AI-Driven Detection, Characterization and Localization of GNSS Interference: A Comprehensive Approach Using Portable Sensors ^†

Abstract

The increasing interest in the development and integration of navigation and positioning services across a wide range of receivers has exposed them to various security threats, including GNSS jamming and spoofing attacks. Early detection of jamming and spoofing interference is crucial to mitigating these threats and preventing service degradation. This research introduces an interference detection technique leveraging an AI algorithm applied to GNSS data utilizing various methods to enhance detection accuracy and efficiency. The objective was to use modern sensors and AI to develop an effective tool that detects, characterizes, and localizes interference, thereby reducing associated risks. These sensors and algorithms enable continuous GNSS interference monitoring and support real-time Decision-making. A server plays a crucial role in managing the entire system. Its primary function is to process data collected from various sensors referred to as nodes (e.g., static, rover, drone, and space) and from (public) GNSS networks as well as to perform localization using rotating-antenna nodes. Within the interference detection module, various methods were implemented at different points in the software receiver architecture. Each method’s certainty in identifying an interference source depends on its design and capabilities, with outcomes—whether positive or negative—being subject to potential accuracy or errors. To enhance the Decision-making process, an AI-based Decision-making block has been introduced to determine the presence of interference at a given epoch. The proposed interference monitoring methods were evaluated through experiments using GNSS signals under clean, jamming, and spoofing scenarios. The results demonstrate the techniques’ applicability across diverse scenarios, achieving high performance in interference detection, characterization, and localization.

1. Introduction

GNSS interference detection and mitigation techniques exploit an array of sensing devices and advanced signal processing methods to recognize and counteract threats such as jamming and spoofing [1,2]. Both real-time surveillance and offline analytical approaches have been extensively studied and applied to enhance the integrity and robustness of GNSS services [3,4]. performance, thereby ensuring more reliable navigation and positioning services. Jamming primarily relies on high power and wide spectral occupation to deny GNSS signals, whereas spoofing involves generating counterfeit GNSS-like signals to mislead the state estimation of affected receivers, and multipath refers to signal reflections from surfaces that can distort or delay the reception of the original signals. Interference detection techniques are typically implemented through permanently deployed receivers that provide continuous monitoring within networked infrastructures or through mobile or vehicle-mounted portable monitoring equipment that enables flexible, on-the-go assessments [5,6]. GNSS interference detection techniques deliver both practical and fundamental insights for diagnosing threat scenarios. The quality and reliability of interference detection are directly related to the density of the measurement and the sophistication of the processing algorithms [7,8,9]. However, managing a large volume of data is a time-consuming process [10]. Traditional interference detection methods, such as signal strength monitoring, spectrum analysis, time-of-arrival, and angle-of-arrival techniques, provide useful insights but often suffer from limitations in adaptability and accuracy. These methods can yield inconsistent results due to inherent uncertainties and potential errors when applied individually [11]. To address these challenges, modern GNSS monitoring systems have increasingly integrated AI-based techniques [12]. This work proposes an AI-driven Decision-making block that streamlines the interference detection process. The proposed approach utilizes twelve interference-detection methods to process and fuse data collected from diverse nodes, enabling rapid characterization and localization of interference sources. By shifting the focus from extensive and time-consuming measurements toward intelligent data processing, the system enhances real-time Decision-making and improves overall interference detection. Therefore, this work enhances Decision-making by incorporating an AI-based block that leverages the mathematical theory of evidence to draw conclusions from the outputs of the various detection methods, effectively accounting for both random and knowledge-based uncertainties and resolving conflicting evidence. Moreover, the system employs a heterogeneous sensor network to collect GNSS and related data from multiple node types: static nodes; rover nodes with advanced vehicle-mounted cameras; drone nodes carrying UAV-borne receivers; rotating-antenna nodes for localization; space nodes; and urban nodes embedded in cars and motorcycles. All data streams feed into a central, AI-powered server, where they are used to detect, characterize, and localize interference.

The paper is organized into four sections, including the present one. Section 2 describes the materials and methods; Section 3 presents the experimental validation; and Section 4 reports the results and discussion. Through controlled tests with GNSS signals under clean, jamming, and spoofing scenarios, the approach achieved approximately 98% accuracy in both interference detection and source localization. By fusing data from heterogeneous sensors and leveraging an AI-driven Decision block, this framework not only accelerates real-time analysis but also provides a resilient defense for maintaining GNSS integrity in challenging, dynamic threat environments.

2. Materials and Methods

2.1. The Role of AI-Based Detection and Characterization

Conventional GNSS interference detection methods have traditionally been divided into several categories, such as signal strength monitoring, time-of-arrival analysis, and angle-of-arrival techniques [11]. Although each of these methods offers valuable insights for detecting jamming or spoofing events, they face significant challenges regarding reliability, scalability, and real-time applicability when employed independently. Moreover, as interference threats have become increasingly sophisticated, relying solely on any single traditional technique often proves insufficient. To address these challenges, recent research has increasingly integrated AI and machine learning into the detection process. This work adopts a different strategy: rather than depending on individual methods, multiple traditional techniques are combined, and their outputs are integrated through a Decision-making block. This fusion enhances the overall robustness and reliability of interference detection. The detection algorithms are organized according to the GNSS receiver’s architecture and are classified into three groups:

• Stream-Based methods: These algorithms continuously analyze the incoming GNSS signal streams to detect anomalies or sudden changes that may indicate interference.
• Receiver-Based methods: These methods focus on the internal processes of the GNSS receiver, for instance, by monitoring correlation outputs or carrier-to-noise density ratios, to identify irregularities that suggest interference.
• Channel-Based methods: This group inspects channel-specific characteristics, such as spectral content and temporal patterns, to differentiate between legitimate signals and interference.

Figure 1 shows the locations in the receiver architecture where each category of methods monitors the situation.

Therefore, a comprehensive GNSS interference detection framework is developed by combining multiple monitoring techniques. Specifically, Statistical Analysis in the Time Domain, Spectral Monitoring, PVT monitoring, Signal Power monitoring, Measurement Quality monitoring, KLT, Code-Carrier Divergence monitoring, first-order and second-order Pseudo range monitoring, Correlation Shape Symmetry monitoring, Bump Jumping detection, and SNR monitoring [13,14]. These individual monitoring methods are integrated throughout different parts of the receiver architecture. However, since each individual method may have strengths and weaknesses depending on the type and severity of interference, their output alone is not always sufficient for reliable detection. Therefore, an interference detection module is proposed, where the outputs of the various methods are combined using a Decision-making Block. This block is based on AI principles to determine, at each epoch, whether interference is present. The Decision-making mechanism is built upon the mathematical theory of evidence, specifically adopting concepts from Dempster-Shafer Theory [14]. This framework addresses the dual nature of uncertainty: Aleatory Uncertainty, resulting from random behavior in the system, and Epistemic Uncertainty, arising from incomplete knowledge about the system. The Decision-making Block processes the potentially conflicting outputs from different detection methods and uses belief and plausibility functions to combine evidence in a systematic way. By doing so, it accounts for both the reliability of each method and the possibility of conflict between them. Finally, a discounting and combination strategy is applied to use all sources of evidence, ensuring robust final decisions even in the presence of uncertainty or disagreement among detection methods. This results in a more reliable and adaptive GNSS interference detection system compared to relying on individual techniques alone.

2.2. The Role of Server and Sensors

The overall system architecture is illustrated in Figure 2, which presents the design framework for interference detection, characterization, and localization within the PNT monitoring context. The system integrates multiple components for data acquisition, signal processing, and analytical evaluation, all enhanced through server support to ensure robust and adaptive operation. In the diagram, the server, located at the center, plays a crucial role in managing the entire system. Its primary function is to process data collected from various sensors. These sensors are capable of continuously monitoring, detecting, and localizing GNSS interference events. The proposed system provides real-time monitoring capabilities, allowing operators to detect and respond to interference swiftly. Upon the detection of an interference event, the system automatically generates detailed reports, enabling informed and timely responses. By facilitating immediate action, the system significantly reduces the risk of service disruption and minimizes potential damage caused by interference.

Static nodes are deployed at specific locations within the monitoring region. These nodes continuously monitor for interference, providing a stable reference point for detecting signal anomalies and jamming or spoofing events over time. Each static node consists of an antenna, a front-end system, and a mini-PC. The antenna collects the signals, while the front-end system and mini-PC process the data locally before transmitting the outputs to the server for further analysis. The software is designed with an intuitive interface that provides real-time monitoring of the region. Data collected from the static nodes are interpreted and visualized in a color-coded format, simplifying the process of understanding interference levels. The Decision-making block differentiates between normal signal variations and genuine interference, ensuring high accuracy in detection. This block processes the data in real time to detect and classify interference, allowing operators to take swift action.

Rover nodes are mobile sensors that can be repositioned throughout the monitoring area (Figure 3a), allowing localized data collection where interference is suspected. This flexibility allows it to cover regions where interference is suspected, complementing the static nodes with more localized data collection. The hardware of a rover node is like that of a static node, consisting of an antenna, a front-end system, and a mini-PC. Additionally, it is equipped with a visual assistance unit designed for capturing and analyzing visual data to improve interference classification. Differentiating between multipath and spoofing attacks is a significant challenge due to their similar effects on signal reception. To address this, the processed visual data is integrated into the rover’s Decision-making block, enabling it to more effectively distinguish between these two types of interference. By analyzing visual cues, the Decision-making block gains a more comprehensive understanding of the surrounding environment, allowing it to recognize inconsistencies or anomalies that may indicate spoofing attempts. This approach not only enhances the system’s situational awareness but also helps reduce the incidence of false alarms related to spoofing attacks, leading to improved accuracy in threat detection and response. Furthermore, the combination of signal and visual data strengthens the rover’s resilience against multipath errors, creating a more robust defense mechanism.

Figure 3b presents the rotating antenna. Jamming detection and localization are based on a two-channel rotating antenna equipped with a highly precise magnetometer. One channel is connected to the omnidirectional part of the antenna, and the other to the directional part. The magnetometer output also indicates the angle of the rotating arm relative to a predetermined reference point. The concept involves monitoring the signal spectrum during the antenna’s rotation and detecting significant changes or anomalies. These anomalies typically indicate the presence of interference. If the system can determine the absolute orientation (i.e., angle) of the antenna relative to known reference points during rotation, and such measurements are taken from at least two distinct receiver positions, it becomes possible to estimate the location of the jammer or spoofer. This method of localization is known as angular intersection—it uses the known angles from different observation points to triangulate the interferer’s position. Once jamming is detected, the direction-of-arrival estimation process begins. The time of the first jamming detection is marked as the starting point of the rotation. From that moment, the system continuously records the signal power, antenna orientation angle, and timestamp for each epoch (moment) of the rotation. After one full rotation is completed and the antenna returns to its initial position, the system analyzes the recorded data. The epoch with the highest received power is assumed to be the moment when the directional antenna was directly facing the jammer. Therefore, the angle associated with this moment is taken as the estimated direction of the jammer relative to the system. This estimated angle is then visualized within the software, helping the operator to understand the jammer’s location and take appropriate action.

3. Experimental Validation

The first stage, referred to as the RF Generation phase, involves the creation of an extensive dataset comprising GNSS signals under diverse conditions. This includes scenarios representing clean signals, jamming, multipath, spoofing, and combined interference threats. The dataset was obtained through real GNSS signal collection using an INDALOS IGASPIN front-end, augmented by various interference conditions generated with the LOKI IGASPIN device. The second stage deployed static nodes, rover nodes, and rotating antenna nodes at various locations to perform detection and characterization of interference. Each node was equipped with an INDALOS front-end and an antenna to collect real-time data and was configured to monitor GNSS signals, and the collected data were processed for detailed interference detection, characterization, and localization.

4. Results and Discussion

Figure 4 presents a snapshot of the detected interference based on data collected from a static node under a jamming chirp attack. It indicates that interference is actively occurring, as detected using the proposed technique. Every vertical pick on the time series plot corresponds to a detected interference event, and the black bands show the stretches of time when those events were continuous. The time and type of interference are shown in the right corner.

Figure 5 presents screenshots of the server software for the static node under various attack scenarios. The pie chart provides a breakdown of different types of interference, including jamming single tone (1.3%) and jamming chirp (15.8%), with most of the time being classified as clean (82.9%).

Figure 6 presents a snapshot of the detected interference, based on data collected from a rover node. By leveraging this data, it is possible to correlate physical objects with observed multipath interference events. This demonstrates the software’s capability to accurately distinguish between jamming, spoofing, and natural multipath interference.

The rover node was strategically positioned near a building to enable comprehensive data collection: Near the cottage: This location was selected to observe interference in a confined area, where surrounding structures and walls are likely to affect signal strength and reception. Figure 6 highlights the detection and characterization of interference, particularly multipath interference, which occurs when signals reflect off surfaces such as buildings, trees, or other obstacles before reaching the receiver.

For localization, the rotating antenna was placed at points P1 through P6 to verify multiple measurement setups and angular intersections (Figure 7a). These locations, along with the jammer and spoofer positions, were measured with reference equipment to obtain true coordinates for validating the measurement campaign.

Figure 7b shows the determination of the jammer position with all possible positions of the rotating antenna. The estimated jammer position is nearly identical with the reference position. It is obvious that the measurement setup, as well as the distance between the measurement positions, e.g., the rotating antenna, and the jammer or spoofer locations, is critical for the achievable location accuracy. The standard deviation in the orientation angle estimation is in the range between 2.8° and 6°, with a mean of 4°. Additionally, the observable random bias of the orientation angle estimation is in the range between 0° and 8°. The localization estimation with the presented test setups, with distances of approximately 20 m between the measurement positions and the jammer, yields position residuals between 1 m and 3 m. The rotation speed and the radius of the rotating antenna were 0.25 Hz and 0.5 m, respectively.

A set of well-established metrics was used to evaluate the accuracy of interference detection. These metrics are derived from the confusion matrix framework and are defined as follows: True Positive (TP) as a jamming signal correctly identified by the model as a jamming signal. True Negative (TN) as a genuine signal correctly classified as non-jamming. False Positive (FP) as a genuine signal incorrectly classified as a jamming signal. False Negative (FN) as a jamming signal mistakenly identified as a clean signal. Based on these parameters, the overall detection accuracy is calculated as:

Accuracy = (TP +TN)/(TP + TN + FP + FN)

(1)

To further evaluate the model’s performance in identifying interference events, precision is computed as the proportion of correctly identified jamming signals, and recall—representing the model’s ability to detect all actual interference cases—is defined as:

Precision = TP/(TP + FP), Recall = TP/(TP + FN)

(2)

Finally, to combine precision and recall into a single performance metric, we calculate the F1-score, the harmonic means of the two:

F1 = 2.(Precision.Recall)/(Precision + Recall)

(3)

According to

Table 1. Performance metrics in percentage (%) for each class using the proposed interference detection model.

Class	Accuracy	Precision	Recall	F1-Score
Jamming chirp	98.73	98.31	98.55	98.44
Jamming Single-Tone	97.05	96.51	96.89	96.67
Spoofing	97.47	97.09	97.10	97.14
Multipath	96.11	95.47	95.54	95.61

, accuracy is 98.73% for chirp jamming, 97.47% for single-tone jamming, 97.05% for spoofing, and 96.11% for multipath.

The proposed AI-powered GNSS monitoring framework—using static, rover, and rotating-antenna nodes—achieved high accuracy in detecting, characterizing, and localizing interference across clean, jamming, spoofing, and multipath scenarios. Real-time Decision-making and an intuitive interface enable rapid classification and seamless integration of new data sources. This adaptable design ensures reliable operation in complex environments, demonstrating readiness for real-world deployment.