GNSS deception jamming detection method and device, equipment and storage medium

Abstract

The invention provides a GNSS deception jamming detection method, device and equipment and a storage medium, and the method comprises the steps: inputting a to-be-detected GNSS signal into a GNSS software receiver, so as to obtain the lead output, the real-time output and the lag output of a correlator in the GNSS software receiver, carrying out the calculation to obtain a feature sequence, and carrying out the calculation of the feature sequence; and inputting the feature sequence into a preset converter model for processing to obtain an analysis result of the to-be-detected GNSS signal. Compared with a traditional detection method and a detection method based on an SVM model, the method has the advantages that the overall detection performance is improved, meanwhile, the low false alarm rate and the high generalization ability are kept, and the effectiveness and robustness in diversified deception jamming scenes are improved.

Description

Technical Field

[0001] The present invention relates to the field of satellite navigation, and particularly to a GNSS spoofing interference detection method, device, equipment and storage medium. Background Art

[0002] As a space-based radio navigation and positioning system, the Global Navigation Satellite System (GNSS) provides all-weather, high-precision three-dimensional positioning, navigation and timing (PNT) services for users on the earth's surface and near-earth space through constellation networking. This system has shown irreplaceable application value in both civilian and military fields such as intelligent transportation management, mobile communication network synchronization, industrial automation control and modern information-based battlefields. The important application value of GNSS in civilian infrastructure and national defense security fields has made it gradually become an important target for malicious attackers to implement spoofing under the dual effects of demand traction and technology drive.

[0003] However, the inherent vulnerability problems of the GNSS system are becoming increasingly prominent with the expansion of its application scope. First, the publicly available Interface Control Document (ICD) lacks a necessary signal authentication mechanism, making the signal structure predictable; second, the downlink signal power is lower than the background noise and is vulnerable to spoofing interference; third, the popularization of Software Defined Radio (SDR) technology makes spoofing interference devices inexpensive and dynamically reconfigurable. In addition, the multipath signals generated by the multipath effect in the electromagnetic propagation environment have physical characteristics similar to spoofing interference signals, which greatly increases the complexity of spoofing interference detection. The coupling effect of the above technical defects and environmental factors makes the GNSS system present significant security risks when facing spoofing attacks.

[0004] The existing machine learning spoofing detection methods use relatively simple models, and the spoofing scenarios studied are not sufficient, and the models lack a certain generalization ability. Summary of the Invention

[0005] The main object of the present invention is to provide a GNSS spoofing interference detection method, device, equipment and storage medium, aiming to solve the problem that the existing machine learning spoofing detection methods use relatively simple models, and the spoofing scenarios studied are not sufficient, and the models lack a certain generalization ability.

[0006] The present invention provides a GNSS spoofing interference detection method, including: Input the GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output, and late output of the correlator in the GNSS software receiver; Based on the early output, the prompt output, and the late output, calculate a feature sequence according to a preset algorithm; Input the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected; The step of inputting the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected includes: Input the feature sequence into a preset transducer model to map the feature sequence to a continuous vector space, and perform encoding using sine positions to obtain a feature sequence vector; Use a multi-head attention mechanism to process the feature sequence vector and integrate the outputs of each attention head to obtain an analysis result of the GNSS signal to be detected.

[0007] Further, the preset algorithm is any one of a delta factor method, an improved quality detection factor method, and a composite detection factor method.

[0008] Further, the step of calculating a feature sequence based on the early output, the prompt output, and the late output according to a preset algorithm includes: Calculate different feature subsequences based on the early output, the prompt output, and the late output according to different algorithms; Perform weighted fusion on each feature subsequence to obtain the feature sequence.

[0009] Further, before the step of performing weighted fusion on each feature subsequence to obtain the feature sequence, it further includes: Analyze the Doppler frequency and carrier phase of the GNSS signal to be detected through a preset GNSS software receiver; Classify the Doppler frequency and the carrier phase as a feature subsequence.

[0010] Further, before the step of inputting the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected, it further includes: Retrieve a specified number of signal data from a preset signal database, and divide the signal data into training signal data and validation signal data according to a preset ratio; wherein the signal data consists of GNSS signals and corresponding artificial labels, and the artificial labels indicate whether the signal is a spoofing signal or not; Input the training signal data into a preset initial encoder of the transducer for training to obtain a temporary encoder of the transducer; Use the verification signal data to verify the temporary encoder of the transducer to obtain a verification result, and determine whether the verification result is passed; If the verification result is passed, record the temporary encoder of the transducer as a preset transducer model.

[0011] The present invention also provides a GNSS spoofing interference detection device, including: An input module for inputting a GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output, and late output of a correlator in the GNSS software receiver; A calculation module for calculating a feature sequence based on the early output, the prompt output, and the late output according to a preset algorithm; A processing module for inputting the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected.

[0012] The present invention also provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of the method described in any one of the above are implemented.

[0013] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any one of the above are implemented.

[0014] Advantages of the present invention: By inputting the GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output, and late output of a correlator in the GNSS software receiver, calculating a feature sequence, and inputting the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected. Compared with traditional inspection methods and SVM model-based detection methods, the overall detection performance is improved, while maintaining a low false alarm rate and high generalization ability, as well as improving the effectiveness and robustness in diverse spoofing interference scenarios. Description of the Drawings

[0015] Figure 1 is a schematic diagram of a GNSS spoofing interference scenario according to an embodiment of the present invention; Figure 2 is a schematic diagram of a GNSS spoofing interference induction process according to an embodiment of the present invention; where Figure 2 (a) is a schematic diagram of spoofing signal injection; Figure 2 (b) is a schematic diagram of spoofing signal alignment;Figure 2 (c) is a schematic diagram of spoofing signal separation; Figure 2 (d) is a schematic diagram of spoofing signal control; Figure 3 is a schematic flowchart of a GNSS spoofing interference detection method according to an embodiment of the present invention; Figure 4 is a schematic diagram of comparison curves of various characteristic observables in real and spoofing scenarios according to an embodiment of the present invention; wherein, Figure 4 (a) is a schematic diagram of a comparison curve with carrier phase as the eigenvector; Figure 4 (b) is a schematic diagram of a comparison curve with Doppler frequency as the eigenvector; Figure 4 (c) is with as the eigenvector of the comparison curve schematic; Figure 4 (d) is with as the eigenvector of the comparison curve schematic; Figure 4 (e) is with as the eigenvector of the comparison curve schematic; Figure 4 (f) is with as the eigenvector of the comparison curve schematic; Figure 4 (g) is with as the eigenvector of the comparison curve schematic; Figure 4 (h) is with as the eigenvector of the comparison curve schematic; Figure 4 (i) is with as the eigenvector of the comparison curve schematic; Figure 4 (j) is with as the eigenvector of the comparison curve schematic; Figure 4 (k) is with as the eigenvector of the comparison curve schematic; Figure 4 (l) is with as the eigenvector of the comparison curve schematic; Figure 5 is a schematic diagram of spoofing detection based on the hypothesis testing method according to an embodiment of the present invention; wherein, Figure 5 (a) is a schematic diagram of spoofing detection by the hypothesis testing method in the TEXBAT-ds2 spoofing scenario; Figure 5 (b) is a schematic diagram of spoofing detection by the hypothesis testing method in the TEXBAT-ds5 spoofing scenario; Figure 6 is an AUC comparison chart of different spoofing detection methods according to an embodiment of the present invention; Figure 7 is an ROC curve chart of different datasets tested in different spoofing scenarios according to an embodiment of the present invention; wherein, Figure 7 (a) is an ROC curve chart of the spoofing scenario ds2;Figure 7 (b) is the ROC curve graph of the deception scenario ds5; Figure 7 (c) is the ROC curve graph of the deception scenario os3; Figure 7 (d) is the ROC curve graph of the deception scenario Targeted DFMC; Figure 8 is the structural schematic block diagram of a GNSS deception interference detection method according to an embodiment of the present invention; Figure 9 is the structural schematic block diagram of a computer device according to an embodiment of the present invention; Figure 10 is the schematic diagram of the relationship between the F1 score and the running time of the Transformer according to an embodiment of the present invention.

[0016] In the drawings: 10, input module; 20, calculation module; 30, processing module.

[0017] The realization, functional characteristics and advantages of the object of the present invention will be further described in conjunction with the embodiments with reference to the drawings. Detailed Embodiments

[0018] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0019] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement conditions between components in a specific posture (as shown in the drawings). If the specific posture changes, the directional indications will also change accordingly. The connection described can be a direct connection or an indirect connection.

[0020] The term "and / or" in the present invention is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and B can represent: A exists alone, A and B exist simultaneously, and B exists alone.

[0021] In addition, in the present invention, descriptions such as "first" and "second" are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one such feature. Additionally, the technical solutions between various embodiments may be combined with each other, but it must be based on the ability of those of ordinary skill in the art to implement. When the combination of technical solutions results in contradictions or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0022] According to the generation method of spoofing signals, spoofing jamming can be divided into retransmission spoofing jamming and generation spoofing jamming, and the spoofing jamming scenarios are as Figure 1 shown. The power of the spoofing signals transmitted by generation spoofing jamming is higher than that of the real signals, and detailed information about satellite navigation signals, such as key information like signal structure and modulation method, is required. Retransmission spoofing jamming only needs to appropriately amplify the power of the signals and extend the signal arrival time. However, it does not need to know the specific structure of satellite navigation signals, making it easier to achieve interference coverage over a larger range.

[0023] The spoofing party copies information such as the carrier, spreading code, and navigation message of each open GNSS signal, and the spoofing jamming model can be expressed as: Wherein, is the number of spoofing satellite signals, is the power of the th spoofing satellite. and respectively represent the navigation message bit stream and the spreading code of the th spoofing satellite; , , , are respectively the corresponding intermediate frequency, code phase, carrier phase, and Doppler frequency shift, is the imaginary unit, is the natural constant.

[0024] The satellite navigation receiver realizes the acquisition and tracking of satellite signals by performing correlation operations on the received signals and local copies. When the receiver is in a stable tracking state, the coherent integration values of the I-branch channel and Q-branch channel of the received signals are: Wherein, and respectively represent the correlator spacing and coherent integration time, represents the noise power variance, and are both random normal noises with zero mean and variance of , is the coherent integration value of the I-branch channel, is the coherent integration value of the Q-branch channel, is the carrier-to-noise ratio, is the phase difference between the local carrier and the received signal carrier.

[0025] In the tracking stage, the spoofing interference induction process can be divided into four stages, as Figure 2 shown: Figure 2 (a) is the spoofing signal injection; Figure 2 (b) is the spoofing signal alignment; Figure 2 (c) is the spoofing signal separation; Figure 2 (d) is the spoofing signal control. The spoofing signal is first started with low power, and then the power is gradually increased. At the same time, the carrier frequency and code phase are adjusted until the code phase is completely synchronized with that of the real signal. The spoofing signal uses the power advantage to gradually weaken the tracking ability of the target receiver for the real signal, and finally makes the tracking target of the target receiver completely transition to the spoofing signal, so as to achieve complete control of the target receiver.

[0026] During the signal acquisition process, when the carrier frequency and code delay of the real satellite signal match the parameters of the local signal, the correlation result reaches the maximum value. Similarly, if the carrier frequency and code delay of the spoofing interference signal are consistent with the local signal parameters, the correlation result of the spoofing interference will also form a peak. Further, when the power of the spoofing interference signal is stronger than that of the real satellite signal, the peak-to-peak value of the spoofing interference correlation will even exceed the maximum value of the real signal correlation peak. In this case, the receiver is very likely to miscapture the spoofing interference signal, resulting in signal tracking failure. Assuming that the spoofing interference signal has the same frequency as the GPS real signal, the integration and accumulation results of the in-phase branch (I-branch) and the quadrature branch (Q-branch) can be expressed as: where, , is the A / D sampling rate, is the pre-detection integration time, is the estimated frequency difference, and respectively represent the phase differences of the estimated satellite signal and the spoofing signal, , are the time delays of the spoofing interference and the real satellite signal respectively, is the autocorrelation function of the C / A code, is the gain factor of the spoofing interference signal strength relative to the real satellite signal, is at time The navigation data code, indicating the delay of the local code, indicating the satellite signal strength, indicating the time.

[0027] During the acquisition stage, if the power of the spoofing signal is greater than that of the real signal, then the coarse code phase and carrier Doppler shift of the spoofing signal will be acquired. After entering the tracking loop, the impact of spoofing interference on the tracking loop is mainly reflected in the carrier tracking loop and the code tracking loop. When the spoofing interference and the real satellite signal coexist, the in-phase and quadrature branches of the tracking loop of a typical GPS receiver , , The coherent integration outputs of the correlators are: In the formula, , respectively represent the code delay and code phase of the real satellite signal, , are respectively the time delay and phase of the local code, , are respectively the code delay and code phase of the spoofing signal, is the spacing between the early and late correlators.

[0028] Existing detection methods include various ones. Taking the hypothesis testing method as an example in the present invention, the real and imaginary parts of the early code, prompt code, and late code correlation outputs are all independent random variables, and the six branches all follow a Gaussian distribution with the same variance but different means. The asymmetric distortion of the GNSS correlator output will affect the mean value, and the distortion situation of the signal correlator output can be judged by comparing the measured value of the detection factor with the threshold. According to the analysis of the Neyman Pearson criterion, the GNSS spoofing interference detection problem can be regarded as a binary hypothesis testing problem.

[0029] Real satellite signal (assuming ) and spoofing interference signal (assuming ) The detection statistic follows different Gaussian distributions.

[0030] Among them, and respectively represent the means of the Gaussian distributions of the real satellite signal and the spoofing interference signal, is the common variance.

[0031] Under the Neyman-Pearson criterion, the decision is The likelihood ratio detection statistic for is: where, and respectively represent the probability density functions of the detection statistic and under the hypotheses of where the decision threshold can be obtained by the following formula: where, represents the complementary error function, is the given false alarm probability.

[0032] Referring to Figure 3 the present invention proposes a GNSS spoofing interference detection method, including: S1: Input the GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output and late output of the correlator in the GNSS software receiver; S2: Based on the early output, the prompt output and the late output, calculate a feature sequence according to a preset algorithm; S3: Input the feature sequence into a preset transducer model for processing to obtain the analysis result of the GNSS signal to be detected.

[0033] As described in step S1 above, input the GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output and late output of the correlator in the GNSS software receiver. That is, input the GNSS signal to be detected into one or more correlators to obtain the early output, prompt output and late output, where the early output is the signal for a period of time before the current time point; the prompt output is the signal at the current time point; the late output is the signal for a period of time after the current time point. It should be noted that the early output, prompt output and late output are all time series.

[0034] As described in step S2 above, based on the early output, the prompt output and the late output, calculate a feature sequence according to a preset algorithm. In a specific embodiment, the preset algorithm is any one of the delta factor method, the improved quality detection factor method, and the composite detection factor method.

[0035] Traditional signal quality monitoring methods include the delta factor method, the ratio (Ratio, ) factor method, and the early-late phase (Early-Late Phase, ) factor method, which are defined as follows: Among them, , , are the early, immediate, and late outputs of the in-phase branch of the correlator respectively, and are the early and late outputs of the quadrature branch of the correlator respectively. In the absence of spoofing interference, the correlation peak is symmetric and flat, tends to zero. When the correlation function is asymmetric, the difference between the early and late is non-zero, and the larger the difference, the more severe the distortion of the correlation peak. Under normal circumstances, the energy distributions of the three are stable, values fluctuate within a certain range, while spoofing signals will disrupt this ratio. and both normalize the detection statistic by dividing by to eliminate the influence of the received signal amplitude change on spoofing detection, but at the same time, they cannot reflect the change in power. And the phase difference between the early and late outputs is stable in the real signal scenario, and the intrusion of spoofing signals will cause phase jumps or phase inconsistencies.

[0036] Since the above three detection factors do not fully utilize all the outputs of the correlator, the prior art proposed an improved signal quality monitoring (ISQM), and its detection factor can be expressed as: Among them, the ISQM detection factor can more robustly reflect the distortion of the correlator output, and and the arctangent functions used in the detection factors can play a role in nonlinearly amplifying the distortion of the correlation peak and have strong robustness for the detection of covert spoofing.

[0037] In a complex electromagnetic environment, even if there is no deception interference signal, external random disturbances will affect the signal-related parameters directly output during the tracking phase, resulting in random fluctuations and misjudgment. Through the sliding window mechanism, the data is averaged within a data window, which can effectively suppress the random fluctuations caused by instantaneous noise or electromagnetic interference, highlighting the long-term trend of signal quality. The observations processed by the moving average are more effective in detecting weak fluctuations and are more suitable for detecting slow traction deception attacks. The variance can reflect the degree of fluctuation of the data in the window. The intrusion of deception attacks will cause the variance of the detection factor to increase significantly. Deception can be detected quickly within a short period of time after the deception is injected, improving the real-time performance of deception detection. The moving mean and moving variance of the composite SQM are defined as: in represents the window moving step size, is the selected window length. It is an important indicator for identifying deceptive interference, and The moving average of can reflect the long-term changes in signal strength, and the injection of deceptive interference will cause Sudden fluctuations and increased variance can be used as indicators for detecting sudden anomalies. The moving mean and moving variance of can be expressed as: In a specific embodiment, the step S2 of calculating the characteristic sequence based on the leading output, the immediate output and the lagging output according to a preset algorithm comprises: S201: Based on the leading output, the immediate output and the delayed output, different characteristic subsequences are calculated according to different algorithms; S202: Perform weighted fusion on each feature subsequence to obtain the feature sequence.

[0038] As described in the above steps S201-S202, a single indicator is often difficult to fully reflect the dynamic changes of the signal. The combination of the moving mean and the moving variance can simultaneously capture the trend changes and fluctuation characteristics of the signal. In the process of selecting training parameters, the present invention constructs a feature vector by multi-parameter weighted fusion and uses it as the input of the training model. This method not only realizes the fusion of multi-dimensional features and constructs a feature system from multiple dimensions, thereby improving the comprehensiveness and robustness of detection, but also effectively reduces the input dimension of model training and accelerates the training process of the model. The feature vector after multi-parameter weighted fusion is defined as follows: .

[0039] Table 1: Multi-parameter weighted weight coefficients under different deception scenarios In one embodiment, before the step S202 of performing weighted fusion on each feature subsequence to obtain the feature sequence, the method further includes: S2011: Analyze the Doppler frequency and carrier phase of the GNSS signal to be detected through a preset GNSS software receiver; S2012: Divide the Doppler frequency and the carrier phase into one feature subsequence.

[0040] As described in the above steps S2011 - S2012, each of the above feature vectors, namely , , , , , , , , , and the 12 vectors including the Doppler frequency and the carrier phase are used as subset vectors, and then any two or more of them are selected as subset vectors for weighted summation, where the weight of each subset vector can be set arbitrarily, as long as the sum of all weights is equal to 1.

[0041] To intuitively show the superiority of the features selected by the model, the comparison curves of each feature parameter changing with time in the real navigation signal scenario and the deception interference scenario are plotted, and the results are as Figure 4 (a) - Figure 4 (l) shown. In the figure, the blue line is the real signal and the orange line is the deception signal. The dataset used in the experiment includes clean_static of TEXBAT (no deception interference scenario) and the ds2 deception scenario. The experimental results show that there are significant differences between the output values of various feature observables after deception injection and the signal output values in the real navigation scenario. Specifically, the more significant the difference in feature observables, the stronger the discrimination ability of the model in the real navigation and deception interference scenarios, and the better the deception detection performance.

[0042] In order to fully explore the impact of different combinations of characteristic parameters on the model performance, 8 groups of comparative experiments are systematically set up. For details, please refer to Table 2. The combinations of characteristic parameters for each group of experiments are different, and the specific settings are shown in Table 2. By comparing and analyzing the results of each group of experiments, the key characteristic parameters that have a significant impact on the model performance are aimed to be identified. At the same time, according to the final training results of the model, the best combination of input characteristic parameters of the model will be selected. The parameter selection follows the following principle: achieving the optimal model performance with the least number of characteristics and the shortest training time. This principle not only helps to reduce the model complexity, improve the computing efficiency, but also enhances the generalization ability of the model, ensuring its stability and reliability in different scenarios. The more concise the combination of characteristic parameters is, the higher the generalization ability and computing efficiency of the model are, so as to meet the real-time requirements while ensuring the detection accuracy.

[0043] Table 2: Different combinations of characteristic parameters To fully verify the generalization ability of the model, the present invention selects three representative datasets for training and testing, including TEXBAT, OAKBAT, and FGISpoofRepo. The specific selections are as follows: TEXBAT dataset: Select ds2 with static high-power time offset and ds5 with dynamic high-power time offset to cover the characteristics of spoofing signals in different scenarios. OAKBAT dataset: Select the os3 scenario. Since the power of the spoofing signal in the os3 scenario is closest to that of the real signal and the detection difficulty is relatively high, it is used as the key dataset for performance evaluation. FGISpoofRepo dataset: Select the Targeted DFMC spoofing scenario. This scenario generates spoofing signals by synchronizing the initial time and position with the real receiver and injecting the latest available ephemeris, and has high practical application value. Through the diverse selection of the above datasets, the present invention aims to comprehensively evaluate the detection performance of the model in different spoofing scenarios and verify its generalization ability and robustness.

[0044] To verify the effectiveness of the traditional hypothesis testing method in spoofing detection problems, the present invention selects ds2 and ds5 in the TEXBAT dataset as spoofing data for experiments. To reflect the change of detection probability with the spoofing process, the spoofing interference data is divided into sub-windows, and a fixed number of sample points are output in each window, and each sample point is compared with the detection threshold. By calculating the ratio of the number of sample points exceeding the threshold to the total number of sample points in the window, a detection probability is output. Each time a detection probability is calculated, the window slides once, and the sliding windows do not overlap. Finally, a series of spoofing detection probability curves changing with time are output, as shown in Figure 5 . (Note: 0 second is the spoofing injection moment).

[0045] From Figure 5 (a) and Figure 5 (b), it can be seen that the detection probabilities of various detection factors in the ds2 scenario are relatively low within the range of 0 - 25 s, and between 100 s and 200 s and the factors have a detection probability of approximately over 90%, and the detection probability curve is relatively smooth, but and the detection probabilities of the factors are relatively low. In the ds5 scenario, the factors with excellent detection probability performance are and the factors, and the detection probability is relatively stable within the range of 130 s to 200 s, while and the factors have poor ability to detect deception.

[0046] As shown in Table 3, the present invention evaluated the accuracy rates of the Transformer model and the traditional hypothesis testing method in deception detection by comparing and analyzing different satellite data. The experimental results are as Figure 6 shown. The detection performances of the two methods were compared through the AUC (Area Under Curve) index. The experiments show that the deception detection accuracy rates of the Transformer model on 6 GPS satellites are all better than those of the hypothesis testing method. Even when the received signal qualities of satellites PRN - 06 and PRN - 19 are poor, the Transformer model still shows excellent detection performance, and its accuracy rate always remains stable without being affected by the signal quality fluctuations. This result verifies the robustness and superiority of the Transformer model in complex deception scenarios.

[0047] Table 3: Deception detection probabilities of the Transformer model and the hypothesis testing method among different satellites Table 4: Confusion matrix In machine learning, ROC (Receiver Operating Characteristic) and AUC (Area Under the Curve) are important metrics for evaluating the performance of binary classification models. The closer the curve is to the upper left corner, the better the model performance (high TPR, low FPR). The confusion matrix is shown in Table 4, where TP and TN represent the number of correctly judged spoof samples and genuine samples respectively, FP represents the number of genuine samples judged as spoof samples, and FN represents the number of spoof samples judged as genuine samples. The definitions of True Positive Rate (TPR) and False Positive Rate (FPR) are as follows: ; .

[0048] Figure 7 The ROC curve graphs showing the testing of the trained model on different datasets for various spoofing scenarios are presented, where Figure 7 (a) is the ROC curve graph for spoofing scenario ds2; Figure 7 (b) is the ROC curve graph for spoofing scenario ds5; Figure 7 (c) is the ROC curve graph for spoofing scenario os3; Figure 7 (d) is the ROC curve graph for spoofing scenario Targeted DFMC; which is used to evaluate the classifier performance of the model on different datasets. The specific analysis is as follows: 1. Parameter combinations and performance comparison: Blue, yellow, green, and red correspond to the parameter combinations of case1 to case4 respectively. In the four spoofing scenarios, case5 to case8 all achieved an accuracy close to 100%, indicating that these parameter combinations have high detection performance in specific scenarios.

[0049] In Figure 7 (a), case3 (AUC = 0.97) showed the best performance, which indicates that detecting the distortion of relevant peaks has a significant effect on improving the spoofing detection accuracy.

[0050] In Figure 7 (b), the performance of case4 is better than that of case1 to case3, indicating that multi-parameter weighted fusion can effectively achieve multi-dimensional feature fusion, improving the detection accuracy while reducing the number of training features.

[0051] In Figure 7 (c) and Figure 7 (d), the AUC of case4 is significantly higher than that of case1 to case3, further verifying the effectiveness of the multi-parameter weighted fusion mechanism in spoofing detection.

[0052] 2. Effect verification of feature fusion: Through the comparative analysis of the AUC indicators of case6, case7 and case1, case2, case4, it is found that: when using the multi-parameter weighted fusion features alone, the AUC value has not reached the optimal detection performance. However, after introducing the Doppler feature and the carrPhase feature for feature fusion, perfect classification performance with AUC = 1.0 is obtained in both case6 and case7.

[0053] In the four spoofing scenarios, the AUC of case6, case7 and case8 all reached 1.0, which verifies the effectiveness of the multi-parameter weighted feature fusion method proposed in the present invention in anti-spoofing detection, especially showing excellent robustness in dealing with multi-dimensional collaborative attack scenarios.

[0054] By training the Transformer model and the SVM model in different scenarios, the detection performances of the two models in various spoofing scenarios are evaluated, and the specific indicators are shown in Table 5 - Table 8.

[0055] Table 5: Comparison of parameter selection and performance evaluation of Transformer model and SVM model in TEXBAT-ds2 spoofing scenario Table 6: Comparison of parameter selection and performance evaluation of Transformer model and SVM model in TEXBAT-ds5 spoofing scenario 。

[0056] Table 7: Comparison of parameter selection and performance evaluation of Transformer model and SVM model in OAKBAT-os3 spoofing scenario 。

[0057] Table 8: Comparison of parameter selection and performance evaluation of Transformer model and SVM model in Targeted DFMC spoofing scenario 。

[0058] Refer to Figure 10, in the TEXBAT-ds2 and ds5 scenarios, the detection accuracy of the Transformer model for cases 1-4 is better than that of the SVM model. For these two types of deception scenarios, the optimal parameter combinations (cases 5-8) enable the Transformer model to achieve 100% accuracy, precision, recall, and F1 score, with a false alarm rate of 0% and a Cohen's kappa coefficient of 1.00, while the detection accuracy of the SVM model ranges between 99% and 100%, and its performance is inferior to that of the Transformer model. The experimental results of the OAKBAT-os3 and Targeted DFMC deception scenarios also draw the same conclusion, verifying the generalization of the Transformer model under diverse deception interference scenarios.

[0059] Generally speaking, the experimental results of cases 5-8 fully demonstrate the good adaptability and stability of the Transformer model under different feature parameter combinations. Whether it is static or dynamic deception, or multi-frequency complex attacks, the Transformer model exhibits strong generalization ability and robustness, and its deception detection performance is better than that of the SVM model.

[0060] In the simulation experiment of the TEXBAT-ds2 deception scenario, the parameter combinations from case 5 to case 8 achieved a 100% F1 score (one of the metrics for evaluating the performance of a classification model), and their running times were in the range of 336.79 - 404.43 seconds (using the 10th generation Core i7-10510U CPU as the processor), verifying that the optimized parameter combinations can achieve perfect detection performance with limited computational costs. As shown in Table 5, the Transformer model achieved the optimal performance while maintaining the shortest running time (336.79s) in case 5, indicating that it has achieved a balance between time and performance. In contrast, parameter combinations such as case 1 and case 2, although having shorter running times, had a significant drop in their F1 scores. Case 8 had the longest running time (404.43s), reflecting that the most feature parameters were introduced during its training process. Appropriate increasing of the number of features and reducing of the training time are necessary trade-offs to ensure that the model can adapt to complex input environments and maintain efficient detection capabilities.

[0061] In one embodiment, step S3 of inputting the feature sequence into a preset transformer model for processing to obtain the analysis result of the GNSS signal to be detected includes: S301: Input the feature sequence into a preset transformer model to map the feature sequence into a continuous vector space, and use sine position encoding to obtain a feature sequence vector; S302: Process the feature sequence vector using the multi-head attention mechanism, and integrate the outputs of each attention head to obtain the analysis result of the GNSS signal to be detected.

[0062] As described in the above steps S301 - S302, the Transformer model consists of two main components: Encoder and Decoder. In an embodiment of the present invention, the encoder module of the Transformer model is used to detect spoofing signals. The Transformer encoder is composed of identical layers stacked together, and each layer contains the following core modules: (1) Input Embedding & Position Encoding Among them Sine position encoding is adopted: , , represents the embedding of the input vector.

[0063] represents the embedding dimension of the model, that is, the dimension of each position encoding vector. and are used to alternately generate sine and cosine values to ensure that adjacent dimensions of each position encoding vector have complementary characteristics. The input embedding maps discrete satellite signal features, such as parameters like carrier phase, Doppler shift, signal-to-noise ratio, correlator output, etc., to a continuous vector space. Since satellite signals have strict time series characteristics, the presence of spoofing signals may exhibit time synchronization anomalies, and the position encoding can retain the signal timing characteristics and capture the time coherence anomalies of the signal, such as timestamp jumps of spoofing signals.

[0064] (2) Multi-Head Self-Attention Mechanism In the formula, the query vector ( ), key vector ( ), and value vector ( ) in the attention mechanism are all obtained by linearly transforming the input sequence. and calculate the similarity score through dot product, and then normalize to prevent the dot product from being too large and causing gradient disappearance. Finally, is weighted and summed with weights to obtain the attention output. By using multiple independent in parallelA module enables the model to establish global feature correlations, analyze the mutual influence of signal features at different times, and learn diverse feature representations from different subspaces. Among them represents the trainable parameter matrix of the th attention head, is the output projection matrix that integrates the outputs of multiple attention heads.

[0065] (3)Residual connection & Layer normalization In the formula, the residual connection can avoid the vanishing gradient or exploding gradient, and at the same time prevent the deep network from losing weak spoofing features, such as the subtle distortion of low-power spoofing signals. In each sub-layer of the Transformer model, the input is directly added to the output through the residual connection, and the network can more easily learn the difference between the input and the output, so as to ensure that the performance of the model during training is not lower than the original model. Finally, layer normalization is performed on the samples.

[0066] (4)Feed-forward neural network In the formula, the features are mapped to a high-dimensional space, and the activation function is used to enhance the model's expression ability, capture high-order non-linear spoofing features, separate the distribution of real satellite signals and spoofing signals in the feature space, and finally map the features back to the original dimension.

[0067] (5)Stacked encoder layers In the formula, the shallow network is used to extract local temporal patterns, and the deep network is used to integrate global context information.

[0068] In one embodiment, before the step S3 of inputting the feature sequence into a preset Transformer model for processing to obtain the analysis result of the to-be-detected GNSS signal, it further includes: S211: Retrieve a specified number of signal data from a preset signal database, and divide the signal data into training signal data and verification signal data according to a preset ratio; wherein the signal data consists of GNSS signals and artificial labels corresponding to the GNSS signals, and the artificial labels are that the signal has a spoofing signal or the signal does not have a spoofing signal; S212: Input the training signal data into a preset Transformer initial encoder for training to obtain a Transformer temporary encoder; S213: Use the verification signal data to verify the Transformer temporary encoder to obtain a verification result, and determine whether the verification result is verification passed; S214: If the verification result is passed, mark the temporary encoder of the transformer as the preset transformer model.

[0069] As described in the above steps S211 - S214, a preset signal database can be established in advance, which contains various types of GNSS signal samples, including normal signals and spoofing interference signals. The signal data is divided into two parts according to a preset ratio (for example, 80% for training and 20% for verification). Ensure that there are sufficient normal signal and spoofing signal samples in each part of the data to ensure the generalization ability of the model. Then, feed the training signal data into the initial encoder of the designed transformer model. This encoder is responsible for processing the input signal data features, extracting valid information, using an appropriate loss function (such as cross-entropy loss), and gradually optimizing the model parameters through the backpropagation algorithm. The verification signal data is input into the temporary encoder of the transformer for testing. If the verification result is passed, mark the temporary encoder of the transformer as the preset transformer model. It should be noted that since the preset transformer model in the previous steps analyzes the feature sequence, the input layer of the preset transformer model here needs to be set to extract features from GNSS signals. In one embodiment, the signal data can also be composed of a feature sequence and the corresponding artificial label. Its training method is the same as that of the above GNSS signal. After training, the GNSS signal to be detected can be pre-extracted with the feature sequence and then input into the model to obtain the analysis result.

[0070] In view of the poor adaptability of traditional hypothesis testing and single feature parameter detection methods, the present invention proposes a GNSS spoofing interference detection method based on multi-parameter weighted fusion of Transformer. First, perform sliding window processing of moving mean and moving variance, and multi-feature weighted fusion processing on the SQM index and carrier-to-noise ratio features extracted in the tracking stage to enhance the characterization ability of the features. Secondly, use the Transformer model that can capture temporal anomaly patterns to train the processed feature parameters. Through the multi-parameter weighted fusion mechanism, not only the sensitivity of the model to features is improved, but also the training speed of the model is accelerated. Experimental results show that compared with traditional single-parameter detection methods and hypothesis testing methods, the proposed method is more superior in overall detection performance. Under the three spoofing data sets of TEXBAT, OAKBAT, and FGISpoofRepo, the method can achieve high detection accuracy and F1-score, while maintaining a low false alarm rate and high generalization ability, further verifying the effectiveness and robustness of the method in diverse spoofing interference scenarios.

[0071] Referring to Figure 8 , the present invention also provides a GNSS spoofing interference detection device, including: An input module 10 for inputting a GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output, and late output of a correlator in the GNSS software receiver; A calculation module 20 for calculating a feature sequence based on the early output, the prompt output, and the late output according to a preset algorithm; A processing module 30 for inputting the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected.

[0072] Other embodiments of the GNSS spoofing interference detection device provided by the present invention are the same as the above GNSS spoofing interference detection method and will not be elaborated here.

[0073] Advantages of the present invention: By inputting a GNSS signal to be detected into a GNSS software receiver to obtain the early output, prompt output, and late output of a correlator in the GNSS software receiver, calculating a feature sequence, and inputting the feature sequence into a preset transducer model for processing to obtain an analysis result of the GNSS signal to be detected. Compared with traditional inspection methods and SVM model-based detection methods, the overall detection performance is improved, while maintaining a low false alarm rate and high generalization ability, and improving the effectiveness and robustness in diverse spoofing interference scenarios.

[0074] Referring to Figure 9 , an embodiment of the present invention also provides a computer device, which may be a server, and its internal structure may be as Figure 9 shown. The computer device includes a processor, a memory, a network interface, and a database connected through a system bus. Among them, the processor of the computer design is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store various GNSS signals, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it can implement the GNSS spoofing interference detection method described in any of the above embodiments.

[0075] Those skilled in the art can understand that Figure 9 the structure shown in

[0076] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the GNSS spoofing interference detection method described in any of the above embodiments can be implemented.

[0077] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium provided by the present invention and used in the embodiments can include non-volatile and / or volatile memories. Non-volatile memories can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memories can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, there are various forms of RAM available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0078] It should be noted that in the present invention, the terms "include", "comprise", or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method including a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, apparatus, article, or method. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, apparatus, article, or method including such element.

[0079] The above are only the preferred embodiments of the present invention and are not used to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the scope of the claims of the present invention.

Claims

1. A GNSS spoofing interference detection method, characterized in that: include: Inputting the GNSS signal to be detected into a GNSS software receiver to obtain an advance output, an immediate output and a delayed output of a correlator in the GNSS software receiver; Based on the leading output, the immediate output and the lagging output, a characteristic sequence is calculated according to a preset algorithm; Inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected; The step of inputting the characteristic sequence into a preset converter model for processing to obtain the analysis result of the GNSS signal to be detected comprises: Inputting the feature sequence into a preset transformer model to map the feature sequence into a continuous vector space, encoding the feature sequence using sinusoidal positions, and obtaining a feature sequence vector; The feature sequence vector is processed using a multi-head attention mechanism, and the outputs of each attention head are integrated to obtain the analysis result of the GNSS signal to be detected.

2. The GNSS spoofing interference detection method according to claim 1, characterized in that: The preset algorithm is any one of a delta factor method, an improved quality detection factor method and a composite detection factor method.

3. The GNSS spoofing interference detection method according to claim 1, characterized in that: The step of calculating the characteristic sequence based on the leading output, the immediate output and the lagging output according to a preset algorithm comprises: The method comprises calculating different characteristic subsequences based on the leading output, the immediate output and the delayed output according to different algorithms; Each feature subsequence is weighted and fused to obtain the feature sequence.

4. The GNSS spoofing interference detection method according to claim 3, characterized in that: Before the step of weighted fusion of the feature subsequences to obtain the feature sequence, the method further includes: Analyzing the Doppler frequency and carrier phase of the GNSS signal to be detected by a preset GNSS software receiver; The Doppler frequency and the carrier phase are divided into a characteristic subsequence.

5. The GNSS spoofing interference detection method according to claim 1, characterized in that: Before the step of inputting the characteristic sequence into a preset converter model for processing to obtain the analysis result of the GNSS signal to be detected, the method further includes: Retrieving a specified amount of signal data from a preset signal database, and dividing the signal data into training signal data and verification signal data according to a preset ratio; wherein the signal data is composed of a GNSS signal and an artificial identifier corresponding to the GNSS signal, and the artificial identifier is that the signal has a spoofed signal or the signal does not have a spoofed signal; Inputting the training signal data into a preset transformer initial encoder for training, thereby obtaining a transformer temporary encoder; Verifying the temporary encoder of the converter using the verification signal data to obtain a verification result, and determining whether the verification result is verification passed; If the verification result is that the verification is passed, the transformer temporary encoder is recorded as the preset transformer model.

6. A GNSS spoofing interference detection device, characterized in that: include: An input module, used for inputting the GNSS signal to be detected into the GNSS software receiver to obtain the advance output, the immediate output and the delayed output of the correlator in the GNSS software receiver; A calculation module, used for calculating a characteristic sequence according to a preset algorithm based on the leading output, the immediate output and the lagging output; A processing module, used for inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected; The processing module comprises: An input submodule, used for inputting the feature sequence into a preset transformer model to map the feature sequence into a continuous vector space, encoding the feature sequence using sinusoidal positions, and obtaining a feature sequence vector; The processing submodule is used to process the feature sequence vector using a multi-head attention mechanism and integrate the outputs of each attention head to obtain the analysis result of the GNSS signal to be detected.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images