physical range
affects several receivers. The spoofer is located at P s between the spoofer transmit and the ith receiver antennas.
which is the desired parameter to be estimated. The ith dTs shows a deliberate time advance that might be added
GNSS receiver is located at Pi . After authentic/spoofing to the spoofers transmit signal in order to compensate for
signal classification, the CAV unit classifies the received the propagation delay between the spoofer antenna and
signals in two groups, namely authentic and spoofing. The the target receivers antenna plus the spoofer clock bias.
actual location and time of each receiver can be estimated This term should be either constant or follow a predefined
using the authentic measurements. Hence, the receivers clock state model in order to be consistent with expected
positions are known with a certain level of accuracy and features of GNSS receiver clock variations. c is the speed
they are all synchronized with GPS time. The PVT of light in vacuum and li represents the other error
solution of the spoofing signals provides a fake position
sources such as ambient noise and multipath.
and velocity results that are almost the same for all
receivers. This is due to the fact that all spoofed PRNs Ci c dTui sui c. dTs defined in Equation 10 is
received by any of those receivers share the same common among all PRNs received by the ith receiver,
propagation channel, hence the distance of a receiver from hence it will be resolved in the clock bias of the PVT
the spoofer source does not significantly change the PVT solution of the spoofing signals at the ith receiver. It is
solutions. However, the clock bias of the spoofing observed that clock bias measurements of the spoofed
measurements is a function of the receiver-spoofer PVT solutions contain the range information from the
Euclidean distance and can be used to localize the spoofer spoofer to the target receivers. The term dTui represents
source. For the case of the lth spoofed pseudorange at the

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 5/12
the clock bias of the ith receiver and it can be observed If the attack is detected, the receiver halts normal
from the authentic position solution corresponding to this operation and then synchronizes measurements with a
receiver. Therefore, having access to the clock bias trusted time such as a network time and transmits all the
measurements from the spoofing group provides the measurements to the CAV unit.
possibility to observe the geometric range between the Synchronization with a trusted time source is required
spoofing source and the ith receiver with an uncertainty since the spoofing attack may manipulate the receiver
term ( dTs ) which is common for all the receivers in the timing and disrupt the classification procedure. Herein, it
network. In other words, the difference between clock is assumed that the network time is accurate within a few
bias terms for authentic and spoofed PRNs can provide a microseconds, otherwise dTs which can be generally a
user-spoofer pseudorange measurement. Having this time varying term, might not be the same for all receivers
information along with a good geometry of different in the network. Upon reception of different measurements
receivers in the network, the position of the spoofing from affected receivers, CAV classifies spoofing and
source can be determined. Figure 2 shows the flow authentic signals based on several carrier phase
diagram of the proposed spoofing detection, classification observations. After successful authentication process, the
and source localization. Initially GNSS receivers (Rxn CAV unit sends the authentic and spoofing classification
shown in Figure 2) start operating in the normal mode results to each receiver. In this case each affected receiver
which means providing PVT solutions for a specific can detect the spoofing PRNs, mitigate them and start
application. The receiver-based spoofing detection unit in normal operation. Then, as discussed before, the CAV
a pre-defined interval checks for a spoofing attack. unit estimates the location of the spoofer based on the
authentic and spoofing PVT solutions.

Rx2 RxN PRACTICAL CHALLENGES

Rx1
Several factors may affect the performance of the
Acquire and Track all Detectable proposed spoofing source localization. In general, the
Correlation Peaks error sources which disturb the proposed spoofing source
localization can be categorized into two groups. The first
Check the Spoofing Detection Metrics (AGC practical limitations consist of those errors which limit
level, Pre-despreading, Acquisition level ) any satellite based positioning systems such as
atmospheric errors, multipath propagation and visibility of
No
satellites. These error sources affect the position and
Is Spoofing Detected? timing solutions of the PRNs in the authentic group that
will be used to localize the spoofing source. These error
Yes types and their characteristics are extensively discussed in
Switch to network time
the literature (e.g. Kaplan 2006, Misra & Enge 2001). The
send all the measurements second sources of errors are those affecting the
to CAV pseudorange measurements from the spoofer to the
receivers. These error sources are discussed in the
following paragraphs.
Central Authenticity Verification (CAV)

Spoofing Detection Receiver position accuracy

Herein it is assumed that the actual position of each
MSR Classification receiver in a network is not available a priori and should
Authentic Spoofing
be estimated. Hence, the accuracy of the receiver position
MSR MSR will affect the performance of the spoofing source
localization. This has been done via position estimation of
PVT PVT the measurements in the authentic group. The accuracy of
the receiver position depends on the receiver type and
available corrections and may range from few tens of cm
Spoofing source to several metres (e.g. NovAtel 2015).
localization
Multipath
Multipath propagation poses significant challenges to
wireless based navigation systems. It remains a dominant
Figure 2: Flow diagram of the proposed spoofing source of accuracy degradation and is a major issue for
localization method GNSS applications. Multipath propagation can result in
biased GNSS measurements, which can lead to inaccurate
position estimates for both authentic and spoofing

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 6/12
solutions. Multipath propagation affects the proposed EXPERIMENTAL RESULTS
spoofing localization method in two ways. First, it Testing an anti-spoofing algorithm in a real case is
degrades the authentic position solution of each receiver. challenging since outdoor radio transmission in the GNSS
This issue has been extensively discussed and frequency bands is not allowed. Therefore, considerations
characterized in the literature (e.g. Irsigler & Eissfeller to avoid this limitation have to be taken into account. The
2003, Townsend et al 1995). Secondly, multipath experimental measurements are based on the reception of
propagation affects the spoofing source localization GPS L1 C/A signals. This section provides experimental
problem through distorting the pseudorange results of spoofing detection, authentic/spoofing
measurements from the spoofer source to individual classification and spoofing source localization.
receivers. The multipath error in the first part is a function
of the wireless channel between the authentic satellites Data collection setup
and individual receivers. However, the multipath error in This section describes the test method used to evaluate the
the second part is a function of the spoofer and each performance of the proposed method. Real data was
receiver propagation environment and it is independent of collected in the presence of authentic and spoofing
the first part. It should be noted that the position and signals. To this end a three channel front-end was used to
velocity solutions of the spoofed measurements are not capture IF samples with a 10 MHz sampling rate. Three
severely affected by multipath propagation. This is due to NovAtel 702 GG antennas were used to collect authentic
the fact that multipath affects all the PRNs almost the GPS signals. Figure 3 shows the data collection scenario
same way and hence the multipath error will be observed and the environment where three spatially separated
in the spoofed clock bias. Therefore, the multipath rooftop antennas were used to collect the authentic signals
propagation only affects the clock bias estimate, which is which were then combined with spoofing signals. The
a function of the spoofer to each receiver distance and is accurate locations of the antennas were known. Rodhe &
the desired measurement to localize the spoofer source. Schwarz SMBV100A hardware simulator signals were
Utilizing different multipath reduction techniques such as used as a spoofing source. The signals were fed to a
Sokhandan et als (2015) can help to reduce the multipath splitter with different cables (L1, L2 and L3 shown in
effect as well. It is important to note that for a terrestrial Figure 3) connected to the antennas and then combined
spoofing source the wireless channel will follow the with the authentic signals. The main difference between
terrestrial channel model which is prone to be more this collection setup and an actual spoofing attack is that
affected by multipath and fading as compared to the in the latter case, the signals propagated from the spoofer
satellite-receiver propagation channel (Parsons 2000). to each antenna would be subject to wireless channel
distortions such as multipath, blockage and refraction.
Hence, the channel model in the present case can be
Receivers time synchronization considered as an additive white Gaussian noise (AWGN).
Herein, the distance (range) from the spoofer to each
Another important factor affecting the performance of the antenna is equivalent to the cable lengths. Hence, the
spoofer source localization is the synchronization pseudorange estimation problem in this case reduces to
accuracy among different receivers. Here, it is assumed cable length estimation.
that each receiver after the PVT solution is synchronized The combined spoofing and authentic signals after down-
with GPS time. The synchronization accuracy is a conversion from the L1 centre frequency to an
function of the receiver hardware and software intermediate frequency were sampled by the front-end.
components such as oscillator, tracking and navigation The digitized samples were then passed to a software
architecture. The timing accuracy of a GNSS receiver receiver to provide measurements and PVT solutions. In
performing clock steering can be as good as 20 ns all tests the hardware simulator generated 8 PRNs. A non-
assuming continuous tracking (e.g. NovAtel 2015). aligned spoofing scenario was considered in these tests
where the correlation peaks of the spoofing and authentic
signals do not overlap. This assumption is justified since
Geometry of the receivers if a spoofing source causes an aligned spoofing attack for
one receiver, its signals will be non-aligned for other
Another important factor affecting the spoofing source receivers (this depends on the distance among receivers
localization is the geometry of the receivers with respect and on the GNSS signal structure). Figure 4 shows the sky
to the spoofer source. This indeed depends on the plot of available GPS signals during the test. In the
application. The effect of geometry on the accuracy of the dataset, PRNs 4, 7, 11, 13, 17, 19, 28, and 30 correspond
navigation solution is discussed broadly in the literature to the authentic signals and PRNs 1, 12, 16, 23, 25, 29,
(e.g. Kaplan 2006) and hence will not be considered here. 31, 32 correspond to the spoofing signals.

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 7/12
 The lengths of the cables (L1, L2 and L3 in Figure 2) are
designed such that the estimated ranges between the
spoofer and receivers converge to a valid virtual position
solution. As discussed before, it is important for an
effective spoofer to slightly overpower the authentic
L3 Combiner Ch3 signals power level and at the same time not to
significantly affect the input AGC gain of the target
receiver. To this end, two data sets were collected. The
L2 Combiner Ch2 Frontend first data set was intended to adjust the spoofing and
authentic signals power levels to provide a realistic
spoofing scenario and to evaluate the performance of
Combiner Ch1 different spoofing detection metrics. In this data set the
power of the simulator was changed to find the proper
power level for spoofing transmission. In the second data
Hardware L1 set, the performance of the spoofing/authentic
Simulator classification and spoofing source localization was
evaluated. In all the test scenarios the receiver tracked all
the authentic and spoofing signals in PLL assisted DLL
Authentic signals mode where the DLL bandwidth was reduced to 0.1 Hz.

Combiner Ant 2 Ant 1 Spoofing detection

To evaluate the performance of the spoofing detection
techniques and adjust the spoofing and authentic signals
power levels, the spoofing signals power was changed in
a 30 dB range in 1 dB steps every 5 s. Figure 5 shows the
performance of the implemented spoofing detection
To front-end metrics. The top plot is the post processing noise variance
as a function of Spoofer-to-Authentic Power Ratio (SAR)
Spoofing signals
By increasing SAR, the post-despreading noise variances
increase gradually.

10
Noise Floor [dB]

Figure 3: Data collection setup

Detection Threshold
5

0
-20 -15 -10 -5 0 5 10

15
SPA Metric

10

5
-20 -15 -10 -5 0 5 10
# of Detected PRNs

20
18
16
14
12
10
-20 -15 -10 -5 0 5 10
Spoofing to Authentic Average Power Ratio [dB]

Figure 5: Comparison of different spoofing

detection metrics
Figure 4: Sky plot of the available authentic signals
during the test

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 8/12
 This is due to the fact that the power of the received
spoofing signal is less than that of the authentic ones. 55
PN4
When the spoofing power becomes comparable with that 50 PN5

CN (dB-Hz)
of the authentic signal the noise floor increases rapidly. PN11
The middle plot in Figure 5 is the SPA metric as a 45 PN13
PN17

0
function of the SAR. It is observed that the SPA metric 40 PN19
gradually increases after about 100 s (20 dB gain in SAR) PN28
from the start of the data set. This metric exceeds the 35 PN30
0 50 100 150 200 250 300 350
detection threshold after the SPA exceeds 3 dB, which Time (s)
shows the excessive amount of structural signal power in 55
the received data set. The SPA metric does not use any PN1
knowledge of the AGC gain, therefore this metric is 50 PN12

CN (dB-Hz)
PN16
useful in cases when only digital samples are available. PN23
45
As described before, one can detect a spoofing attack by PN25

0
monitoring the total number of detectable signals and set a 40 PN29
PN31
spoofing flag. The bottom plot of Figure 5 is the total PN32
35
number of acquired signals as a function of the spoofing 0 50 100 150 200 250 300
to authentic signal power. In this experiment the Time (s)

acquisition sensitivity was 38 dB-Hz for a 5 ms coherent Figure 6: C/N0 values of the authentic and spoofing
integration time. Here the spoofing detection threshold is signals
14 detectable peaks, which means that if there are more
than 14 detectable signals the spoofing flag will be set.
This method can detect the spoofing attack much faster As mentioned before the carrier phase double difference
than the earlier methods and when the SAR value exceeds observations over a time period has a slope for authentic
-8 dB spoofing flag is set. As shown in the lower plot, by PRNs whereas this observations has a zero slope for the
increasing the spoofing power, the total number of spoofing signals. The test statistics for spoofing
detectable signals is reduced. This is due to the fact that as classification was given in Equation 7. In the case of more
the spoofing propagation power increases, it jams the than two receivers providing these observations the
authentic signals and affects their detectability. As shown proposed method of Jafarnia et al (2014) has been
in Figure 5 up and middle plots, spoofing detection modified to accommodate all the observations as shown
methods detect a spoofing event when the spoofer power in Equation 9. Figure 7 and Figure 8 show the carrier
is a bit higher than that of the authentic signals. The noise phase single and double differences for different authentic
floor monitoring method requires a calibration data (clean signals over 150 seconds of observation. Figure 8 also
data) to set the threshold value. On the contrary, the SPA shows the spoofing signals double difference plots. In
and the acquisition based spoofing detection methods do these figures the mean value of single and double
not need any calibration data and can detect both low difference measurements are removed in order to provide
power and high power spoofing scenarios. Thus, an easier comparison. Since both spoofer and authentic
incorporating several spoofing detection techniques in the signals were stationary during the observation intervals, a
spoofing detection block, the spoofing detection reliability single difference test can be used to classify spoofing and
will be increased and a wide range of spoofing signals authentic signals utilizing a single clock source. As shown
power levels can be detected. in Figure 7 the single difference magnitude is higher for
single differences between Ant 1 and Ant 3 ( 1,3 ) as
Authentic/Spoofing classification compared to 1,2 and 2,3 cases. This is due to the
This part describes the practical results of fact that the baseline between Ant1 and Ant3 is longer
authentic/spoofing classification based on carrier phase than the other cases. As discussed before and shown in
observations In the second data set, the power level of Equation 3, a longer baseline facilitates and enhances the
spoofing signals is adjusted such that both the authentic classification performance. Another important observation
and spoofing signals are detectable after combining. from Figure 7 is that the single difference observations for
Hence, the software receiver could track both the different pairs, namely Ant1-Ant2, Ant1-Ant3 and Ant2-
authentic and spoofing signals. Figure 6 shows the C/N0 Ant3 do not follow the same pattern. For instance, the
variations of the authentic and spoofing signals over time single difference of PRNs 7, 13, 30 in the 1,2 case
for the first antenna. (shown in Figure 7a) are almost overlaid and have the
same variation during the observation interval. This
makes the double difference test statistics between these
PRNs almost zero mean, which results in false
classification. However, considering the single difference

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 9/12
curves of PRNs 7, 13, 30 for the 1,3 ,
2,3 configurations shown in Figure 7b and Figure 7c, a) Single Difference An1-Ant 2
0.5
one can observe that the plots corresponding to these

1,2 (cycles)
PRNs are not overlaid and thus their carrier phase double
differences are not zero mean. Hence, incorporating
0
various double difference pairs will significantly reduce
the time and enhance the performance of the
spoofing/authentic classification. Figure 8 shows double -0.5
difference plots for the authentic and spoofing cases. 0 50 100 150
b) Single Difference An1-Ant 3
Curves in green correspond to the authentic signals while 0.5
spoofing double difference observations are shown in PRN-07

1,3 (cycles)
black. The green curves demonstrate a linear temporal PRN-11
variation while the black curves are constant as a function PRN-13
0
of time. This trend is the main feature that is used for the PRN-19
authentic and spoofing PRNs classification. Considering PRN-28
the results of Figure 8 it seems that some of the green PRN-30
lines have very small linear temporal variations. This is -0.5
0 50 100 150
because the single difference of those PRNs, for instance c) Single Difference An2-Ant 3
0.5
PRNs 7, 13, 30 in the Ant1-Ant2 case are highly

2,3 (cycles)
correlated in time. However, utilizing spatial diversity and
considering more double difference pairs in the
0
classification problem, the performance of the proposed
method can be significantly improved. After incorporating
all the pairs in the decision metric the combined test
-0.5
statistics for all pairs enter in the final stage of signal 0 50 Time (s) 100 150
classification. This stage employs graph theory to enhance
the performance of the spoofing/authentic classification Figure 7: Single difference carrier phase
module (Jafarnia et al 2015). Table 1 shows the authentic measurements for different antenna pairs
spoofing classification after 30 s of observation. The false a) Double Difference An1-Ant 2
alarm probability for authenticity verification was set to 1
1,2 (cycles)

PFA=10-6. Signal type in Table 1 shows the actual status of

each PRN in terms of belonging to the authentic (A) or 0
spoofing (S) groups. Classification results show the
i,j

outputs of the classification unit based on considering

different antennas double differences and the combined -1
0 50 100 150
method proposed in Equation 9. Considering 30 s of
observation for the data sets, all the PRNs are successfully b) Double Difference Ant1-Ant3
1
authenticated utilizing the proposed method. Spoofing
(cycles)

Spoofing localization 0.5 Authentic

In this section, the problem of spoofing source 0

1,3
i,j

localization is considered. After authentic/spoofing

-0.5
classification the signals in the authentic group were
tracked utilizing a modified software receiver to estimate -1
0 50 100 150
the actual location of each receiver and synchronize the Time (s)
receivers with GPS time. The position solutions of the c) Double Difference Ant2-Ant3
authentic signals for various receivers in the horizontal 1
2,3 (cycles)

plane are shown in Figure 9. Estimated Ant1 shows the 0.5

horizontal position solutions of the first receiver. The
0
actual position of each receiver is also shown in Figure 9.
i,j

Since the spoofing signals are combined with the -0.5

authentic signals through various cables as shown in
-1
Figure 3 and Figure 4, the pseudorange measurements for 0 50 100 150
the spoofing case results in estimating the cable length Time (s)

from the spoofer to the victim receivers. The cable lengths

Figure 8: Double difference carrier phase
have been chosen so as to result in a valid 2-D virtual
measurements for different antenna pairs
position solution of the spoofing source.

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 10/12
 Horizontal position of the antennas
10
Table 1: Spoofing authentic classification results
Classification Result in 30 s
Signal
PRN Ant1- Ant1- Ant2- Combined
type
Ant2 Ant3 Ant3
1 S S S S S
5
4 A A A A A
7 A A A A A

North (m)
11 A S A A A Estimated Ant1
12 S S S S S Estimated Ant2
13 A A A A A Estimated Ant3
0
16 S S S S S Actual Ant1
17 A A A A A Actual Ant2
19 A A A A A Actual Ant3
23 S S S S S Estimated Spoofer
25 S S S S S True spoofer
28 A S A S A -5
-15 -10 -5 0 5
29 S S S S S East (m)
30 A A A A A Figure 9: Receivers position solution
31 S S S S S
32 S S A S S

CONCLUSIONS
The position estimate rms errors for the three receivers are
The network based GNSS anti-spoofing architecture
tabulated in Table 2.
introduced herein has shown that spoofing signals
Table 2: Estimated position rms error
generated from a single point source can be effectively
East (m) North (m) Up (m)
detected using different metrics, namely AGC level,
Ant1 0.7 0.6 1.5 structural power content and acquisition level analyses.
Ant2 0.5 0.3 2.4 The acquisition level spoofing detection can effectively
Ant3 0.7 0.6 2 detect the presence of a spoofing attack in matched power
Spoofer 2.6 1.2 - spoofing propagation whereas the AGC level analysis and
The position and velocity solutions of the signals in the SPA methods are more reliable in overpowered spoofing
spoofing group result in the same estimates for all the propagation. Spoofing and authentic signals classification
three receivers. However, the clock bias measurements of was implemented by utilizing a test statistics based on
the signals in the spoofing group include the clock bias of carrier phase double-differences between two receivers.
the spoofer plus the cable lengths. Since the clock bias of The experimental results show that the reliability and
the spoofing source is common among all the clock bias performance of the classification module can be enhanced
measurements, the single difference between clock bias by incorporating several double-difference observations
measurements cancels the spoofer clock bias corresponding to the different receivers in the network.
contributions and the remaining term is the cable length The solution of the spoofing source location problem was
difference between receivers. Herein, since all receivers based on measuring the clock bias measurements of
are in the same plane, the 2-D spoofer position was signals in the spoofing group. The experimental results
considered. Figure 9 also shows the position solution of demonstrated the applicability of the proposed method in
the spoofing source based on the measured cable lengths a real-world test scenario.
and estimated position of each receiver at given time. The
rms error values of the positions of the spoofer source are
tabulated in Table 2. It should be noted that the REFERENCES
pseudorange measurement results for spoofing source
localization in this specific test scenario are not affected Akos, D. M. (2012) Whos Afraid of the Spoofer?
by multipath propagation since signals from the spoofer GPS/GNSS Spoofing Detection via Automatic Gain
source travelled in the cables. In real cases, the multipath Control (AGC), in Jounral of Navigation, vol. 59, No. 4,
propagated from a terrestrial source could affect the Winter, Institute of Navigation, pp. 281-290
measurements accuracy and consequently affect the
spoofing source localization performance. Broumandan, A., A. Jafarnia and G. Lachapelle
(2014) Spoofing Detection, Classification and
Cancellation (SDCC) Receiver Architecture for a Moving
GNSS Receiver, GPS Solutions, published online 23
September, DOI 10.1007/s10291-014-0407-3, 13 pages.

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 11/12
 Broumandan, A., A. Jafarnia, V. Dehghanian, J. Kay, S. M. (1998) Fundamentals of Statistical Signal
Nielsen, and G. Lachapelle (2012) GNSS Spoofing Processing: Detection Theory, Prentice-Hall Inc.
Detection in Handheld Receivers Based on Signal Spatial
McDowell, C.E. (2007) GPS Spoofer and Repeater
Correlation, in Proceedings of IEEE/ION PLANS 2012,
Mitigation System using Digital Spatial Nulling US
April 24-26, Myrtle Beach, South Carolina , pp. 479-487
Patent 7250903 B1, 7 pages
Daneshmand, S., A. Jafarnia, A. Broumandan and G.
Misra, P., and P. Enge (2006) Global Positioning
Lachapelle (2011) A Low Complexity GNSS Spoofing
System: Signals, Measurments, and Performance, Ganga-
Mitigation Technique Using a Double Antenna Array
Jamuna Press, 2nd Edition
GPS World magazine, December, vol 22, no 12, pp. 44-
46 Montgomery, P.Y., T.E. Humphreys, and B.M.
Ledvina (2009) Receiver-Autonomous Spoofing
Daneshmand, S., A. Jafarnia, A. Broumandan and G.
Detection: Experimental Results of a Multi-antenna
Lachapelle (2012) A Low-Complexity GPS Anti-
Receiver Defense Against a Portable Civil GPS Spoofer
Spoofing Method Using a Multi-Antenna Array in
in Proceedings of ION ITM 2009, Jan 26-28, Anaheim,
Proceedings of the 25th International Technical Meeting
CA, pp. 124-130
of The Satellite Division of the Institute of Navigation
(ION GNSS 2012), 17-21 September, Nashville TN, 11 Nielsen, J., A. Broumandan, and G. Lachapelle
pages (2011) GNSS Spoofing Detection for Single Antenna
Handheld Receivers in Journal of Navigation, vol 58, no
Heng, L., D. B. Work, G. X. Gao (2014) GPS
4, Winter, pp. 335-344
Signal Authentication From Cooperative Peers IEEE
TRANSACTIONS ON INTELLIGENT NovAtel Inc (2015) OEM638 receivers
TRANSPORTATION SYSTEMS, http://www.novatel.com/assets/Documents/Papers/OEM6
0.1109/TITS.2014.2372000, 12 pages 38-PS-D17916.pdf, last accessed May 28, 2015
Humphreys, T. E., B. M. Ledvina, M. L. Psiaki, B. Psiaki, M. L., S. P. Powell, and B. W. OHanlon
W. O'Hanlon, and P. M. Kintner (2008) Assessing the (2013) GNSS Spoofing Detection using High-Frequency
Spoofing Threat: Development of a Portable GPS Civilian Antenna Motion and Carrier-Phase Data in Proceedings
Spoofer,in Proceedings of ION GNSS 21st. International of the 26th International Technical Meeting of The
Technical Meeting of the Satellite Division, September Satellite Division of the Institute of Navigation (ION
16-19, Savannah, GA, pp. 2314-2325 GNSS+ 2013), 16-20 September, Nashville, TN, pp. 2949
2991.
Irsigler, M. and B. Eissfeller (2003) Comparison of
multipath mitigation techniques with consideration of Psiaki, M.L., B.W. O'Hanlon, S.P. Powell, J.A.
future signal structures, in Proceedings of the 16th Bhatti, K.D. Wesson, T.E. Humphreys, and A. Schofield
International Technical Meeting of the Satellite Division (2014) GNSS Spoofing Detection using Two-Antenna
of the Institute of Navigation, 9-12 September, Portland Differential Carrier Phase, Proc. ION GNSS+ 2014,
OR, USA Sept. 9-12, Tampa, FL, pp. 2776-2800.
Jafarnia, A., S. Daneshmand, A. Broumandan, J. Parsons, J. D. (2000) The Mobile Radio Propagation
Nielsen and G. Lachapelle (2013) PVT Solution Channel, John Wiley & Sons LTD, 2nd ed.
Authentication Based on Monitoring the Clock State for a
Moving GNSS Receiver in the European Navigation Scott, L. (2010) J911:Fast Jammer Detection and
Location Using Cell-phone Crowd-Sourcing GPS World
Conference (ENC2013), April 23-25, Vienna, Austria, 11
November.
pages
Swaszek, P. F. and R. J. Hartnett (2014) A Multiple
Jafarnia, A., A. Broumandan, S. Daneshmand, N.
COTS Receiver GNSS Spoof Detector Extensions
Sokhandan and G. Lachapelle (2014) A Double Antenna
Approach toward Detection, Classification and Mitigation Proceedings of the 2014 International Technical Meeting
of GNSS Structural Interference, Proceedings of of The Institute of Navigation, January 27-29, 2014, San
Diego, CA.
NAVITEC 2014, Noordwijk, Netherlands, 3-5 Dec, 8
pages. Townsend, B., D. J. R. van Nee, P. Fenton, and K.
Van Dierendonck (1995) Performance evaluation of the
Kaplan, E. D. and C. J. Hegarty (2006),
multipath estimating delay lock loop, Navigation Journal
Understanding GPS Principles and Applications, Artech
House, Boston, London, 2nd edition of the Institute of Navigation, 42(3), 503-514

ION GNSS + 2015 Conference, Session F2, Tampa, FL, Sept 14-18 2015 12/12