Resilient Cooperative Localisation for EVs Using V2X Sidelink Measurements Under Hybrid Cyber-Attacks: A Deep Learning-Based Physical-Layer Security Framework

Abstract

In this work, we explore resilient cooperative localisation for electric vehicles subject to the hybrid attack of gradual global navigation satellite system (GNSS) drag-off spoofing along with received signal strength indicator (RSSI) jamming. In order to mitigate such attacks, a deep learning-based physical-layer security approach is presented. The presented approach includes a long short-term memory (LSTM) detector for attack detection, a regression-based RSSI signal purifier, and a cooperative fusion scheme, which decreases the dependence on the GNSS branch in case of attack detection. The proposed approach is validated via the Berlin Vehicle-to-Everything (V2X) dataset with respect to six scenarios, including benign GNSS-only and cooperative localisation, attacked localisation without defence, and attacked localisation with physical-layer security support. According to the experimental evaluation results, the considered hybrid attack significantly impacts the localisation accuracy, leading to an increase in the GNSS-only localisation error to root mean square error (RMSE) = 149.93 m, mean absolute error (MAE) = 129.81 m, and maximum error = 259.62 m. At the same time, the proposed cooperative localisation with physical-layer security decreases the attacked cooperative localisation error to RMSE = 4.00 m, MAE = 3.51 m, and maximum error = 12.01 m.

1. Introduction

The high rate of electrification and automation in the automobile sector has made electric vehicles (EVs) a key component of connected and autonomous transport systems. In order to attain high autonomy, electric vehicles make extensive use of cooperative intelligent transport systems (C-ITS) [1], where the global navigation satellite system (GNSS) signal is used along with Vehicle-to-Everything (V2X) communication to exchange kinematic information with the surroundings to ensure safe operation [2,3,4]. As shown in Figure 1, the major drawback associated with the operation of EVs is the fact that the accuracy of the location information is dependent on unauthenticated wireless signals.

Vehicular localisation is highly vulnerable to physical-layer attacks [5,6]. An attacker can gradually bias the GNSS solution through spoofing [7,8,9], while simultaneously degrading the cooperative verification channel through received signal strength indicator (RSSI) jamming [10,11,12]. Even though a lot of research has been dedicated to using upper-layer cryptography for secure data, this cannot be achieved with physical signals [13]. In addition, most countermeasures are based on static thresholds or standard Kalman filtering, which are not capable of differentiating between a coordinated attack, referred to as drag-off, and natural channel fading [14,15]. Although prior studies have investigated GNSS anti-spoofing, V2X misbehaviour detection, and deep learning-based RSSI processing separately, the protection of cooperative EV localisation against coordinated GNSS drag-off spoofing and RSSI jamming remains insufficiently addressed.

To address this important problem, a physical-layer security (PLS)-assisted cooperative localisation framework based on cooperative localisation is proposed in this research. Instead of discarding the noisy data, a deep learning (DL) method is utilised to characterise and filter the interference of the signal. The deep learning module acts as a defensive physical-layer processing stage and corrects the vehicle trajectory based on the reliability of the V2X ranging information. The key contributions of this paper are summarised as follows:

i

Modelling of Hybrid Cyber-Attacks: We formulate a hybrid attack model combining gradual GNSS drag-off spoofing with high-variance RSSI jamming for cooperative EV localisation.

ii

Deep Learning-Based PLS Architecture: We design a dual-stage deep learning architecture comprising a long short-term memory (LSTM) network for real-time attack detection and a regression-based autoencoder for signal purification within the localisation loop.

iii

Resilient Cooperative Fusion: We demonstrate that the proposed PLS-assisted cooperative fusion framework can substantially reduce the localisation error under the considered hybrid attack scenario, lowering the RMSE from 149.93 m to 4.00 m in the attacked cooperative case.

The rest of this paper is organised as follows. In Section 2, the related work on GNSS spoofing, V2X misbehaviour detection, DL-based localisation, and PLS is discussed. In Section 3, the PLS-based cooperative localisation system is introduced, including the system model, threat model, deep learning-based PLS system, and simulation settings. In Section 4, the quantitative results are provided, including detector performance, signal purification behaviour, and localisation performance under the six considered scenarios. Finally, the conclusions are provided in Section 5.

2. Related Work

In this section, the main research lines regarding this work are briefly described: Section 2.1 GNSS spoofing and jamming in connected and autonomous vehicles, Section 2.2 misbehaviour and intrusion detection in V2X networks, and Section 2.3 deep learning techniques for RSSI-based localisation and PLS. The purpose is to point out the gap remaining in the protection of platooning EVs against hybrid drag-off and jamming attacks using physical-layer machine learning.

2.1. GNSS Spoofing and Jamming in Vehicular Localisation

The susceptibility of GNSS systems to spoofing and jamming attacks has been widely discussed. Previous studies on detecting GNSS spoofing attacks in vehicle navigation systems have primarily relied on detecting sudden position jumps or inconsistencies in pseudorange residuals using simple thresholding, receiver autonomous integrity monitoring (RAIM), or Kalman filter innovation methods [16,17,18,19]. Although these methods perform well against simple drag-off attacks, they perform poorly when confronted with more sophisticated attacks where the position bias is gradually applied to avoid triggering a static detector. More recent studies have also focused on sophisticated spoofing techniques for connected and autonomous vehicles, such as drag-off attacks that maintain a nominal error envelope for a long period of time [7,20]. Some studies have also proposed infrastructure-aided verification or even multiple-antenna-based angle-of-arrival detection methods [21,22,23]. However, these methods are not always feasible in a mixed-traffic environments due to a lack of infrastructure. In parallel, GNSS jamming has been investigated as Denial-of-Service attacks with wideband interference to saturate the front-end and degrade the carrier-to-noise ratio [24]. Conventional mitigation techniques rely on adaptive notch filtering and/or array processing at the radio-frequency (RF) front-end, which again requires special hardware and does not address the question of how the navigation engine should react if both GNSS and cooperative ranging become unreliable [25]. Moreover, these methods mainly protect the GNSS branch itself and do not explain how localisation should be recovered when the cooperative V2X ranging channel is simultaneously degraded.

2.2. Misbehaviour and Intrusion Detection in V2X Networks

At the V2X level, a significant body of work is dedicated to misbehaviour detection and intrusion detection systems (IDSs) for vehicular networks [26]. Most of these methods are based on network- and application-layer approaches that monitor the content of messages and their conformity to the road topology and vehicle dynamics in order to identify unrealistic cooperative awareness messages (CAMs) and basic safety messages (BSMs) [27,28,29]. Such methods are particularly useful for identifying fake information and Sybil attacks [30]. However, most of these methods depend on the reliability of the underlying physical information [31,32]. Recently, machine learning-based IDS approaches have been proposed for V2X communication, which utilise the advantages of the packet time, message sequence, and flow statistics [33,34]. Hybrid models using convolutional neural network (CNN) and LSTM techniques have been proposed to effectively identify complex attacks in intelligent transport systems operating at 5.9 GHz (ITS-G5) and Cellular Vehicle-to-Everything (C-V2X) networks [35]. However, these approaches primarily concentrate on the security of the higher layers of the protocols, such as Denial-of-Service (DoS), flooding, and replay attacks, rather than physical-layer attacks like RSSI jamming and GNSS spoofing [36]. They do not address the integrity of the lane-level localisation measurements. Consequently, although such methods are useful for detecting higher-layer vehicular misbehaviour, they do not directly resolve the corruption of the physical measurements used by the localisation engine.

2.3. Deep Learning for RSSI-Based Localisation and Physical-Layer Security

Deep learning has also been employed in improving wireless localisation and PLS techniques [37]. For wireless localisation in indoor and urban environments, several works have employed feed-forward networks, CNNs, LSTMs, and autoencoders in improving localisation estimates based on RSSI fingerprints, moving beyond traditional log-distance path loss models [38,39,40,41,42]. These works prove the effectiveness of neural networks in learning complex relationships from noisy data using temporal convolutional network (TCN) RSSI time-series data and in improving localisation estimates significantly compared to traditional path loss models [43]. In the framework of PLS, deep learning techniques have been considered for PLS channel authentication, the detection of eavesdroppers, and the detection of jamming attacks in 5G and beyond-5G systems [44,45,46,47]. The most popular approaches rely on CNNs and recurrent neural networks (RNNs) for the detection of malicious links based on channel state information (CSI), RSSI-based distributions, and constellation diagrams [48,49]. Although these studies prove the effectiveness of PLS by significantly enhancing it via AI-based classifiers, the decision process is not completed by a feedback loop to correct the trajectory based on clean measurements. Moreover, most of these studies treat localisation enhancement, signal denoising, or physical-layer attack detection separately, rather than integrating detection, purification, and defensive fusion within one cooperative localisation pipeline.

2.4. Gap Analysis and Distinction of This Work

The existing GNSS anti-spoofing and anti-jamming techniques have mainly focused on GNSS-based detection or additional RF-based techniques. Studies on the detection of misbehaviour and IDSs in V2X have considered message integrity in higher layers, while those on deep learning-based localisation and PLS have considered security and localisation separately, as shown in

Table 1. Comparative positioning of the proposed framework against representative prior work.

Reference	Work	Attack Model	Defence Stage	Cooperative Fusion?	Reported Outcome
[19]	RAIM	GNSS spoofing (jump)	GNSS only	No	Detection only
[16]	Kalman filter-based global positioning system (GPS)/INS	GPS spoofing	GPS/INS Kalman filter	Yes (filter)	Few-metre horizontal error
[18]	Particle filter localisation	GNSS spoofing	Particle filter	Yes	Few-metre error
[33,39]	CNN-LSTM V2X IDS	DoS/replay (upper layer)	Upper-layer IDS	No	High F1, no localisation error
[43]	TCN RSSI localisation	Indoor noise	RSSI localisation	Single link	≈metre-level (indoor)
[47]	DL RSSI denoising	Indoor noise	RSSI denoising	Single link	≈metre-level (indoor)
[46]	PLS channel authentication	PLS spoofing	Channel level	No	Detection only
	This work (proposed)	Hybrid drag-off + RSSI jamming	PLS (LSTM + autoencoder)	Yes (GNSS + V2X)	RMSE 4.00 m under attack

. To the best of the authors’ knowledge, three main gaps are not fully addressed. These gaps are summarised as follows:

i

A hybrid drag-off + jamming attack specifically targeting lane-level localisation in autonomous EV platoons;

ii

A dual-stage deep learning-based PLS framework that both detects and denoises physical-layer measurements (via an LSTM sentinel and a regression-based cleaner);

iii

A cooperative fusion engine that dynamically reweights GNSS and V2X ranging based on the PLS decision, explicitly aiming to prevent the off-road divergence of the EV trajectory on real V2X measurement data (Berlin V2X) [50].

The presented framework integrates deep learning components into a closed-loop physical-layer defence pipeline for cooperative localisation. As per Section 3.2, the attack detection occurs in the PLS layer using the LSTM-based sentinel, followed by the purification of the jammed sidelink RSSI using the regression autoencoder. The purified RSSI feeds the cooperative fusion layer, which down-weights the (possibly spoofed) GNSS layer under attack at the same time. The novelty of the present work does not lie in proposing a new standalone learning model but in the integration of detection, RSSI purification, and cooperative fusion against a coordinated GNSS drag-off spoofing and RSSI jamming threat. LSTM classifiers for anomaly detection in time-series, autoencoder-style regression for the denoising of input data, and weighted GNSS-V2X fusion are all known techniques. However, the novelty is in the closed-loop integration of these building blocks against a particular type of joint drag-off + jamming threat at the physical layer for autonomous EV platoons, which has been previously overlooked, to the best of our knowledge.

Finally, the empirical evaluation on the publicly available Berlin V2X dataset shows that the proposed closed-loop defence substantially reduces the localisation error under the considered hybrid attack scenario, while remaining within the same order of magnitude as the benign cooperative baseline.

3. PLS-Assisted Cooperative Localisation Framework

This framework was formulated for analysing the impact of deep learning physical-layer protection mechanisms on electric vehicle localisation under coordinated spoofing and jamming attacks. In the process, the target vehicle is assumed to receive the GNSS position estimation and V2X sidelink signal, which include the RSSI and signal-to-noise ratio (SNR) measurements. Under normal circumstances, both sensors will be exploited in localising the target vehicle. However, under adversarial conditions, the GNSS sensor is spoofed and the V2X sensor is jammed. As such, the aim of the proposed framework is to detect the attack and cleanse the RSSI measurement of any contamination. To achieve this objective, a deep learning-based physical-layer security module is introduced, as illustrated in Figure 2.

3.1. System and Threat Model

Let the true horizontal position of the target vehicle at discrete time step $t$ be denoted by

$${\mathit{p}}_{true}\left(t\right)=\left[\begin{array}{c}{\varphi }_{true}\left(t\right)\\ {\lambda }_{true}\left(t\right)\end{array}\right]$$

(1)

where ${\varphi }_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right)$ and ${\lambda }_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right)$ are the true latitude and longitude, respectively.

Under spoofing, the GNSS observation is gradually displaced from the true position according to

$${\mathbf{p}}_{\mathbf{gps}}\left(t\right)={\mathbf{p}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right)+t\left[\begin{array}{c}{\delta }_{\varphi }\\ {\delta }_{\lambda }\end{array}\right]$$

(2)

where ${\mathbf{p}}_{\mathrm{gps}}\left(t\right)$ is the spoofed GNSS position, ${\delta }_{\varphi }$ is the latitude drift rate, and ${\delta }_{\lambda }$ is the longitude drift rate introduced by the attacker. This formulation represents a drag-off attack in which the position error grows progressively rather than appearing as an abrupt jump. In benign operation, the GNSS observation is instead written as

$${\mathbf{p}}_{\mathbf{gps}}\left(t\right)={\mathbf{p}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right)+{\mathbf{n}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)$$

(3)

where ${\mathbf{n}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)$ is the nominal GNSS perturbation.

Let ${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{r}\mathrm{a}\mathrm{w}}\left(t\right)$ denote the clean sidelink RSSI measurement at time step $t$. Under jamming, the observed RSSI becomes

$${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)={\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{r}\mathrm{a}\mathrm{w}}\left(t\right)+n_{\mathrm{j}\mathrm{a}\mathrm{m}}\left(t\right)$$

(4)

where ${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)$ is the jammed observation and $n_{\mathrm{j}\mathrm{a}\mathrm{m}}\left(t\right)$ is the injected jamming term. In benign operation, the observation is represented as

$${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)={\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{r}\mathrm{a}\mathrm{w}}\left(t\right)+n_{\mathrm{b}\mathrm{e}\mathrm{n}\mathrm{i}\mathrm{g}\mathrm{n}}\left(t\right)$$

(5)

where $n_{\mathrm{b}\mathrm{e}\mathrm{n}\mathrm{i}\mathrm{g}\mathrm{n}}\left(t\right)$ denotes ordinary measurement noise. The purpose of the PLS stage is therefore to distinguish between nominal RSSI variation and hostile RSSI corruption before the corrupted measurements are used in localisation.

For the RF-based ranging model, let $P_{\mathrm{T}\mathrm{X}}$ denote the transmit power, $n$ denote the path loss exponent (PLE), and ${\widehat{d}}_{\mathrm{r}\mathrm{f}}\left(t\right)$ denote the range estimate inferred from the purified RSSI. The log-distance inversion used in the code is

$${\widehat{d}}_{\mathrm{r}\mathrm{f}}\left(t\right)={10}^{{\displaystyle \frac{P_{\mathrm{T}\mathrm{X}}-{\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\left(t\right)}{10n}}}$$

(6)

where ${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\left(t\right)$ is the reconstructed RSSI after purification. Although the RF-only branch is part of the wider simulation code, the present manuscript focuses only on the six scenarios associated with GNSS-only, cooperative, and PLS-assisted cooperative localisation.

3.2. Deep Learning-Based Physical-Layer Security Layer

The PLS layer processes physical-layer measurements as short temporal sequences. At each time step $t$, the detector input feature vector is defined as

$$\mathbf{x}\left(t\right)=\left[\begin{array}{c}SNR\left(t\right)\\ {\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)\end{array}\right]$$

(7)

where $\mathrm{S}\mathrm{N}\mathrm{R}\left(t\right)$ is the SNR and ${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)$ is the potentially jammed RSSI. The corresponding temporal input sequence is

$$\mathbf{X}\left(t\right)=\left[\mathbf{x}\left(t-L+1\right),\mathbf{x}\left(t-L+2\right), \dots ,\mathbf{x}\left(t\right)\right]$$

(8)

where $L$ is the detector sequence length. This sequence is supplied to the LSTM detector, which produces a binary decision

$$\widehat{a}\left(t\right)=f_{\mathrm{L}\mathrm{S}\mathrm{T}\mathrm{M}}\left(\mathbf{X}\left(t\right)\right)$$

(9)

where $f_{\mathrm{L}\mathrm{S}\mathrm{T}\mathrm{M}}(\cdot )$ denotes the detector mapping and $\widehat{a}\left(t\right)\in \left\{\mathrm{0,1}\right\}$ is the estimated attack label. A value of $\widehat{a}\left(t\right)=1$ indicates that the current sidelink condition is classified as attacked.

The detector is trained on synthetically labelled data. Let $a_i\in \left\{\mathrm{0,1}\right\}$ denote the label assigned to the $i$-th training sample, where $a_i=0$ indicates a safe sample and $a_i=1$ indicates a jammed sample. The attacked training RSSI is formed as

$${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_i^{\mathrm{a}\mathrm{t}\mathrm{k}}={\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_i+n_i$$

(10)

where ${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_i$ is the clean RSSI and $n_i$ is the injected jamming perturbation. The corresponding training sequence label is then taken from the terminal element of each temporal window,

$$y_k=a_{k+L-1}$$

(11)

Thus, the detector learns to classify short temporal segments as safe or attacked based on the joint behaviour of the SNR and RSSI. The exact architectural and optimisation settings are summarised later in the implementation table.

Once an attack is indicated, the observed RSSI is purified by a regression-based cleaner. Let $g_{\mathrm{r}\mathrm{e}\mathrm{g}}(\cdot )$ denote the cleaner mapping. The reconstructed signal is

$${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\left(t\right)=g_{\mathrm{r}\mathrm{e}\mathrm{g}}\left({\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)\right)$$

(12)

If no attack is detected, the measurement is left unchanged and

$${\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\left(t\right)={\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}_{\mathrm{o}\mathrm{b}\mathrm{s}}\left(t\right)$$

(13)

The cleaner is trained using jammed–clean RSSI pairs, where the corrupted RSSI serves as input and the corresponding clean RSSI serves as the target. In this way, the LSTM and the regression network perform complementary roles: the detector identifies the presence of hostile channel activity, whereas the cleaner reconstructs a more usable sidelink signal for localisation.

In the present implementation, the detector output is latched. Once an attack has been detected, the system remains in the attacked state for the remainder of the run. This can be written as

$$a_{\mathrm{l}\mathrm{a}\mathrm{t}\mathrm{c}\mathrm{h}\mathrm{e}\mathrm{d}}\left(t\right)=\underset{1\le \tau \le t}{\max \widehat{a}\left(\tau \right)}$$

(14)

where $a_{\mathrm{l}\mathrm{a}\mathrm{t}\mathrm{c}\mathrm{h}\mathrm{e}\mathrm{d}}\left(t\right)$ is the persistent attack state. This rule prevents repeated switching between attack and non-attack modes during contested operation.

3.3. Cooperative Localisation and Fusion Logic

The GNSS branch is directly represented by the current GNSS observation,

$${\widehat{\mathbf{p}}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)={\mathbf{p}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)$$

(15)

The cooperative branch utilises the purified RSSI measurements obtained from the PLS cleaner in order to support localisation under degraded GNSS conditions. The reconstructed RSSI is first converted into cooperative ranging information using the log-distance path loss model defined in Equation (6). The resulting ranging measurements are then incorporated into the cooperative localisation branch to generate a bounded cooperative position estimate. The cooperative estimate is modelled in the current six-scenario implementation as

$${\widehat{\mathbf{p}}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right)={\mathbf{p}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right)+{\mathbf{n}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right)$$

(16)

where ${\widehat{\mathbf{p}}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right)$ denotes the cooperative position estimate and ${\mathbf{n}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right)$ represents the residual cooperative ranging uncertainty after RSSI purification. This simplified representation was retained in the present scenario study in order to isolate the effect of the PLS-assisted detection and fusion strategy. The final position estimate is obtained through the weighted fusion of the GNSS and cooperative branches

$$\widehat{\mathbf{p}}\left(t\right)=\alpha \left(t\right){\widehat{\mathbf{p}}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)+\left(1-\alpha \left(t\right)\right){\widehat{\mathbf{p}}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right)$$

(17)

where $\widehat{\mathbf{p}}\left(t\right)$ is the fused position estimate and $\alpha \left(t\right)$ is the GNSS trust weight. In the current implementation, $\alpha \left(t\right)$ is scenario-dependent. Under nominal cooperative operation, the GNSS and cooperative branches are equally weighted. Under attacked cooperative operation without defence, the GNSS branch remains strongly trusted, so the spoofed position dominates the estimate.

Under attacked cooperative operation with PLS enabled, the GNSS trust weight is represented by the fixed reduced value ${\alpha }_{\mathrm{d}\mathrm{e}\mathrm{f}}=0.01$, corresponding to an almost complete reliance on the cooperative branch after attack detection. In the current six-scenario implementation, the fusion weights are predefined on a per-scenario basis rather than dynamically adapted over time. Thus, the PLS layer affects localisation not by directly estimating the position but by purifying the sidelink signal and by modifying the fusion logic in response to detected attack conditions.

For clarity, three representative cooperative fusion scenarios are explicitly defined in this study. Scenario S4 corresponds to benign cooperative localisation, Scenario S1 represents attacked cooperative localisation without defence, and Scenario S6 represents attacked cooperative localisation with the proposed PLS-assisted defence.

$$\begin{gathered} {\widehat{\mathbf{p}}}_{S4}\left(t\right)={\alpha }_{\mathrm{n}\mathrm{o}\mathrm{m}}{\widehat{\mathbf{p}}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)+\left(1-{\alpha }_{\mathrm{n}\mathrm{o}\mathrm{m}}\right){\widehat{\mathbf{p}}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right) \\ {\widehat{\mathbf{p}}}_{S1}\left(t\right)={\alpha }_{\mathrm{u}\mathrm{n}\mathrm{d}\mathrm{e}\mathrm{f}}{\widehat{\mathbf{p}}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)+\left(1-{\alpha }_{\mathrm{u}\mathrm{n}\mathrm{d}\mathrm{e}\mathrm{f}}\right){\widehat{\mathbf{p}}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right) \\ {\widehat{\mathbf{p}}}_{S6}\left(t\right)={\alpha }_{\mathrm{d}\mathrm{e}\mathrm{f}}{\widehat{\mathbf{p}}}_{\mathrm{g}\mathrm{p}\mathrm{s}}\left(t\right)+\left(1-{\alpha }_{\mathrm{d}\mathrm{e}\mathrm{f}}\right){\widehat{\mathbf{p}}}_{\mathrm{c}\mathrm{o}\mathrm{o}\mathrm{p}}\left(t\right) \end{gathered}$$

(18)

where ${\alpha }_{\mathrm{n}\mathrm{o}\mathrm{m}}$ is the nominal cooperative fusion weight, ${\alpha }_{\mathrm{u}\mathrm{n}\mathrm{d}\mathrm{e}\mathrm{f}}$ is the attacked but undefended weight, and ${\alpha }_{\mathrm{d}\mathrm{e}\mathrm{f}}$ is the attacked defended weight. Their exact numerical values are reported in the parameter table at the end of this section.

3.4. Operational Workflow of the Proposed Framework

The complete operation of the proposed framework follows the processing chain illustrated in Figure 2. At each time step $t$, the target EV first acquires a GNSS-based position observation and a V2X sidelink measurement characterised by the RSSI and SNR. The GNSS branch may be affected by spoofing, whereas the V2X branch may be affected by RSSI jamming. The received physical-layer features are then processed by the LSTM-based attack detector using the temporal input sequence defined in Equation (8). The detector output in Equation (9) determines whether the current sidelink condition is regarded as safe or attacked. If the condition is classified as attacked, the signal cleaner is triggered and reconstructs the purified RSSI according to Equation (12). Otherwise, the original observed RSSI is retained according to Equation (13). The purified RSSI is then forwarded to the cooperative localisation branch, while the GNSS branch is weighted according to the fusion logic defined in Equation (17). In this way, the framework performs detection, signal purification, and defensive fusion within one closed-loop localisation pipeline.

The processing sequence can therefore be summarised as

$$\begin{gathered} \mathrm{GNSS}/\mathrm{V}2\mathrm{X} \mathrm{acquisition}\to \mathrm{attack} \mathrm{detection}\to \mathrm{RSSI} \mathrm{purification} \\ \to \mathrm{cooperative} \mathrm{localisation}\to \mathrm{weighted} \mathrm{fusion} \\ \to \mathrm{final} \mathrm{position} \mathrm{estimate} \end{gathered}$$

where each stage corresponds directly to one of the functional modules shown in Figure 2. The main role of the PLS layer is not only to indicate the presence of a hostile condition but also to influence the final position estimate by improving the sidelink signal quality and by reducing the influence of the spoofed GNSS branch when required.

3.5. Evaluation Metrics

Let ${\mathbf{p}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right)$ denote the ground-truth horizontal position of the target EV at time step $t$, and let $\widehat{\mathbf{p}}\left(t\right)$ denote the corresponding fused position estimate. The instantaneous localisation error is defined as

$$e\left(t\right)=\parallel \widehat{\mathbf{p}}\left(t\right)-{\mathbf{p}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}\left(t\right){\parallel }_2$$

(19)

where $e\left(t\right)$ is the horizontal localisation error at time step $t$, and $\parallel \cdot {\parallel }_2$ denotes the Euclidean norm.

Over a simulation horizon of $T_{\mathrm{s}\mathrm{i}\mathrm{m}}$ time steps, the root mean square error (RMSE) is defined as

$$RMSE=\sqrt{{\displaystyle \frac{1}{T_{\mathrm{s}\mathrm{i}\mathrm{m}}}}{\displaystyle \sum _{t=1}^{T_{\mathrm{s}\mathrm{i}\mathrm{m}}}}{e}^2\left(t\right)}$$

(20)

where $\mathrm{R}\mathrm{M}\mathrm{S}\mathrm{E}$ measures the overall localisation accuracy over the whole trajectory.

The mean absolute error (MAE) is given by

$$\mathrm{M}\mathrm{A}\mathrm{E}={\displaystyle \frac{1}{T_{\mathrm{s}\mathrm{i}\mathrm{m}}}}{\displaystyle \sum _{t=1}^{T_{\mathrm{s}\mathrm{i}\mathrm{m}}}}e\left(t\right)$$

(21)

where $\mathrm{M}\mathrm{A}\mathrm{E}$ represents the average magnitude of the localisation error.

The maximum error is defined as

$$\mathrm{M}\mathrm{a}\mathrm{x}\mathrm{E}\mathrm{r}\mathrm{r}=\underset{1\le t\le T_{\mathrm{s}\mathrm{i}\mathrm{m}}}{\max e\left(t\right)}$$

(22)

where $\mathrm{M}\mathrm{a}\mathrm{x}\mathrm{E}\mathrm{r}\mathrm{r}$ captures the worst-case localisation deviation over the whole simulation horizon. These three metrics are used to compare the six localisation scenarios considered in this work.

In addition to the trajectory-level metrics, the LSTM detector is evaluated using standard binary classification measures. Let $TP$, $TN$, $FP$, and $FN$ denote the true-positive, true-negative, false-positive, and false-negative counts, respectively. The classification accuracy is

$$\mathrm{A}\mathrm{c}\mathrm{c}\mathrm{u}\mathrm{r}\mathrm{a}\mathrm{c}\mathrm{y}={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(23)

where $\mathrm{A}\mathrm{c}\mathrm{c}\mathrm{u}\mathrm{r}\mathrm{a}\mathrm{c}\mathrm{y}$ indicates the proportion of correctly classified attacked and safe samples.

The detector precision is defined as

$$\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}={\displaystyle \frac{TP}{TP+FP}}$$

(24)

where $\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}$ quantifies the fraction of predicted attacks that are truly attacks.

The detector recall is

$$\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}={\displaystyle \frac{TP}{TP+FN}}$$

(25)

where $\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}$ measures the fraction of actual attacks that are successfully detected.

The F1-score is computed as

$$\mathrm{F}1={\displaystyle \frac{2\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n} \mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}}{\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}+\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}}}$$

(26)

where $\mathrm{F}1$ provides a balanced measure of detection performance by combining precision and recall. In addition, the receiver operating characteristic–area under the curve (ROC-AUC) is reported in the Results section in order to characterise the separability of attacked and safe conditions.

The signal cleaner is evaluated independently by comparing the reconstructed RSSI against the clean RSSI target. Let $r_i^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}$ denote the clean RSSI target for sample $i$, let $r_i^{\mathrm{j}\mathrm{a}\mathrm{m}}$ denote the jammed RSSI input, and let ${\widehat{r}}_i$ denote the reconstructed RSSI. The cleaner RMSE is defined as

$${\mathrm{R}\mathrm{M}\mathrm{S}\mathrm{E}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}=\sqrt{{\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{\left({\widehat{r}}_i-r_i^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\right)}^2}$$

(27)

where $N$ is the number of cleaner evaluation samples.

The cleaner MAE is

$${\mathrm{M}\mathrm{A}\mathrm{E}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}\mid {\widehat{r}}_i-r_i^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\mid$$

(28)

where ${\mathrm{M}\mathrm{A}\mathrm{E}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}$ measures the average absolute reconstruction error.

To further quantify the reconstruction quality, the coefficient of determination is defined as

$$R^2=1-{\displaystyle \frac{{\displaystyle {\sum }_{i=1}^N}{\left({\widehat{r}}_i-r_i^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\right)}^2}{{\displaystyle {\sum }_{i=1}^N}{\left(r_i^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}-{\overline{r}}^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\right)}^2}}$$

(29)

where ${\overline{r}}^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}$ is the sample mean of the clean RSSI targets. In addition, the percentage reduction in residual error variance is defined as

$${\mathrm{V}\mathrm{R}}_{\mathrm{\%}}=100\times {\displaystyle \frac{\mathrm{V}\mathrm{a}\mathrm{r}\left(r^{\mathrm{j}\mathrm{a}\mathrm{m}}-r^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\right)-\mathrm{V}\mathrm{a}\mathrm{r}\left(\widehat{r}-r^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\right)}{\mathrm{V}\mathrm{a}\mathrm{r}\left(r^{\mathrm{j}\mathrm{a}\mathrm{m}}-r^{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}\right)}}$$

(30)

where ${\mathrm{V}\mathrm{R}}_{\mathrm{\%}}$ denotes the percentage reduction in reconstruction error variance after signal cleaning. These measures allow the denoising stage to be assessed independently of the final localisation output.

3.6. Simulation Configuration

The full set of implementation settings used for this experiment is listed in

Table 2. Simulation and model parameters.

Parameter	Value	Description
$T_{\mathrm{s}\mathrm{i}\mathrm{m}}$	1000 steps	Simulation duration
Data split	70%/30%	Chronological training/testing partition
$I{D}_{\mathrm{v}\mathrm{i}\mathrm{c}\mathrm{t}\mathrm{i}\mathrm{m}}$	2	Vehicle selected for tracking
$\eta$	0.5	Proportion of training samples synthetically jammed
$P_{\mathrm{T}\mathrm{X}}$	$-10$ dBm	Transmit power of the sidelink beacons
$n$	2.5	Average urban PLE
${\sigma }_{\mathrm{j}\mathrm{a}\mathrm{m}}$	12.0 dB	Standard deviation of jamming noise
${\sigma }_{\mathrm{R}\mathrm{S}\mathrm{S}\mathrm{I}}$	1.0 dB	Standard deviation of benign RSSI perturbation
${\sigma }_{\mathrm{G}\mathrm{N}\mathrm{S}\mathrm{S}}$	${10}^{-5}$ deg	Standard deviation of benign GNSS perturbation
${\delta }_{\mathrm{d}\mathrm{r}\mathrm{i}\mathrm{f}\mathrm{t}}$	$2\times {10}^{-5}$ deg/s	GNSS spoofing drift rate
$L$	5	LSTM temporal window length
Detector input dimension	2	SNR and RSSI
Detector architecture	1 LSTM layer + fully connected (FC) + Softmax	LSTM classifier structure
LSTM hidden units	50	Hidden units in detector
Detector optimiser	Adam	Detector training algorithm
Detector learning rate	0.01	Detector initial learning rate
Detector mini-batch size	256	Detector batch size
Detector epochs	5	Detector training epochs
Cleaner architecture	FC–Rectified Linear Unit (ReLU)–FC–FC regression network	RSSI cleaner structure
Cleaner hidden-layer sizes	20, 10	Hidden units in cleaner
Cleaner optimiser	Adam	Cleaner training algorithm
Cleaner learning rate	0.01	Cleaner initial learning rate
Cleaner mini-batch size	128	Cleaner batch size
Cleaner epochs	20	Cleaner training epochs
${\alpha }_{\mathrm{n}\mathrm{o}\mathrm{m}}$	0.50	GNSS weight in nominal cooperative fusion
${\alpha }_{\mathrm{u}\mathrm{n}\mathrm{d}\mathrm{e}\mathrm{f}}$	0.90	GNSS weight in attacked cooperative fusion without defence
${\alpha }_{\mathrm{d}\mathrm{e}\mathrm{f}}$	0.01	GNSS weight in attacked cooperative fusion with PLS

below. These include the dataset splitting strategy, simulation time frame, length of detector sequence, attack injection rule, GNSS spoofing parameters, RSSI jamming parameters, detector network architecture, cleaner network architecture, training hyperparameters, and fusion weights for each of the six selected scenarios. The use of a single table in order to present all of these quantities allows the discussion of the methodology to remain tightly focused.

4. Results and Discussion

The proposed PLS layer was tested using the test portion of the Berlin V2X dataset [50], where the localisation performance was assessed under six different scenarios, which included a benign scenario, an attacked scenario without any defence, and an attacked scenario with the proposed PLS support. The evaluation process can be divided into three phases. Firstly, the deep learning modules within the proposed PLS layer will be validated independently. Secondly, the performance of the localisation under the six selected scenarios will be quantitatively investigated. Finally, the time-varying and location-varying effects of the proposed defence will be demonstrated by error evolution and trajectory plots.

4.1. Validation of Deep Learning-Based PLS Layer

Prior to analysing the localisation accuracy, the two deep learning modules that constitute the proposed PLS layer need to be verified, as the success of the whole scheme relies on not only attack detection but also signal cleaning. The former module is tasked with differentiating between attacked and unattacked physical-layer environments, while the latter is tasked with rebuilding an improved RSSI signal upon detecting attacks. Thus, in this section, we first investigate the statistical separability utilised by the detector, followed by the detector performance and cleaner evaluation.

4.1.1. Statistical Separation of Clean and Jammed RSSI

Figure 3 presents the empirical RSSI distributions under clean and synthetically jammed conditions. The red bars and red fitted curve represent the jammed RSSI used during detector training, showing a wider distribution and higher variance due to the injected attack. The green fitted curve represents the genuine clean sidelink RSSI, while the green histogram is mostly seen as the darker red or brownish region beneath the semi-transparent red attack distribution. This overlap indicates that some clean and jammed RSSI samples share similar values, so the two classes are not perfectly separable from RSSI alone. However, the wider spread and shifted behaviour of the jammed distribution provide useful statistical features for the LSTM detector to distinguish benign from hostile channel conditions.

4.1.2. Quantitative Performance of the LSTM Detector

It is necessary to evaluate the performance of the detector quantitatively as well. In terms of test sequences, the LSTM detector showed accuracy of 0.7056, precision of 0.7248, recall of 0.6636, an F1-score of 0.6928, and an ROC-AUC of 0.7462. The confusion matrix numbers included $TP=1659,TN=1866,FP=630,$ and $FN=841$. The results indicate that the detector provides reasonable discrimination capabilities between benign and attacked physical-layer conditions. However, some attack instances remain undetected, while certain benign conditions are incorrectly classified as attacks.

Table 3. LSTM detector performance metrics.

Metric	Value
Accuracy	0.7056
Precision	0.7248
Recall	0.6636
F1-Score	0.6928
ROC-AUC	0.7462
True Positives (TP)	1659
True Negatives (TN)	1866
False Positives (FP)	630
False Negatives (FN)	841

shows their significance in analysing the localisation results.

4.1.3. Qualitative Signal Reconstruction by the Cleaner

Having detected the attack, the cleaner tries to produce a more accurate RSSI signal for the cooperative localisation path. Figure 4 presents an example of a segment, where the red line represents the jammed input, the green line represents the clean RSSI target, and the blue dotted line represents the produced output. It can be observed that the clean signal correlates well with the clean one and reduces a considerable share of the highly volatile noise added by the jammer. This means that the cleaner increases the usefulness of the sidelink measurement.

4.1.4. Quantitative Performance of the RSSI Cleaner

The denoising phase should also be evaluated using quantitative methods. Prior to denoising, the jammed signal had an RMSE of 11.959 dB and MAE of 9.5156 dB compared to the target RSSI signal. After denoising, these metrics were decreased to RMSE = 5.5249 dB and MAE = 4.4303 dB. Moreover, after denoising, the signal obtained an R2 value of 0.1100 and a residual error variance decrease of 79.856%; this is summarised in

Table 4. RSSI cleaner performance metrics.

Metric	Value
RMSE before cleaning (dB)	11.959
RMSE after cleaning (dB)	5.5249
MAE before cleaning (dB)	9.5156
MAE after cleaning (dB)	4.4303
$R^2$ after cleaning	0.1100
Residual error variance reduction (%)	79.856

. This shows that the cleaner is not able to restore the original signal completely; however, it decreases the RSSI distortion from the jammer considerably and therefore ensures that it is a significantly improved input for the cooperative localisation engine branch.

Taken together, the detector and cleaner results confirm that the proposed PLS layer performs the two required physical-layer defence tasks: identifying suspicious channel conditions and reconstructing a substantially less distorted sidelink signal. However, the practical value of these improvements must still be evaluated in the full localisation loop. The next subsection therefore examines the localisation behaviour under the six retained scenarios.

4.2. Localisation Performance Under the Six Considered Scenarios

The localisation performance of the proposed framework was assessed on the basis of six scenarios, as mentioned in Section 3. The six scenarios consist of a benign GNSS-only and cooperative baseline, attacked GNSS-only and cooperative localisation without defence, and attacked GNSS-only and cooperative localisation with defence using the proposed PLS layer. The corresponding RMSE, MAE, and MaxErr are provided in

Table 5. Performance comparison.

Scenario ID	Scenario Description	Attack?	Detection/Defence?	RMSE (m)	MAE (m)	MaxErr (m)
S1	Attack + Cooperative	Yes	No	134.94	116.84	233.42
S2	Attack + GNSS Only	Yes	No	149.93	129.81	259.62
S3	Baseline (GNSS Only)	No	-	1.31	1.14	3.75
S4	Baseline (Cooperative)	No	-	2.07	1.81	6.33
S5	Attack + GNSS + PLS	Yes	Yes	149.93	129.81	259.62
S6	Proposed (Coop + PLS)	Yes	Yes	4.00	3.51	12.01

below.

The six scenarios also enable a component-level interpretation of the proposed framework. Scenario S2 shows the effect of the hybrid attack on GNSS-only localisation, while Scenario S1 shows that cooperative localisation without the PLS layer remains strongly affected by the spoofed GNSS and jammed sidelink measurements. Scenario S5 isolates the use of the PLS layer without cooperative fusion and shows that signal purification alone does not improve localisation when the final estimate remains GNSS-dominated. Scenario S6 therefore represents the full closed-loop configuration, where attack detection, RSSI purification, and cooperative fusion operate together. This comparison indicates that the main gain is not produced by a single module in isolation but by the interaction between the detector, cleaner, and fusion rule.

For benign conditions, the GNSS-only baseline in Scenario S3 attains an RMSE of 1.31 m, MAE of 1.14 m, and MaxErr of 3.75 m. The cooperative baseline in Scenario S4 attains an RMSE of 2.07 m, MAE of 1.81 m, and MaxErr of 6.33 m. This implies that the cooperative baseline is less accurate compared to the pure GNSS baseline when there is no attack. This type of behaviour is expected in the current scenario since the nominal cooperative baseline is constructed using the fusion of the highly accurate GNSS baseline with another branch whose accuracy level is lower due to RSSI errors. In other words, cooperation is included in this case mainly for robustness against attacks rather than improving the nominal GNSS baseline under benign conditions.

As soon as the joint spoofing and jamming attack is launched, the performance of the unguarded localisation algorithms deteriorates significantly. For Scenario S2, in which the localisation component depends entirely on the attacked GNSS component, the RMSE increases to 149.93 m, the MAE increases to 129.81 m, and the MaxErr becomes equal to 259.62 m. The situation is only marginally improved in Scenario S1, in which the cooperation takes place but without implementing the suggested PLS mitigation measure, as the RMSE in this scenario amounts to 134.94 m, the MAE equals 116.84 m, and the MaxErr is 233.42 m. It can be observed that mere cooperation is insufficient in combating the hybrid attack, as the fusion stage is affected by the spoofed GNSS position and the jammed sidelink observation.

An especially interesting finding is obtained based on the results of Scenario S5. Here, the PLS filter is used, but the localisation engine is solely GNSS-based. As a consequence, the values of the RMSE, MAE, and MaxErr are exactly the same as in Scenario S2. Hence, we can conclude that denoising alone does not have any effect on the accuracy of localisation, provided that the final estimate of the location is computed based on the GNSS spoofing branch alone. Consequently, the signal cleaner cannot be considered as an independent module. It is valuable only in combination with the cooperative localisation approach, since its output affects the logic of fusing data streams. This is a crucial finding for the research, because the gain is not achieved through denoising alone but through the closed-loop interaction of all three stages.

The efficiency of the suggested approach is confirmed by Scenario S6, when both the PLS layer and the cooperative fusion engine operate. As for the second scenario, the RMSE metric takes the value of 4.00 m, the MAE value amounts to 3.51 m, while the MaxErr metric is equal to 12.01 m. Compared to the attacked GNSS-only scenario of Scenario S2, this results in a reduction in the RMSE and MAE metrics of 97.3% and 97.2%, respectively. When comparing the suggested approach to the attacked and undefended cooperative case of Scenario S1, the RMSE and MAE metrics are reduced by more than 96%. This proves that the suggested approach allows the system to overcome the negative impact of the coordinated attack on the localisation process and keeps the error rate close to that in the case of benign cooperation. Nevertheless, the non-zero value of MaxErr shows that localisation failures can occur, although the suggested approach is highly resilient to the threat model in question.

From the above results in Table 5, we can deduce four major observations. First, localisation using the GNSS system only is precise in good environments but very susceptible in the case of coordinated spoofing attacks. Second, a cooperative strategy without any defensive measures cannot guarantee resilience. Third, when the GNSS channel dominates, there will be no improvement in localisation using the signal purification based on PLS. Finally, our proposed strategy, which combines physical-layer attack detection, RSSI purification, and cooperative fusion, offers the highest robustness in localisation under the current hybrid attack.

4.3. Trajectory-Level Analysis and Discussion

The scenario-based metrics given in Table 5 indicate the level of localisation error in each operating condition; however, they do not completely capture how the error is evolving over time and how the attack is shaping the vehicle trajectory in space. This is why, in addition to the numerical results, a temporal error evolution study and a spatial trajectory analysis are included herein. These two approaches provide insight into how the proposed cooperative approach based on the use of PLS mitigates the hybrid drag-off attack.

4.3.1. Localisation Error Evolution Under Attack

Figure 5 depicts the cumulative distribution function (CDF) plot for the localisation errors of the safe baseline, the attacked GNSS-only solution, and the proposed defended cooperative solution. Here, the green curve depicts the safe baseline, while the red dashed curve depicts the case of the attack. The blue curve depicts the proposed defence method. From Figure 5, it is clear that the safe baseline has a high cumulative probability value for smaller errors, which means that the majority of the benign estimates are near the ground truth trajectory. However, the attacked GNSS-only solution is highly biased towards higher errors, indicating the negative impact of the hybrid spoofing and jamming attack on the performance of the system. Finally, it can be seen from Figure 5 that the proposed defence is somewhere in between these two extremes and closer to the safe baseline, suggesting that the number of estimates having low to moderate errors is far greater than that for the GNSS-only solution. This can also be seen from the horizontal line at the 90% confidence level, where high-confidence localisation is achieved with low error values.

While Figure 5 presents the localisation accuracy in terms of its distribution, Figure 6 shows how the localisation error changes with time when an attack takes place. The red dotted line shows the attacked case without any protection, while the blue line shows the proposed localisation architecture using the PLS layer. This temporal performance is consistent with what can be seen in Table 5. In the unprotected case, the localisation error increases gradually since the GNSS branch is persistently pulled towards the spoofing attack, while the sidelink branch is constantly suffering from jamming interference.

In contrast, once the proposed PLS-based cooperative approach is activated, the growth of the localisation error is significantly reduced. The threat situation is detected by the LSTM detector, the cleaner provides a more accurate RSSI signal, and the cooperative approach shows an advantage over the fused approach. Thus, the blue curve is restricted within rather small boundaries of the error. This proves that the proposed approach not only reduces the average error but also prevents further growth of the localisation error under threat conditions. However, this does not mean that the error is completely eliminated, since some deviation exists even under defended conditions because of competition as well as the inaccuracy of the detector and cleaner. Thus, the conclusion is that the proposed approach should be considered as providing an appreciable improvement in the localisation error under threat conditions.

4.3.2. Trajectory Correction Under Attack

Figure 7 illustrates the spatial impact of the proposed defence on the vehicle trajectory. The ground-truth path is shown in green, the attacked and undefended GNSS-dominated trajectory is shown in red, and the defended cooperative trajectory is shown in blue. In the undefended case, the estimated path drifts far from the ground-truth trajectory, which is consistent with the large RMSE, MAE, and MaxErr values reported for Scenarios S1 and S2. This spatial divergence demonstrates the practical effect of the drag-off spoofing attack: even if the deviation develops gradually, it eventually drives the localisation estimate away from the intended road corridor.

In contrast, the trajectory corresponding to the proposed defended case remains much closer to the ground-truth path. Although some residual offset and fluctuation remain, the defended trajectory follows the true route in a qualitatively consistent manner and avoids the large spatial drift observed in the undefended baselines. This visual behaviour supports the substantial reductions in the RMSE and MAE reported for Scenario S6. It also confirms the main conclusion of the paper: the benefit of the proposed framework arises from the joint action of attack detection, RSSI purification, and cooperative fusion, rather than from signal cleaning in isolation.

Because the defended trajectory still exhibits a non-zero residual deviation, the result should not be interpreted as complete recovery to the benign GNSS-only case. Instead, it shows that the proposed framework is able to preserve a practically usable localisation track under the simulated hybrid attack, while greatly reducing the off-path behaviour seen in the undefended scenarios. This interpretation is more consistent with the reported MaxErr and avoids overstating the safety guarantee of the present single-scenario study.

5. Conclusions

In this paper, an approach towards physical-layer security using deep learning algorithms was introduced to provide resilience to attacks on the cooperative localisation process in the form of a hybrid attack that combines GNSS spoofing via drag-off and RSSI jamming. In the design of the presented framework, two main functions have been included within the localisation process: an LSTM detector to detect the attacked physical-layer state and an RSSI cleaner to perform regression on the corrupted RSSI values. This combination of the two functions allows for the recovery of the clean sidelink signal prior to its usage for localisation purposes. The findings indicate that the discussed hybrid attack leads to significant localisation performance degradation without any countermeasure being employed. In the scenario where only the GNSS was attacked, the localisation error rose to an RMSE of 149.93 m, an MAE of 129.81 m, and a MaxErr of 259.62 m. Even the attacked cooperative scheme without any countermeasure still exhibited very poor performance, with the RMSE being equal to 134.94 m. In contrast, the RMSE of the defended cooperative localisation dropped to 4.00 m, with an MAE of 3.51 m and a MaxErr of 12.01 m. It is obvious that the advantage in the latter case did not result from the pure signal cleaning, since, in this instance, the attacked and the defended GNSS-only localisation schemes were the same. The reason for this positive effect lies in the cooperation of the above three techniques within a closed defence localisation scheme. The validity of deep learning was also used to demonstrate the efficiency of the proposed PLS module. Discrimination between the physical layers’ attacked and safe states was successfully achieved by the LSTM detector, and a significant reconstruction error reduction for the jammed RSSI signal was attained through the regression-based cleaner method. In terms of computational time, the LSTM detector needed about 0.00109 s per sequence of input data and the cleaner needed about 0.00051 s per sample of RSSI data on a CPU processor. Accordingly, even in the case where the two modules operate simultaneously, the extra processing time of PLS amounts to approximately 1.6 ms per update, which is considerably shorter than the usual time interval of 100 ms associated with a rate of 10 Hz for cooperative vehicular communications. Future lines of research include the extension of the proposed methodology to non-linear spoofing attacks, burst and adaptive RSSI jamming, complex geometric configurations with more than one vehicle, fusion weighting based on the confidence level, and the implementation of the method with hardware-in-the-loop testing on vehicular platforms. With such extensions, it will then be possible to assess how effective the proposed physical-layer security solution can be against many different types of attacks, while retaining the main idea from this paper, i.e., that robust localisation can be obtained by a unified loop process.