Session A2: GNSS Security: Interference, Jamming, and Spoofing 1

Real-World Spoofing Characterization Using Low-Cost Receivers
Argyris Kriezis, Yu-Hsuan Chen, Stanford University; Dennis Akos, University of Colorado Boulder; Sherman Lo, and Todd Walter, Stanford University
Location: Beacon A

The Global Navigation Satellite System (GNSS) is integral for the daily functions of the world and critical for numerous safety-of-life applications. Aviation, for instance, relies on GPS for navigation, take-off, and landing procedures, making sudden or unexpected signal interference a significant concern. The open-source nature of the GPS signals and codes make them vulnerable to Radio Frequency Interference (RFI) in the form of spoofing. Spoofing is a type of interference which sends GNSS-like signals to receivers making them believe they are at a false location. Recently, due to the conflicts taking place in eastern Europe and the Middle East there has been an increase in spoofing attacks that often also affect civilians far away from war zones. While detection of spoofing from fixed receivers is possible by comparing the true location with the calculated solution, effects it can be more difficult for a dynamic receiver to always identify the problem. This work is part of the Stanford’s GPS lab effort to develop an RFI monitoring network to protect critical infrastructure by utilizing low-cost GNSS receivers.
Spoofing detection and characterization methodologies have been developed for both stationary and in motion platforms. However, the pervious lack of real-world spoofing data has limited studies to lab-based experiments or large-scale outdoor testing campaigns, both with artificial interference environments. While this artificial data is useful in the development process, real-world data are needed to understand the spoofing techniques used in uncontrolled environments. This paper analyzes GNSS data collected from the southeast Mediterranean Sea during the summer of 2024 with the goal of characterizing the interference, in the form of spoofing, observed. The receivers used for the data collection are two u-blox F9P receivers, one of the L1/L2 model and one of the L1/L5 model. The study aims to demonstrate both the utility of low-cost GNSS receivers in detecting and characterizing spoofing as well as understanding the weaknesses in GNSS receivers that make them vulnerable to spoofing.
Spoofing characterization is performed through several steps including spoofing detection, identification of spoofing strategy and analysis of receiver effects. Once the spoofing signals have been characterized, methodologies are explored on isolating the spoofing effects from the receiver. For spoofing detection each of the signals from three core constellations are evaluated in this study. GPS, GALILEO and GLONASS are evaluated independently using standard receiver provided outputs. Some of the measurements used are the pseudo range residuals, position solutions and carrier-to-noise ratios of each satellite. For the identification of the spoofed satellites, the detection metrics are combined with jamming information derived from methodologies developed in previous studies. Further analysis is conducted to determine the spoofing strategy and how it affects other measurements of the receiver, resulting in a false position solution. As a last step, different methods are explored to isolate the effects of the spoofed satellites and allow for a true position solution to be calculated.
To summarize, this study utilizes real-world spoofing data to develop detection and characterization methodologies that can be used to alert users when RFI in the form of spoofing occurs. In addition to detection and characterization, the information is used to explore methodologies that can isolate the spoofing effects and potentially restore the receiver operations.