A Method of Detections’ Fusion for GNSS Anti-Spoofing

Abstract

The spoofing attack is one of the security threats of systems depending on the Global Navigation Satellite System (GNSS). There have been many GNSS spoofing detection methods, and each of them focuses on a characteristic of the GNSS signal or a measurement that the receiver has obtained. The method based on a single detector is insufficient against spoofing attacks in some scenarios. How to fuse multiple detections together is a problem that concerns the performance of GNSS anti-spoofing. Scholars have put forward a model to fuse different detection results based on the Dempster-Shafer theory (DST) of evidence combination. However, there are some problems in the application. The main challenge is the valuation of the belief function, which is a key issue in DST. This paper proposes a practical method of detections’ fusion based on an approach to assign the belief function for spoofing detections. The frame of discernment is simplified, and the hard decision of hypothesis testing is replaced by the soft decision; then, the belief functions for some detections can be evaluated. The method is discussed in detail, and a performance evaluation is provided, as well. Detections’ fusion reduces false alarms of detection and makes the result more reliable. Experimental results based on public test datasets demonstrate the performance of the proposed method.

1. Introduction

The security of the Global Navigation Satellite System (GNSS) is deeply concerned with the rapid development of GNSS applications. Due to the weakness of the power and the openness of the signal characteristics, GNSS receivers are vulnerable to interferences, and the signals are easy to counterfeit. There have been several reports about successful GNSS spoofing, which could cause great damage to important infrastructures, such as the telecommunication network, the power grid, etc. Therefore, anti-spoofing technology attracts researchers’ attention [1].

There have been many methods of GNSS spoofing detection and exclusion [1,2,3,4]. They can be classified into three categories. The first can be named signal design. The typical method is cryptographic authentication. Encrypted military signals, such as the GPS P(Y) code and M code, could not be duplicated by the spoofer; however, their target user group is limited, and most commercial users do not have the authority to access these signals. Besides, cryptographic authentication is powerless to prevent repeat spoofing, which transmits the delayed copy of authentic signals. The second category can be called external aids. GNSS measurements and solutions can be checked with external systems, such as inertial measurement units (IMU), compass, cellular network positioning, etc. [3,5]. The external systems are independent of GNSS, and they are not affected by GNSS spoofing. However, external aids increase the complexity of the user receiver, and they are expensive to implement in general receivers. The third category can be called GNSS signal processing. There are many methods in this category, such as multi-antenna processing [6,7], signal power monitoring [8], correlation domain monitoring [9,10], vestigial signal detection, receiver autonomous integrity monitoring (RAIM) [4] and the extended method [11], etc. In addition, some crossing methods are proposed; for example, the authors of [12] propose a method based on machine learning and signal processing to monitor the interference of GNSS. However, there are shortcomings in these methods, and some of them are complementary in anti-spoofing. The cooperation of multiple spoofing detections is necessary to improve the performance of GNSS anti-spoofing.

Information fusion is a key issue of the cooperation of multiple spoofing detections. There are many methods to fuse the information of different detectors, such as Bayesian data fusion, the Kalman filtering method, Dempster–Shafer theory (DST), etc. However, there are some obstacles in the applications. For example, a priori knowledge of the detectors is needed for Bayesian data fusion. The statistical properties of most detectors are known in the case of authentic GNSS signals, but uncertain in the case of spoofing signals, i.e., a priori information of the GNSS spoofing detectors is partially unknown. The uncertainty makes it impossible to apply Bayesian inference to calculate the posterior probabilities of the possible results. For the Kalman filtering method, the precise estimate of the noise covariances, including the covariances of process noise and observation noise, is very important in applications. However, a precise estimate is hard to obtain in the case of spoofing, because the style of spoofing is varied and unknown. DST [13] is a general framework for reasoning with uncertainty, and it provides a solution to combine evidence from different sources. It is suitable for use in situations where a priori information of detectors is partially unknown. The authors of [14] propose the framework of a mathematic model for conjunct GNSS spoofing detection. The model is based on the DST. However, it does not give the way to valuate the basic probability assignment (BPA) or belief function for each possible result of detection. Thus, the method cannot be implemented in practice. This paper focuses on this problem of DST and proposes a method to overcome this difficulty.

Each spoofing detection makes a decision according to the anomaly of the signal. Usually, it is a hard decision to discern the authenticity of the received signals. A hard decision is easy to implement, but it loses some information of measurement. Thus, false decision cannot be rectified. Meanwhile, most spoofing detections are equivalent to hypothesis testings, and the test statistics are quantifications of the anomaly of measurements or signal features. The quantification of the anomaly is equivalent to a soft decision that indicates the degree of anomaly, and the soft decision can be used to evaluate the belief function in binary detection. This makes it possible to implement the DST if the frame of discernment is simplified properly while the belief function is constructed on the basis of the quantification of the anomaly.

This paper proposes a method to deal with this problem. There are two main points for the purpose of implementation. The first is to extract a simplified frame of discernment for spoofing detection. Compared with the existing method, some elements in the complete, but redundant frame of discernment are excluded, and only two basic and mutually exclusive elements are left. This is conducive to the valuation of belief functions. The second point and the main contribution of this work is to construct the belief function for each possible result of detections. The belief function is proposed based on the model of hypothesis testing for a spoofing detector. These two points make it feasible to fuse the information from multiple spoofing detections.

The remainder of this paper is organized as follows. Section 2 describes the method of spoofing detections’ fusion, including the model of detections’ fusion, the valuation of the belief function and performance of fusion. Section 3 provides a detailed performance evaluation of the proposed method. Simulations based on the fusion of two spoofing detections are given. Finally, the conclusions are provided in Section 4.

2. The Proposed Method of Spoofing Detections’ Fusion

A detailed discussion of the proposed method is provided in this section. First, a simplified frame of discernment is given. The simplification is for the purpose of the quantization for detection results. Then, the valuation of the belief function, which is the key of information fusion, is given and discussed. Finally, the performance of detections’ fusion is analyzed briefly.

2.1. The Model of Detections’ Fusion

Most of the spoofing detections focus on the anomalies of signal features or measurements. Generally, each detector aims at only one feature, and the result is evidence of the presence of the spoofing attack. However, this evidence would be inadequate and not absolute reliable in some cases. The combination of the results from multiple detectors is an approach to deal with this problem. A method based on DST to fuse multiple detectors is proposed in the following.

According to DST, a complete frame of discernment in spoofing detection should contain all possible mutually exclusive declared propositions, such as the noise, authentic signal, counterfeit signal and the mixture of them. They indicate the identity of the signal. However, this complete frame of discernment sets up obstacles for implementation. The main problem is the evaluation of BPA. Thus, it is necessary to simplify this frame for application. In what follows, the noise, authentic and counterfeit signal are denoted as “N”, “A” and “C”, respectively, and the frame of discernment is denoted as Θ.

In practice, noise is universal because the environment temperature cannot be absolute zero. The acquisition module of the GNSS receiver would determine the absence of satellite signals if there is only noise. Thus, N is redundant in Θ. In what follows, the object is limited to the satellite signal that has been processed by the receiver, regardless of its authenticity. In a broader sense, C does not only represent the spoofing signal, it also means the abnormal change of the satellite signal. Besides, A and C are exclusive for a signal. If authentic and counterfeit signals are mixed together in a processing channel and cannot be separated by the GNSS receiver, they should be marked as “abnormal”, and the identified result should be C. Thus, it is unnecessary to reserve a position for the mixture “$AC$” in Θ. Therefore, Θ could be simplified as follows:

$$\Theta =\{A,C\}$$

(1)

That is, there are only two possible results of spoofing detector, “authentic” or “counterfeit”; the more generalized description is “no spoofing” or “spoofing”. This simplification of Θ facilitates the valuation of BPA and the belief functions, it also simplifies the combination rule. According to DST, for a possible result of one detector, the BPA is equivalent to the belief function because there are only two elements in Θ. Herein, the belief function is denoted as $m_i(·)$, which corresponds to detector $D_i$. $m_i(·)$ follows:

$$\left\{\begin{array}{c}{m}_i\left(\varphi \right)=0\\ m_i\left(A\right)+m_i\left(C\right)=1\end{array}\right.$$

(2)

where ϕ represents an empty set. $m_i(·)$ implies the believable degree of the evidence from detector $D_i$. For example, $D_i$ tends to determine the signal as “A” if $m_i\left(A\right)>m_i\left(C\right)$; otherwise, it tends to determine the signal as “C”. The conflict degree of different evidence can be defined as follows:

$$\kappa =1-\left(\prod _{i=1}^N{m}_i\left(A\right)+\prod _{i=1}^N{m}_i\left(C\right)\right)$$

(3)

The combination result is reliable if all evidence is coincident, while it is unreliable when the conflict degree is high. $\kappa =1$ means that some evidence is completely opposite, such as $m_1\left(A\right)=1$ and $m_2\left(A\right)=0$.

Due to the inference of the combination rule of DST [13] in the case of binary detection, the combined $m(·)$ are given as follows:

$$\left\{\begin{array}{c}{\displaystyle m\left(A\right)=\frac{{\displaystyle \prod _{i=1}^N}{m}_i\left(A\right)}{{\displaystyle \prod _{i=1}^N}{m}_i\left(A\right)+{\displaystyle \prod _{i=1}^N}{m}_i\left(C\right)}}\hfill \\ {\displaystyle m\left(C\right)=\frac{{\displaystyle \prod _{i=1}^N}{m}_i\left(C\right)}{{\displaystyle \prod _{i=1}^N}{m}_i\left(A\right)+{\displaystyle \prod _{i=1}^N}{m}_i\left(C\right)}}\hfill \end{array}\right.$$

(4)

where N is the number of spoofing detectors. In the case that $\kappa =1$, there is $\prod m_i\left(A\right)+\prod m_i\left(C\right)=0$; $m(·)$ cannot be obtained according to Equation (4). It is necessary to add a rule with Equation (4) in such a case as follows:

$$m\left(A\right)=m\left(C\right)=0.5\mathrm{when}\kappa =1$$

In what follows, they are denoted as Equation (4) together. After the fusion, a final decision must be made to determine the authenticity of the signal. The decision rule is given as follows:

$$\left\{\begin{array}{c}\mathrm{Determine}A\mathrm{when}m\left(A\right)\ge m\left(C\right)\hfill \\ \mathrm{Determine}C\mathrm{when}m\left(A\right)<m\left(C\right)\hfill \end{array}\right.$$

(5)

As $m\left(A\right)+m\left(C\right)=1$, the rule of Equation (5) determines “A” if $m\left(A\right)\ge 0.5$ and determines “C” if $m\left(A\right)<0.5$. That is, 0.5 is the threshold of the final decision after detections’ fusion.

Figure 1 shows the diagram of the detections’ fusion. Detector $D_i$ points at $x_i$, which could be any feature of the GNSS signals or measurements, such as signal power, Doppler shifts, code delay, pseudoranges, the results of positioning, etc.

It should be noted that not the different detection methods, but the different signal features are the key of fusion. The evidence of the spoofing attack is collected from the detectors and fused according to the rule of Equation (4). The fusion makes the result more credible if the evidence from different detections is coincident, while it would give a compromise result according to all evidence if it is conflictive. Two examples are provided in

Table 1. Examples for combination rule.

Coincident Evidence				Conflictive Evidence
	${\mathit{m}}_{\mathbf{1}}$	${\mathit{m}}_{\mathbf{2}}$	${\mathit{m}}_{\mathbf{1}}\mathbf{\oplus }{\mathit{m}}_{\mathbf{2}}$		${\mathit{m}}_{\mathbf{1}}$	${\mathit{m}}_{\mathbf{2}}$	${\mathit{m}}_{\mathbf{1}}\oplus {\mathit{m}}_{\mathbf{2}}$
A	0.8	0.2	0.903	A	0.8	0.2	0.632
C	0.2	0.3	0.097	C	0.3	0.7	0.368

as follows to demonstrate the combination of coincident and conflictive evidence.

2.2. Valuation of the Belief Function for GNSS Spoofing Detections

Belief functions are the key to the detections’ fusion. They represent the reliability of the corresponding measurement or features of the signal. The belief function is calculated based on the basic probability assignment (BPA) in DST. As previously mentioned, BPA is equivalent to the belief function in the case of binary detections. However, there is no general way to get BPA or the belief function for a detection result. This section proposes a method to valuate the belief function and provides a brief discussion about two spoofing detections.

Most of the spoofing detections are equivalent to hypothesis testings. They can be described as:

$$\left\{\begin{array}{cc}{H}_0:& T\left(x\right)\le \gamma \\ H_1:& T\left(x\right)>\gamma \end{array}\right.$$

(6)

where $H_0$ and $H_1$ are hypotheses that represent the absence and presence of a spoofing attack, and they are equivalent to A and C of Equation (1), respectively. $T\left(x\right)$ is the test statistic of x, which is a measurement of the signal. γ is the threshold of detection. Here, x could be any signal features and measurements, such as the absolute power or carrier-to-noise ratio ($C/N_0$) of the received signal, Doppler shift, outputs of the correlator, pseudorange measurement, etc.

The detection of Equation (6) makes a hard decision to decide whether the signal is authentic or not. It is easy to implement, but it loses some information and increases the error decision. $T\left(x\right)$ is a quantization of the anomaly of x, and it also can be considered as a soft decision of the authenticity of signal. The belief function for the detection results of detector $D_i$ can be defined as:

$$\left\{\begin{array}{c}{m}_i\left(A\right)=f(T_i,{\gamma }_i)\hfill \\ m_i\left(C\right)=1-f(T_i,{\gamma }_i)\hfill \end{array}\right.$$

(7)

where $m_i(·)$ is the belief function, $T_i$ and ${\gamma }_i$ represent the test statistic and threshold of $D_i$, respectively, and f is the function that maps $T_i$ and ${\gamma }_i$ to a real number. The mapping is subject to:

$$\left\{\begin{array}{c}f(T_i,{\gamma }_i)\in [0,1]\hfill \\ m_i\left(A\right)>m_i\left(C\right)\mathrm{when}{T}_i<{\gamma }_i\hfill \\ m_i\left(A\right)<m_i\left(C\right)\mathrm{when}{T}_i>{\gamma }_i\hfill \\ m_i\left(A\right)=m_i\left(C\right)\mathrm{when}{T}_i={\gamma }_i\hfill \end{array}\right.$$

(8)

This is in keeping with the decision rule of Equation (6). However, unlike Equation (6), $m_i(·)$ of Equation (7) provides a soft decision of the authenticity of the signal. Compared with the hard decision, it retains more information of x. More than that, Equation (7) makes it possible to fuse the information from multiple detections to reduce the probability of error decisions.

There are many forms of f to meet Equation (8). The p-value of hypothesis testing would have more proper to reflect the reliability of the results than the test statistic and threshold. However, the calculation of the tail probability for each obtained statistics in the method of the p-value is too complicated. Herein, two definitions of f are proposed for simplicity in the application. In what follows, $T_i$ and ${\gamma }_i$ are assumed as non-negative, and this is possible in a proper way. One definition of f can be given as:

$$f_1(T_i,{\gamma }_i)={\left(\frac{1}{2}\right)}^{T_i/{\gamma }_i}$$

(9)

$f_1(T_i,{\gamma }_i)$ is a decreasing function of $T_i/{\gamma }_i$, and it is easy to implement. However, $f_1(T_i,{\gamma }_i)$ descends slowly even if the anomaly is obvious enough. Besides, $f_1(T_i,{\gamma }_i)$ is in a half closed interval $[0,1)$ because the base number of the power function is less than one. Another definition of f is given as:

$$f_2(T_i,{\gamma }_i)=\left\{\begin{array}{cc}{\displaystyle 1-\frac{T_i}{2{\gamma }_i}}\hfill & T_i<2{\gamma }_i\\ 0\hfill & T_i\ge 2{\gamma }_i\end{array}\right.$$

(10)

$f_2(T_i,{\gamma }_i)$ meets Equation (8), as well, and it is in a closed interval $[0,1]$. However, $f_2(T_i,{\gamma }_i)$ descends quickly, and it makes a decision $m_i\left(A\right)=0$ even if the anomaly is not obvious enough. The decision $m_i\left(A\right)=0$ is strong, and it makes an irrevocable decision while all other detectors are meaningless. Figure 2 shows the curves of $f_1(T_i,{\gamma }_i)$ and $f_2(T_i,{\gamma }_i)$, where $T_i/{\gamma }_i$ is plotted on the horizontal axis, and the red line is the threshold to determine “A” or “C”.

As mentioned previously, both $f_1(T_i,{\gamma }_i)$ and $f_2(T_i,{\gamma }_i)$ have weakness in practice. The linear combination of them would be applicable, and it can be given as follows:

$$f(T_i,{\gamma }_i)=\alpha ·f_1(T_i,{\gamma }_i)+(1-\alpha )·f_2(T_i,{\gamma }_i)\alpha \in [0,1]$$

(11)

where α is the weight of $f_1(T_i,{\gamma }_i)$; it can be set according to the actual implementation.

2.3. Performance of Detections’ Fusion

A spoofing detection can be fused with others by the method as mentioned previously, as long as it could be depicted by a hypothesis testing as Equation (6). There are two types of errors in hypothesis testings. One is false alarm and the other is missed detection. The former is the incorrect rejection of the true hypothesis $H_0$, while the latter is the failure to reject the false hypothesis $H_1$. The probabilities of these two errors can be described as follows:

$$\left\{\begin{array}{c}{P}_{fa}=P\left(H_1\right|H_0)\hfill \\ P_{md}=P\left(H_0\right|H_1)\hfill \end{array}\right.$$

(12)

where $P_{fa}$ is the false alarm probability and $P_{md}$ is the missed detection probability. They are contradictory. For a given sample set, $P_{md}$ increases with the reduction of $P_{fa}$, and vice versa. $P_{fa}$ and $P_{md}$ cannot be reduced simultaneously unless the sample size increases, but this is infeasible especially in practice. Detection aiming at data set for a long time cannot reflect the real-time changes of signals. This limits the performance of single spoofing detection. However, it is different in case that multiple detections are fused, because the false alarms would not happen simultaneously in different detectors. This means that false alarms of fused detection would be much less than those of each detector.

Herein, a brief derivation of $P_{fa}$ is given in the case that only two detections are fused. The probabilities of $m_i(·)$ under hypotheses $H_0$ and $H_1$ are denoted as $P_0^{\left(i\right)}$ and $P_1^{\left(i\right)}$, respectively. The false alarm probability of detector $D_i$ is denoted as $P_{fa}^{\left(i\right)}$, and the corresponding missed detection probability is denoted as $P_{md}^{\left(i\right)}$. In the case that only two detections are fused, $m\left(C\right)>0.5$ is equivalent to $m_1\left(C\right)+m_2\left(C\right)>1$, and $m\left(A\right)\ge 0.5$ is equivalent to $m_1\left(A\right)+m_2\left(A\right)\ge 1$. The derivation is provided in Appendix A. Based on Equations (4) and (5), $P_{fa}$ of fused detections can be given as follows:

$$\begin{array}{ccc}{\displaystyle P_{fa}}\hfill & =\hfill & P\left(m\left(A\right)<0.5|H_0\right)=P\left(m\left(C\right)>0.5|H_0\right)\hfill \\ & =\hfill & P_0^{\left(1\right)}\left(m_1\left(C\right)>0.5\right)·P_0^{\left(2\right)}\left(m_2\left(C\right)>1-m_1\left(C\right)|m_1\left(C\right)>0.5\right)\hfill \\ & & +P_0^{\left(2\right)}\left(m_2\left(C\right)>0.5\right)·P_0^{\left(1\right)}\left(m_1\left(C\right)>1-m_2\left(C\right)|m_2\left(C\right)>0.5\right)\hfill \\ & & -P_0^{\left(1\right)}\left(m_1\left(C\right)>0.5\right)·P_0^{\left(2\right)}\left(m_2\left(C\right)>0.5\right)\hfill \\ & <\hfill & P_{fa}^{\left(1\right)}+P_{fa}^{\left(2\right)}-P_{fa}^{\left(1\right)}·P_{fa}^{\left(2\right)}\hfill \end{array}$$

(13)

where 0.5 is the threshold of $m(·)$ to determine the authenticity of the signal. $P_{fa}^{\left(1\right)}+P_{fa}^{\left(2\right)}-P_{fa}^{\left(1\right)}·P_{fa}^{\left(2\right)}$ is the false alarm probability of two detectors if their results are not fused together. In such a case, each false alarm would be mistaken for a spoofing attack no matter in which detector it happens. This can be explained as Figure 3.

The shadow areas in Figure 3a represent the region of false alarms under the hypothesis of $H_0$ in the case that two detections are not fused, while in Figure 3b, the shaded region is lessened in the case that two detectors are fused together. This is the graphical interpretation of the inequality (13). Meanwhile, the dark shaded area in Figure 3a, denoted as $R_1$, represents the region in which false alarms happen simultaneously in both $D_1$ and $D_2$. Denoting the shaded area in Figure 3b as $R_2$, $R_1$ is a subset of $R_2$, i.e., $R_1\subset R_2$. Thus, there is:

$$P_{fa}^{\left(1\right)}·P_{fa}^{\left(2\right)}<P_{fa}$$

(14)

The above inequality can be deduced as follows:

$$\begin{array}{ccc}{\displaystyle P_{fa}}\hfill & =\hfill & P\left(m_1\left(C\right)+m_2\left(C\right)>1|H_0\right)\hfill \\ & =\hfill & P_0^{\left(1\right)}\left(m_1\left(C\right)<0.5\right)·P_0^{\left(2\right)}\left(m_2\left(C\right)>1-m_1\left(C\right)|m_1\left(C\right)<0.5\right)\hfill \\ & & +P_0^{\left(2\right)}\left(m_2\left(C\right)<0.5\right)·P_0^{\left(1\right)}\left(m_1\left(C\right)>1-m_2\left(C\right)|m_2\left(C\right)<0.5\right)\hfill \\ & & +P_0^{\left(1\right)}\left(m_1\left(C\right)>0.5\right)·P_0^{\left(2\right)}\left(m_2\left(C\right)>0.5\right)\hfill \\ & & >P_{fa}^{\left(1\right)}·P_{fa}^{\left(2\right)}\hfill \end{array}$$

(15)

Based on Equations (13) and (14), the range of $P_{fa}$ can be given as:

$$P_{fa}^{\left(1\right)}·P_{fa}^{\left(2\right)}<P_{fa}<P_{fa}^{\left(1\right)}+P_{fa}^{\left(2\right)}-P_{fa}^{\left(1\right)}·P_{fa}^{\left(2\right)}$$

(16)

Meanwhile, $P_{md}$ of fused detections can be given as follows:

$$\begin{array}{ccc}{\displaystyle P_{md}}\hfill & =\hfill & P\left(m\left(A\right)\ge 0.5|H_1\right)\hfill \\ & =\hfill & P_1^{\left(1\right)}\left(m_1\left(A\right)\ge 0.5\right)·P_1^{\left(2\right)}\left(m_2\left(A\right)\ge 1-m_1\left(A\right)|m_1\left(A\right)\ge 0.5\right)\hfill \\ & & +P_1^{\left(2\right)}\left(m_2\left(A\right)\ge 0.5\right)·P_1^{\left(1\right)}\left(m_1\left(A\right)\ge 1-m_2\left(A\right)|m_2\left(A\right)\ge 0.5\right)\hfill \\ & & -P_1^{\left(1\right)}\left(m_1\left(A\right)\ge 0.5\right)·P_1^{\left(2\right)}\left(m_2\left(A\right)\ge 0.5\right)\hfill \\ & <\hfill & P_{md}^{\left(1\right)}+P_{md}^{\left(2\right)}-P_{md}^{\left(1\right)}·P_{md}^{\left(2\right)}\hfill \end{array}$$

(17)

where $P_{md}^{\left(1\right)}+P_{md}^{\left(2\right)}-P_{md}^{\left(1\right)}·P_{md}^{\left(2\right)}$ is the missed detection probability of two detectors if their results are not fused together. Each missed detection cannot be re-examined in the case that two detectors are not fused. Similar to Equation (14), there is:

$$P_{md}>P_{md}^{\left(1\right)}·P_{md}^{\left(2\right)}$$

(18)

Based on Equations (17) and (18), the range of $P_{md}$ can be given as:

$$P_{md}^{\left(1\right)}·P_{md}^{\left(2\right)}<P_{md}<P_{md}^{\left(1\right)}+P_{md}^{\left(2\right)}-P_{md}^{\left(1\right)}·P_{md}^{\left(2\right)}$$

(19)

The range of $P_{fa}$ and $P_{md}$, Equations (16) and (19), just provides rough boundaries of $P_{fa}$ and $P_{md}$. They clearly show that both $P_{fa}$ and $P_{md}$ in the case of fusion are less than the corresponding values in the case that detections are not fused. The actual ranges depend on the performance of the detectors, which are fused. Monte Carlo simulations based on two detectors are given in the following section to demonstrate the performance of fusion.

The above discussions are based on the fusion of two detectors. Actually, the combination rule of Equation (4) is associative, that is:

$$m_1\oplus m_2\oplus m_3=m_1\oplus (m_2\oplus m_3)=m_1\oplus m_2^{\prime }$$

(20)

where ⊕ represents the operation of the combination and $m_2^{\prime }$ represents the combination of $m_2$ and $m_3$. The derivation of the associative law is provided in Appendix B. Equation (20) means that the combination of multiple detections can be equivalent to the combination of two detections after some of them are fused together. Thus, discussions about two detections are sufficient to extend to the cases of multiple detections.

3. Performance Evaluation

A model of detections’ fusion has been given, and the valuation of the belief function has been proposed in the above section. In order to evaluate the performance of the method, simulations based on the fusion of two spoofing detections are provided in this section.

3.1. Two Detectors

Herein, two detectors, monitoring the correlator outputs and consistency of Doppler, are given. They aim at different features of GNSS signal and provide different evidence of the authenticity of the signal.

3.1.1. Monitoring of Correlator Outputs

Monitoring of the received signal power is a usual method of spoofing detection, and it can be implemented in several ways, such as the monitoring of absolute power, $C/N_0$ and the correlator outputs [8]. The anomaly of correlator outputs reflects the abnormal change of the power of received GNSS signals. Some methods have been proposed to monitor the correlator outputs, such as testing the goodness of fit based on the ${\chi }^2$ distribution [10,15], Herein, another practical way of correlator output monitoring is proposed.

In the case of the spoofing attack, it is difficult for the spoofer to calibrate the power of the spoofing signal to maintain a stable level at the target receiver because of the uncertainty of the relative motion between spoofer and receiver. Besides, correlator outputs may be abnormal because the tracking loop is disturbed by spoofing. Monitoring the stationarity of correlation values is a practical way to detect the anomaly of the signal. Denote the correlator outputs in time k as $r\left[k\right]$. There are jumps in correlator outputs because of the change of navigation data. Denote $x\left[k\right]$ as:

$$x\left[k\right]=D\left[k\right]·r\left[k\right]$$

(21)

where $D\left[k\right]$ represent the navigation data and its value is one or −1. Then, $x\left[k\right]$ can be approximated as a Gaussian random variable because it is determined by several factors, such as signal power, tracking errors, noise, etc. Assuming that the signal is locked and the parameters of the receiver do not change, the mean value of $x\left[k\right]$ reflects the power of the signal while the variance of $x\left[k\right]$ represents other effects, such as noise and errors. The outputs of the correlator are steady in the case of authentic signals and unsteady in the case of the spoofing attack. Denote two sample sets of correlator outputs in different times as $X=\left\{x\right[1],x[2],\cdots ,x[K\left]\right\}$ and $Y=\left\{y\right[1],y[2],\cdots ,y[K\left]\right\}$; they conform to a Gaussian distribution as:

$$\left\{\begin{array}{c}X\sim N({\mu }_x,{\sigma }_x^2)\hfill \\ Y\sim N({\mu }_y,{\sigma }_y^2)\hfill \end{array}\right.$$

(22)

As mentioned previously, the mean value reflects the power of the signal, while the variance represents the effects of random factors. Therefore, the spoofing detection based on the monitoring of correlator outputs can be equivalent to the following hypothesis testing:

$$\left\{\begin{array}{cc}{H}_0:& {\mu }_x={\mu }_y\\ H_1:& {\mu }_x\ne {\mu }_y\end{array}\right.$$

(23)

Assuming ${\sigma }_x^2={\sigma }_y^2={\sigma }^2$ and because ${\sigma }^2$ is unknown, define the test statistic as follows:

$$T=\sqrt{K}·\frac{\overline{x}-\overline{y}}{\sqrt{{\widehat{\sigma }}_x^2+{\widehat{\sigma }}_y^2}}$$

(24)

where $\overline{x}$ and $\overline{y}$ are the mean value of X and Y with a data length of K and ${\widehat{\sigma }}_x^2$ and ${\widehat{\sigma }}_y^2$ are estimations of X and Y, respectively. $({\widehat{\sigma }}_x^2+{\widehat{\sigma }}_y^2)/2$ is an unbiased estimation of the variance of sample group $\{X,Y\}$; $\overline{x}$ and ${\widehat{\sigma }}_x^2$ are given as:

$$\left\{\begin{array}{c}{\displaystyle \overline{x}=\frac{1}{K}\sum _{k=0}^{K-1}x\left[k\right]}\hfill \\ {\displaystyle {\widehat{\sigma }}_x^2=\frac{1}{K}\sum _{k=0}^{K-1}{\left(x\left[k\right]-\overline{x}\right)}^2}\hfill \end{array}\right.$$

(25)

$\overline{y}$ and ${\widehat{\sigma }}_y^2$ can be obtained in the same way. The test statistic as Equation (24) has been used for GPS interference detection [16]. Under hypothesis $H_0$, the test statistic conforms to Student’s t distribution with $2K-2$ degrees of freedom [17] as follows:

$$T\sim t(2K-2)$$

(26)

Thus, Equation (23) is equivalent to:

$$\left\{\begin{array}{cc}{H}_0:& \left|T\right|\le \gamma \\ H_1:& \left|T\right|>\gamma \end{array}\right.$$

(27)

where γ is the threshold of detection, and it can be given as follows:

$$\gamma =Q_{t(2K-2)}^{-1}(1-P_{fa}/2)$$

(28)

where $Q_{t(2K-2)}^{-1}(·)$ represents the inverse function of the cumulative density function (CDF) of Student’s t distribution.

3.1.2. Consistency Check of Doppler

Doppler shift is generated by the relative motion of the satellite and receiver. The carrier Doppler shift of the GNSS signal must be consistent with its code Doppler shift. However, this is not satisfied in some cases of the spoofing attack. Thus, the consistency check of Doppler can be used for spoofing detection. A brief introduction of this method is given herein.

As a consequence of the formula of Doppler shift, the pseudo-code Doppler of the GNSS signal is proportional to the carrier Doppler; the proportionality coefficient is given as follows:

$$\alpha =\frac{f_{D\_code}}{f_{D\_carrier}}=\frac{f_{code}}{f_{carrier}}$$

(29)

where $f_{D\_code}$ is the Doppler shift of pseudo-code and $f_{D\_carrier}$ is the Doppler shift of the carrier and $f_{D\_code}$. $f_{code}$ is the code rate of the pseudo-code, and $f_{carrier}$ is the carrier frequency. For example, the coefficient of the GPS L1 C/A signal is:

$$\alpha =\frac{f_{D\_code}}{f_{D\_carrier}}=\frac{1.023\times {10}^6}{1575.42\times {10}^6}=\frac{1}{1540}$$

(30)

Not just the Doppler of the pseudo-code and carrier, but a similar relationship exists between signals of different frequencies from one satellite, so the consistency check can apply to them. Based on Equation (29), define:

$$x=f_{D\_code}-\alpha f_{D\_carrier}$$

(31)

The equivalent hypothesis testing of the consistency check of Doppler can be written as follows:

$$\left\{\begin{array}{cc}{H}_0:& x\left[k\right]=w\left[k\right]\hfill \\ H_1:& x\left[k\right]=A+w\left[k\right]\hfill \end{array}\right.$$

(32)

A is a non-zero bias between carrier Doppler and code Doppler, and $w\left[k\right]$ represents the noise and error of measurements. Assuming that $w\left[k\right]$ conforms to a zero mean Gaussian distribution, $x\left[k\right]$ can be described as:

$$x\sim N(\mu ,{\sigma }^2)$$

(33)

where μ and ${\sigma }^2$ represent the mean value and variance. Hypothesis testing of Equation (32) is equivalent to:

$$\left\{\begin{array}{cc}{H}_0:& \mu =0\\ H_1:& \mu \ne 0\end{array}\right.$$

(34)

As ${\sigma }^2$ is unknown, define the test statistic as follows:

$$T=\frac{\sqrt{K}·\overline{x}}{\widehat{\sigma }}$$

(35)

where $\overline{x}$ is the mean value of the observed data of $x\left[k\right]$ with data length K, and $\widehat{\sigma }$ represents the maximum likelihood estimation (MLE) of σ; they can be obtained as Equation (25). The test statistic conforms to Student’s t distribution with $K-1$ degrees of freedom [17] under hypothesis $H_0$ as follows:

$$T\sim t(K-1)$$

(36)

Therefore, the detection as Equation (27) can be used for the consistency check of Doppler, as well as the threshold is obtained by a similar way as Equation (28).

3.2. Simulation Results

There are two parts of the simulations in this section. The first is the Monte Carlo simulation of the performance of fusion, and the second aims at public test datasets. Monitoring of correlator outputs and the consistency check of Doppler shifts, which have been discussed previously, are employed and fused together in what follows. Their test statistics are denoted as $T_1$ and $T_2$, which correspond to Equations (24) and (35). The corresponding belief functions are denoted as $m_1(·)$ and $m_2(·)$, respectively. Both detectors adopt the same false alarm probability denoted as $P_{fa}^{\left(i\right)}$.

3.2.1. Probabilities of False Alarm and Detection

The performance of a detector can be depicted by the receiver operating characteristics (ROC) curve, which illustrates the relationship of false alarm probability $P_{fa}$ and detection probability $P_d$. Here, detection probability $P_d$ can be obtained as:

$$P_d=P\left(H_1\right|H_1)=1-P\left(H_0\right|H_1)=1-P_{md}$$

(37)

In the following Monte Carlo simulations, a dataset that conforms to a standard normal distribution is employed. The false alarm probability of fused detection is counted based on the detection results. Then, a bias, denoted as A, is added to the dataset to simulate the anomaly of measurements. For the first detector, A is added to the difference of mean value $\overline{x}-\overline{y}$. The results of two detectors and fused detection are counted. The results are shown in Figure 4 and Figure 5.

Figure 4 shows the simulation results of false alarms. The horizontal axis represents $P_{fa}^{\left(i\right)}$, while the vertical axis shows the rate of false alarms that happened in simulations. Here, the rate of false alarm is denoted as $R_{fa}$; it is tallied in Monte Carlo simulations. Two red curves in Figure 4 give the rough bounds of $P_{fa}$, which has been described in Equation (16). The blue curve is the $R_{fa}$ of fusion. It can be observed that fused $R_{fa}$ is between two boundaries. Moreover, in a practical range, $R_{fa}$ is less than $P_{fa}^{\left(i\right)}$, which is plotted in the green curve, and this means that false alarms are reduced by fusion.

ROC curves are plotted in Figure 5. In the simulations, two different normalized biases A are tested, and the corresponding results are plotted in dashed lines and solid lines. In both cases, blue curves are higher than the corresponding red and green curves. This means that the detection performance is improved by the fusion. It should be noted that the ROC curves of fusion take account of the reduction of false alarms, which is shown in Figure 4. Simulation results with other $A/{\sigma }^2$ are similar to them.

Actually, the improvement of detection performance is reasonable, because the data size of multiple detections’ fusion is much larger than the data size of single detection, while the fusion does not extend the time of detection.

3.2.2. Test Results on TEXBAT

Simulations of multiple detections’ fusion based on the proposed method are provided next. The test data are from TEXBAT, which is a public dataset of eight high-fidelity digital recordings of live static and dynamic GPS L1 C/A spoofing tests. It is conducted by the Radio Navigation Laboratory of the University of Texas at Austin, and each scenario in TEXBAT has been described in detail in [18]. In Scenario 1 of TXBAT, the counterfeit signals substitute all authentic GNSS signals instantaneously; the power of counterfeit signals is much weaker than the authentic. In Scenario 2, the spoofer increases the power of the counterfeit signal, and it has a 10-dB power advantage; this is an obvious power attack. Moreover, the spoofer changes the counterfeit signals’ carrier phase proportionally when it shifts the code phase to induce a position or timing deviation in the target receiver. The power advantage of counterfeit signals is common in the next scenarios, but it is reduced. In Scenario 3, the spoofer fixes the carrier phase offset between the counterfeit signals and the authentic signals when it shifts the code phase of counterfeit signals. Scenario 4 is identical to Scenario 3, except that the power advantage of the counterfeit signal is reduced again. Static Scenarios 1∼4 are tested, and the results are discussed in this section. In each scenario, the detection results of just one satellite, GPS PRN 6, is discussed because the results of most satellites in the same scenario are similar.

In the following tests, a software-defined GPS receiver is employed. Common acquisition and tracking algorithms of GPS signals are implemented in the receiver where a phase-locked loop (PLL) is used for carrier tracking and a common delay lock loop (DLL) is used for code tracking. The coherent integration time is 1 ms in the receiver, and a measurement is obtained per one millisecond. The detection time is 50 milliseconds as the sample size is K = 50. The time interval of two sample sets, X and Y, is 1 s. This time interval can be set according to the application scenario. Herein, the short interval is conducive to improve the real-time capability of detectors. Besides, false alarm probabilities or significance levels are set as $P_{fa}=0.005$ in both detections.

Figure 6 shows the test results of the clean static dataset where the GPS signals are not disturbed by counterfeit signals. It can be observed that there is a small number of false alarms in both two detections, and they disappear in the fused results. Reduction of false alarms is coincident with the curve in Figure 4, and it suggests that higher $P_{fa}^{\left(i\right)}$ can be adopted to obtain a lower $P_{md}^{\left(i\right)}$ in each detector before the fusion.

Test results of Scenario 1 for GPS PRN 6 are shown in Figure 7. The sudden replacement of the signals and the power difference disturbed the correlator and tracking loop. It can be observed that an obvious change of correlator outputs occurs at about 125 s in the time history, and an anomaly between carrier Doppler and code Doppler is detected at the same time, although the signal is tracked and locked by the receiver in the whole process.

Figure 8 shows the fused results of two detections of Scenario 2. They are similar to the results of Scenario 1; the appearance of counterfeit signals with the power advantage makes two detectors issue alarms simultaneously at about 110 seconds. Moreover, with the shift of the carrier phase and code phase, the consistency of carrier Doppler and code Doppler is not met. Meanwhile, correlator outputs are not stationary because the tracking loop is disturbed. These are reflected in the figure.

The fused results based on Scenarios 3 and 4 are shown in Figure 9 and Figure 10, respectively. In Scenario 3, the spoofer’s power advantage is weaker than the case of Scenario 2, but it still can be detected by the monitoring of correlator outputs. Besides, it can be observed in Figure 10 that the fused result exceeds the threshold at about 160 seconds, even though the second detector does not raise the alarm. This shows the robustness of the fusion method.

It can be observed from the above results that decisions after the fusion are more distinguishable than before the fusion. It should be noted that stable tracking conditions are crucial to obtain the test statistics; however, the stability of tracking cannot be guaranteed under the spoofing attack. Actually, in the above tests, tracking conditions are stable for most of the time, except sometimes in the tests of Scenarios 3 and 4. In test of Scenario 3, the receiver failed to track and lock the signal for about fifteen seconds at about 160 s in the time history. In this period, the receiver attempted to track and lock the signal; the test statistics based on the outputs of tracking loop cannot reflect the real conditions. However, failure to lock the signal indicates the anomalies of the signal. It is reasonable that detectors issue alarms to declare the unavailability of the signal in this case.

The above simulations illustrate the process and effect of the detections’ fusion. It can be observed on them that the fusion of multiple detections reduces the false alarms and makes the results more reliable. Only two detectors are fused in this section. However, a complete anti-spoofing method should employ more detectors and fuse them together.

4. Conclusions

As long as a spoofing detection could be depicted as a hypothesis testing, it can be fused with others by the method that is proposed in this paper. A key point of the fusion method is to simplify the discernment frame in order to assign the belief functions for spoofing detection results. Most of the spoofing detections are equivalent to hypothesis testings. The deviation degree of the test statistic and threshold represents the reliability of the measurement, and it is the basis of the belief function of the spoofing detection result. The performance evaluation and simulations based on two detections are provided in the paper. The proposed method improves the performance of spoofing detection and makes the results more reliable. The root cause of improvement is the increase of the detection data. However, there are some questions to be solved; for example, the evidence from different detections should be independent, but this may not be true in spoofing detections because some measurements are related in the GNSS receiver, such as $C/N_0$ and correlation values, while some measurements are independent, such as $C/N_0$ and Doppler shift. Besides, the selection of detectors to be fused in a specific scenario and the assignment of weightings for them are problems to be studied.