Use of Supervised Machine Learning for GNSS Signal Spoofing Detection with Validation on Real-World Meaconing and Spoofing Data—Part II

Abstract

Global Navigation Satellite System (GNSS) meaconing and spoofing are being considered as the key threats to the Safety-of-Life (SoL) applications that mostly rely upon the use of open service (OS) signals without signal or data-level protection. While a number of pre and post correlation techniques have been proposed so far, possible utilization of the supervised machine learning algorithms to detect GNSS meaconing and spoofing is currently being examined. One of the supervised machine learning algorithms, the Support Vector Machine classification (C-SVM), is proposed for utilization at the GNSS receiver level due to fact that at that stage of signal processing, a number of measurements and observables exists. It is possible to establish the correlation pattern among those GNSS measurements and observables and monitor it with use of the C-SVM classification, the results of which we present in this paper. By adding the real-world spoofing and meaconing datasets to the laboratory-generated spoofing datasets at the training stage of the C-SVM, we complement the experiments and results obtained in Part I of this paper, where the training was conducted solely with the use of laboratory-generated spoofing datasets. In two experiments presented in this paper, the C-SVM algorithm was cross-fed with the real-world meaconing and spoofing datasets, such that the meaconing addition to the training was validated by the spoofing dataset, and vice versa. The comparative analysis of all four experiments presented in this paper shows promising results in two aspects: (i) the added value of the training dataset enrichment seems to be relevant for real-world GNSS signal manipulation attempt detection and (ii) the C-SVM-based approach seems to be promising for GNSS signal manipulation attempt detection, as well as in the context of potential federated learning applications.

A Self-Diagnosis Method for Detecting UAV Cyber Attacks Based on Analysis of Parameter Changes

“…Unlike previous work [ 23 , 24 , 25 , 26 ], we do not need to know which behavior is considered normal, or to compose many training datasets. It is enough for the UAV system to obtain one value and it does not need to be compared with a normal value, as in other approaches [ 8 , 9 , 10 , 11 , 12 ].…”

“…Semanjski et al presented a method for determining the authenticity of a GPS signal based on the correlation between true and incoming signals using C-Support Vector Machine (C-SVM) classification [ 25 ]. Application of their method is suggested at the signal receiver level to avoid changes that may occur during signal processing.…”

Satellite-Based Communications Security: A Survey of Threats, Solutions, and Research Challenges

“…A large variety of means have been used to detect GNSS spoofing attacks. Approaches use either PHY-layer information ( [53], [58]- [61], [64], [65], [67]- [70], [73], [74], [76]- [79], [82], [84]), or additional communication technologies ( [26], [56], [57], [62], [63], [66]), or techniques based on Machine Learning (ML) over heterogeneous data ( [75]- [79], [83], [84]). All these techniques share the basic consideration that the bitstrings in GNSS signals cannot be modified to be more secure before being transmitted.…”

“…Technology. While some works focused on a generic SATCOM technology, most were more specific, and analyzed Statistics Approach [58] HF Antenna Motion & Carrier-Phase [59] Phase-Only Analysis of Variance [60] Symmetric Difference Autocorrelation Distortion Monitor and a Total in-band Power Monitor [53] Meteor Burst Communications [56] Cellular Network [61] Cross-Check Receivers [62] Multilateration Phasor Measurement Units in Smart Grids [63] Cross-Correlation and Cooperative Authentication [64], [65] Carrier-Phase Measurements [66] Code Signals Correlation [67] Total Signals Energy Measurement [68] Time Authentication [69] Multi-Receiver Hybrid Communication Network for Power Grid Timing Verification [70] Fraction Parts of Double-difference Carrier Phases [71], [72] Channel Gain / Estimation Noise [73] Least Absolute Shrinkage and Selection Operator [74] Chips-Message Robust Authentication [75] Neural Network [76]- [78] Maximum-Likelihood [79] K-mean clustering [80] Control Theory (IMU sensor) in UAVs [81] Cooperative Receivers Positions [82] Semi-Codeless Receiver [83] Genetic Algorithm, Shortest Path and Pattern Matching [84] Supervised Machine Learning [26] IRIDIUM Ring Alert the jamming issue in GNSS ( [101], [103], [105], [107], [113], [114], [118]) and Military SATCOM constellations. Others were even more focused, proposing anti-jamming schemes tailored to the specific GNSS technology, such as the Chinese Beidou (…”

On the Use of Differential Correction Clustering for Facing Spoofing Attacks to GNSS Augmentation Networks

“…More specifically, Support Vector Machines (SVM) are used for GPS spoofing attack detection and the distribution of the error between the two systems is analyzed to identify the attack. Supervised machine learning has been exploited for spoofing detection showing promising results also in [22]. The authors performed a correlation analysis to identify the statistically significant variables and used them to train the SVM.…”