Wide-Area GNSS Interference Source Localization Using a Sparse Monitoring Network ^†

Abstract

This paper discusses the design, development, and initial testing of a distributed monitoring system intended to detect and localize sources of harmful interference impacting Global Navigation Satellite System (GNSS) users over city-sized areas using only a small number of monitoring stations to limit costs. The motivation and background of the work is rooted in the results of the Advanced Radio Frequency Interference Detection Analysis and Alerting System (ARFIDAAS), a network of GNSS Radio Frequency Interference (RFI) monitors which built the largest known database of multi-frequency GNSS RFI events. Insights gained from this database on parameters such as modulations, impacted bands, power-level distributions and other relevant factors are used to inform the design of the source localization system discussed in the paper. The design of the receiver hardware to allow the implementation of a distributed Time Difference of Arrival (TDOA) detection and localization system incorporating components of Commercial Off-The-Shelf (COTS) radios while supporting dynamic coverage of all L-band signals is detailed, along with the software architecture used to control and operate the individual nodes of the work-in-progress development systems and testbed. Further information is included to describe the design and operation of the software which controls the composite network, including decisions made for the support of mobile detectors and multiple data consumers to allow the pursuit of multiple simultaneous sources. Since the system is designed for the detection of sources which are likely below the local noise floor at the participating nodes, the paper explores the derived operating envelope of the architecture, showing examples of measurements produced during controlled field testing at Jammertest 2023, and discusses considerations for the screening of nuisance events that are likely to be unintentionally generated by incidental devices over a city-sized area.

1. Motivation

As the use of GNSS has proliferated into mass market applications such as in-car navigation, infotainment consoles, and fleet tracking appliances, the perceived incentives behind the operation of harmful GNSS jamming devices within civilian vehicles has unfortunately led to a Radio Frequency (RF) environment where interference is to be expected as a daily phenomenon along highways and busy urban roadways. Past studies dedicated to documenting the variety of RFI types encountered along European roadways [1,2] and the occurrence rates of the same type [2,3] have shown that all GNSS L-band signals are susceptible to RFI and that the occurrence rate is equivalent to between 10 and 30 s per day depending on the band or bands considered. While L1/E1 is the most frequently jammed band, the relative occurrence rate is within a factor of four for the other bands.

While the rate of RFI occurrence is higher than acceptable for some operations and higher than desirable for many applications, the ability to intercept and confiscate vehicle-based jamming devices is complicated in many jurisdictions through restrictions on the authority’s ability to speculatively pursue sources and the limited options for tracking mobile low-power signal emitters. This type of relatively low-power privately operated mobile sources is the focus of this work. Typically, the process by which a jamming source or other RFI emitter is handled starts with an incident report to the local communications authorities, who will then begin an investigation. Even when this investigation begins with the immediate dispatch of a search vehicle to the site of the report, even a few minutes of latency in the arrival of the search vehicle to the site is enough time for a mobile source to have moved far enough away that it may no longer be detectable. For high-power emitters, static emitters, or vehicle-borne devices which are parked and not moving, this approach yields results [4,5]. Unfortunately, mobile vehicle-borne low-power GNSS jamming devices are very unlikely to be caught by such approaches. While it is possible to use repeating patterns of behavior to predict and intercept drivers using these devices on predictable routes and schedules, this does not address the majority of vehicle-based GNSS jamming.

From extended observation campaigns in Europe, it is known that the distribution of power levels due to wideband RFI events relative to the undisturbed background tends to be limited to less than 20 dB even for stations deployed within tens of meters of major roadways bearing the jamming devices [6], per Figure 1. From the point of view of RFI source hunting, this presents a challenge insofar as low-power signals have a very limited range over which they will be visible over the local noise floor, particularly in urban environments where terrain masking and attenuation due to buildings will be a significant factor. Simultaneously the low transmitted jamming power presents other opportunities, particularly when combined with the observation that the vast majority of narrowband RFI events are believed to be unintentionally generated leakage from general electronics, while nearly all wideband and time-modulated signals with significant bandwidth are thought to be intentionally generated RFI [6].

While some past comprehensive RFI studies such as Strike3 have otherwise recommended overlooking RFI signals which cause less than 5 dB of apparent noise level increase, per [7], the results in Figure 1 show that this is a tradeoff between the removal of a potential majority of events for some sites.

2. System Design

2.1. Concept

To address the identified challenge in a cost-effective manner, a distributed TDOA-based source localization system was conceptualized to allow detection and tracking of RFI emitters in city-sized areas with a limited number of monitoring stations, even when the transmitted signals are received mutually below the local noise floors at all cooperating sites. While other implementations such as GIMAD [8] have exploited the Angle of Arrival (AoA) to allow the localization of distant high-power sources using a modest network, or many distributed sensors via crowdsourcing [9,10], this system has focused on the use of sparse single antenna nodes. The exploitation of cross-correlation of received data to extract wideband and time-modulated RFI signals from the noise floor requires synchronized receiver equipment to be used at each site, and while this would be a challenge if GNSS were fully denied, as previously discussed, the rate of occurrence of jamming events which are powerful enough to deny tracking to already-locked receivers at roadside locations is thankfully low. Additionally, the spectrum management authorities and other user groups have interest in the monitoring of other sensitive signal bands such as ADS-B in order to better respond to RFI incidents impacting the operation of these services. For this reason, the system should be capable of operating beyond the GNSS L-band frequencies.

2.2. Expected Operating Envelope

One of the critical parameters of a detection system is the expected signal-to-noise ratio of the signal of interest relative to the expected background noise level. While the GNSS bands have the advantage of generally not containing signals aside from the satellites themselves, which are individually under the noise floor, or specific authorized users of RADARs or ARNs, the signals of interest from low-powered PPD style emitters are still expected to be very weak at one or all the widely spaced receiver stations. Despite this reality, even a modest 0.1 Watt source over a 0.1 s observation interval provides a worst-case link margin of more than 60 dB over a 6 km-by-6 km grid when free space path loss is the only loss factor considered, as shown in Figure 2.

We expect that physical obstructions from building materials will significantly limit the functional range of the system as even a light construction residential building is expected to produce 40–60 dB of attenuation for GNSS signals passing through, while masking terrain or concrete constructions is expected to completely block the line-of-sight transmission of the signal. By limiting spacing between the nodes to 3 km and increasing the observation integration time to 1 s, a comfortable operating margin is restored for signals from such emitters passing through a single light construction.

2.3. Hardware and Station Node

While such a system design could benefit from a custom radio front-end, due to time and budget constraints, it was decided to make use of an available COTS radio with a pre-existing GNSS-based sample stream synchronization capability, which would be connected through a custom-designed signal handling and measurement device to provide the needed features not available to the base radio system. The selected COTS radio was a single-channel USRP N210 model with a GNSS-disciplined OCXO timing module installed. This presented a challenge of being a single-channel receiver with a bandwidth limit of approximately 55 MHz. Since there is a desire to cover all operational GNSS bands, ADS-B bands, and the 900 MHz ISM band, not just the spectrum near the L1 center frequency, there was a need to detect anomalous signals in all target bands simultaneously without requiring the radio to enable intelligent target frequency selection and agility. This was achieved by designing an integrated filtering, amplification, in-band power measurement and combining board. The first stage of this board takes signals from three input antennas covering the desired GNSS bands, ADSB bands, and an ISM band and passes them through a total of six tuned SAW filters to prevent aliasing in subsequent stages. The isolated signal from each sub-band is split into two branches, with one from each frequency fed to a micro-electromechanical system (MEMS)-based power meter, which allows the attached system to simultaneously see the received power level in each sub-band regardless of where the attached USRP is tuned. To enable the USRP to employ its single antenna input to receive any of the sub-bands, the second branch after the post-SAW split is merged into a combined signal feed which then exits the combining board. The exception to this configuration is the GNSS SAW outputs, which are also divided to feed the USRP’s integrated GNSS timing receiver separately without potential impacts from the presence of the other signals. The aggregation of equipment comprising one of the developed multi-band monitoring and data capture nodes is shown in Figure 3.

2.4. Node, Server, and Rover Software

While the node hardware and custom combining board allow the nodes to sensibly monitor their local spectrum, the system operating concept requires coordinated collection of the synchronized sample streams over multiple nodes to function. This is achieved through the system architecture depicted in Figure 4, where the overall system from data production to result presentation is illustrated. On power-up, each of the nodes connects to a control server. The control server is responsible for monitoring the aggregate network for reports of signals above the noise floor at any of the connected nodes, and for initiating data collection cycles, whether passively or actively. Here, the term actively is used to refer to the scenario where a noise signal is reported as above the noise floor at a node, while passively refers to speculative capture of samples bursts to search for signals below the noise floor at all sites but present in the monitored area. The procedure for capturing a burst of data is to first ensure that all nodes in the network are identically configured with respect to their center frequency and sample rates, after which a capture command is issued with a target time in the future to start the capture and a defined duration. Once these sample packs are collected, they are forwarded to the control server, which proceeds to implement the signal search process.

3. Results and Discussion

In this section, a collection of initial results from the system is presented from both controlled signal tests at Jammertest and the work-in-progress testbed in Trondheim Norway. In the Jammertest activity, five static nodes were deployed, while the testbed in Trondheim has evolved from the three static nodes shown to four at present with the optional inclusion of mobile vehicle-borne receiver stations under development.

3.1. Live Signal Test Results

The cross-correlation results for an example static source captured at Jammertest 2023 [11] are shown in Figure 5. The envelopes shown in Figure 4 were captured during emissions from a chirp PPD jammer meant for in-car use and illustrates that despite the repetitive sweep structure of the signal, no ambiguity is observed over several kilometers of equivalent cross-correlation offsets.

In the case of wideband modulations including chirp signals, the correlation envelope will have a single peak, while pure CW sources have an intractable number of potential peaks with a repetition every carrier cycle. In one of the other evaluated transmissions which made use of a rapidly frequency-hopping CW source, the ambiguity is twofold, yet tractable. In the case of that specific modulation, there are peak clusters spaced approximately 500 sample offsets apart, and tight clusters approximately 100 sample offsets apart. Since this data was captured at a 10 MHz sample frequency, these ambiguity spaces correspond approximately to 15 km, and 3 km at the larger and smaller scale, respectively, which illustrates that on the scale of city-sized areas, certain emitter types may or may not yield unique solutions directly and may instead require an ambiguity resolution step before an emitter position can be estimated.

Once these correlation envelopes are produced by the server, they are transmitted to the subscribed rovers, the rover interface for which is shown in Figure 6.

3.2. Trondheim Testbed Results

In the Trondheim testbed with three stations deployed, the rover software provides a visualization of the estimation of a potential emitter position based on the intersection of two hyperbolic lines of a position such as in Figure 6, where a local high-powered RADAR emitter was observed by the nascent testbed network in Trondheim.

For scale, the spacing between the closely spaced pair of stations TRD and TRDB is 1.1 km, and the intersection point of the two lines of position is offset by approximately 400 m from the true source location. This poor result is in part due to the very unfavorable geometry of the testbed relative to the source, whereby the source is not contained between the node locations and is nearly collinear with two of the three stations, but still served as a basic proof of concept of the approach and was used as it is an authorized high-power transmission from a local RADAR station, which serves for system testing and development. While the RADAR is an elevated target in the line of sight to each receiver station, real targets will experience much more complex multipath and obstruction conditions, which require additional first path estimation techniques to resolve the true path.

4. Ongoing Development and Future Work

4.1. Geometry Challenges

The concept behind the use of this system is to provide mobile enforcement vehicles with estimates of emitter locations in near real time, to allow them to be approached close enough to become visible and trackable over the local noise floor. In this context, the absolute positioning accuracy at the level of 100 m is thought to be sufficient if latency can be limited to five seconds or less. To address the geometry challenges, an attempt to site a fourth station distant from the existing three along the eastern side of the valley was investigated, but this was not possible with the available buildings from participating partners. While a fourth static station extending the baseline between the top two sides has been established, it has also been decided that the network will be augmented for future testing using a mobile monitoring node.

4.2. Additional Capabilities and Mobile Nodes

Software development for the server and nodes has been completed to include mobile receivers has been completed and the next major development effort is the extension of the target search and reporting processes to support mobile targets over high Doppler rates commensurate with airborne targets. This latter consideration is motivated by the desire to have a system capable of tracking potential drone-borne jamming devices over the city.

4.3. Nuisance Source Removal

One of the open questions raised during this activity was how to reduce the prevalence of unintentional RFI sources such as the leakage of narrowband signals from household electronics, switch mode power supplies, or wideband arc discharges that may reasonably occur in a populated area. While it was understood at the outset from the ARFIDAAS data that nearly half of the events would be unintentionally generated narrowband sources thought to be leaking from in-vehicle electronics, the question of how much EMI would passively emanate from the electronics within the buildings of the area under observation was unknown. While devices in the latter category will tend to be attenuated by passing through the walls of the building containing them, the cross-correlation approach employed by the system will raise these nuisance signals along with those of interest. At present, the authors believe that it may be necessary to ‘notch’ or ignore the zero-frequency offset or ‘DC’ bin of the search and observation space to collectively ignore the emissions of this type when a stronger static source is not being actively tracked. It is hoped that this, and other pre-classification problems, can be resolved through algorithmic adjustments as well as the application of Machine-Learning (ML)-based pre-classification operating in the cross-correlation domain to reduce nuisance detections and lower operator load.