Radio frequency fingerprinting-based unmanned aerial vehicle GPS spoofing detection device and method

Abstract

The present disclosure relates to a radio frequency fingerprinting-based unmanned aerial vehicle GPS spoofing detection device and method, which is configured to extract radio frequency fingerprinting features from a received radio frequency signal and analyze the radio frequency fingerprinting features using a pre-trained model to determine whether the radio frequency signal is a spoofing signal, wherein the trained model may be trained to classify satellites based on radio frequency fingerprinting features extracted from radio frequency signals from a plurality of satellites.

Description

Technology Field

[0001] The present disclosure relates to a radio frequency (RF) fingerprinting-based unmanned aerial vehicle GPS (global positioning system) spoofing detection device and method. Background Technology

[0002] Today, anti-drone technology is broadly classified into detection and identification technologies and neutralization technologies, with neutralization technologies further divided into hard kill and soft kill technologies. Soft kill technologies are categorized into communications jamming, spoofing, control hijacking, and geofencing. Spoofing is a technique that generates forged GPS signals on the ground to transmit fake GPS information to a target unmanned aerial vehicle (UAV), thereby guiding the UAV to a safe area. Most UAVs are known to be highly vulnerable to GPS spoofing technology.

[0003] Existing GPS spoofing detection technologies are broadly divided into hardware (HW) and software (SW) methods. Hardware-based GPS spoofing detection is not widely utilized due to the need to mount additional devices, such as phased-array antennas, multiple receivers, or AHRS (Attitude and Heading Reference System), on drones. Software-based GPS spoofing detection is performed by verifying the consistency of PVT (Position, Velocity, Time) of GPS signals from spoofing equipment, monitoring relative GPS signal strength, position signal strength of received signals, and monitoring identification codes and the number of received signals. A method of detecting GPS spoofing using the GNSS (Global Navigation Satellite System) method is employed by utilizing signal strength, reception time, etc. Recently, a technology has been proposed to detect GPS spoofing by using the average, min-max range, and SNR (Signal-to-Noise Ratio) standard deviation of received signals as inputs to a neural network. However, the problem with this approach is that, assuming a GPS spoofing detection method, an attacker can forge the characteristics and location of the signal at any time, thereby enabling GPS spoofing. The problem to be solved

[0004] The present disclosure proposes a new GPS spoofing detection method for defending against GPS spoofing attacks by unmanned aerial vehicles.

[0005] The present disclosure provides a radio frequency fingerprinting-based unmanned aerial vehicle GPS spoofing detection device and method. means of solving the problem

[0006] In the present disclosure, a method for detecting GPS spoofing in a device mounted on an unmanned aerial vehicle may include the step of extracting radio frequency fingerprinting features from a received radio frequency signal, and the step of analyzing the radio frequency fingerprinting features to determine whether the radio frequency signal is a spoofing signal.

[0007] According to various embodiments, the step of determining whether the radio frequency signal is the spoofing signal is performed using a pre-trained model, and the trained model may be trained to classify the satellites by radio frequency fingerprinting features extracted from radio frequency signals from a plurality of satellites.

[0008] In the present disclosure, a device for detecting GPS spoofing mounted on an unmanned aerial vehicle may include a communication module configured to receive a radio frequency signal, a feature extraction module configured to extract radio frequency fingerprinting features from the radio frequency signal, and a detection module configured to analyze the radio frequency fingerprinting features to determine whether the radio frequency signal is a spoofing signal.

[0009] According to various embodiments, the detection module is configured to determine whether the radio frequency signal is the spoofing signal using a pre-trained model, and the trained model may be trained to classify the satellites using radio frequency fingerprinting features extracted from radio frequency signals from a plurality of satellites. Effects of the invention

[0010] Existing GPS spoofing defense systems and GPS spoofing attack systems are infinitely iterative processes of developing technology while evading each other's functions. According to the present disclosure, a GPS spoofing detection device can distinguish between a GPS signal from a satellite and a spoofing signal from a spoofing device using wireless signal fingerprinting technology. Thus, the GPS spoofing detection device can be mounted on an unmanned aerial vehicle to neutralize all GPS spoofing attacks on the unmanned aerial vehicle induced by the spoofing device. Brief explanation of the drawing

[0011] FIG. 1 is a block diagram illustrating the operating system of a GPS spoofing detection device according to the present disclosure. FIG. 2 is a block diagram illustrating the internal configuration of a GPS spoofing detection device according to the present disclosure. FIGS. 3a and FIG. 3b are exemplary diagrams for explaining radio frequency fingerprinting feature extraction in a GPS spoofing detection device according to the present disclosure. FIG. 4 is a flowchart illustrating a GPS spoofing detection method according to the present disclosure. Specific details for implementing the invention

[0012] Hereinafter, various embodiments of the present disclosure are described with reference to the accompanying drawings.

[0013] In the following, the present disclosure proposes a GPS spoofing detection technique using radio frequency fingerprinting technology. Radio frequency fingerprinting technology is a technique that receives a radio frequency signal and recognizes an identifier (ID) of a transmitting device hidden within the radio frequency signal.

[0014] FIG. 1 is a block diagram illustrating the operating system of a GPS spoofing detection device (100) according to the present disclosure.

[0015] Referring to FIG. 1, a GPS spoofing detection device (100 of FIG. 1) is mounted on an unmanned aerial vehicle (10) and can receive radio frequency signals. The GPS spoofing detection device (100) can be configured to analyze radio frequency signals to determine whether the radio frequency signal is a GPS signal having normal GPS information transmitted from a satellite (20) or a spoofing signal having forged GPS information transmitted from a spoofing device (30). Additionally, the GPS spoofing detection device (100) can detect a spoofing state, that is, whether the unmanned aerial vehicle is under a spoofing situation, based on the judgment results accumulated over a predetermined period of time.

[0016] FIG. 2 is a block diagram illustrating the internal configuration of a GPS spoofing detection device (100) according to the present disclosure. FIG. 3a and FIG. 3b are exemplary diagrams for explaining radio frequency fingerprinting feature extraction in a GPS spoofing detection device (100) according to the present disclosure.

[0017] Referring to FIG. 2, the GPS spoofing detection device (100) may include a receiving module (110), a processing module (120), a feature extraction module (130), a detection module (140), and a task execution module (150).

[0018] The receiving module (110) may be configured to receive radio frequency signals. At this time, the receiving module (110) may receive radio frequency signals from the unmanned aerial vehicle (10). The unmanned aerial vehicle (10) may receive radio frequency signals having GPS information while in operation and transmit them to the receiving module (110). For example, the receiving module (110) may receive and signal L1 carrier waves (center frequency 1575.42 Hz), L2 carrier waves (center frequency 1227.60 Hz), and L3 carrier waves (center frequency 1176.45 Hz).

[0019] The processing module (120) may be configured to process radio frequency signals. Specifically, the processing module (120) may detect an analysis section from the radio frequency signal and transform it into a defined format. For example, the processing module (120) may transform the I / Q signal of the analysis section into the frequency domain through a Fast Fourier Transform.

[0020] The feature extraction module (130) can extract radio frequency fingerprinting features from a radio frequency signal. Here, the radio frequency fingerprinting features can be extracted using at least one of the distribution of frequency peaks in the frequency domain for the radio frequency signal, the fourth moment in the frequency domain, the co-occurrence matrix, or the backbone of a one-dimensional neural network. As an example, the feature extraction module (130) can extract the distribution of frequency peaks in the frequency domain for the radio frequency signal as shown in FIG. 3a as a radio frequency fingerprinting feature. As another example, the feature extraction module (130) can generate a co-occurrence matrix for the radio frequency signal as shown in FIG. 3b, create cumulative distributions in the diagonal and horizontal directions, and then extract the mean and variance in each distribution as radio frequency fingerprinting features. For example, the feature extraction module (130) can extract radio frequency fingerprinting features for L1, L2, and L3.

[0021] The detection module (140) can determine whether the radio frequency signal is a spoofing signal by analyzing radio frequency fingerprinting features. At this time, the detection module (140) can determine whether the radio frequency signal is a spoofing signal by using a pre-trained model (141).

[0022] The trained model (141) may be trained to classify satellites (20) using radio frequency fingerprinting features extracted from radio frequency signals from multiple (e.g., 24 or more) satellites (20). Here, the reliability of the satellites (20), i.e., the radio frequency fingerprinting features, is detected, and this reliability may be set as a reference reliability. For example, the trained model (141) may be implemented using a one-dimensional CNN (convolutional neural network) algorithm (e.g., Resnet, etc.), and the reliability of the result of the one-dimensional CNN's feedforward algorithm on the radio frequency fingerprinting features may be set as a reference reliability.

[0023] Specifically, the detection module (140) can determine that the radio frequency signal is a spoofed signal if the reliability of the radio frequency fingerprinting features is less than the reliability of the radio frequency fingerprinting features, i.e., the reference reliability. At this time, the detection module (140) can detect the reliability of the radio frequency fingerprinting features using the learned model (141). For example, the reliability of the result of the execution of the one-dimensional CNN algorithm on the radio frequency fingerprinting features of the learned model (141) can be detected as the reliability of the radio frequency fingerprinting features. Then, the detection module (140) can compare this reliability with the reference reliability. As a result, if this reliability is less than the reference reliability, the detection module (140) can determine that the radio frequency signal is a spoofed signal. Meanwhile, if this reliability is greater than or equal to the reference reliability, the detection module (140) can determine that the radio frequency signal is a GPS signal.

[0024] In addition, the detection module (140) can detect a spoofing state if it determines that a predetermined ratio of radio frequency signals received during a predetermined time period consists of spoofing signals. That is, the detection module (140) can detect a spoofing state, that is, whether the unmanned aerial vehicle (10) is in a spoofing situation, based on the accumulated judgment results regarding radio frequency signals received during a predetermined time period. Here, if radio frequency signals exceeding a predetermined ratio are determined to be spoofing signals, the detection module (140) can detect a spoofing state. Meanwhile, if radio frequency signals below a predetermined ratio are determined to be spoofing signals, the detection module (140) can detect a normal state, not a spoofing state.

[0025] The mission execution module (150) can notify the unmanned aerial vehicle (10) whether the radio frequency signal is a spoofing signal. At this time, if the radio frequency signal is a normal GPS signal, the mission execution module (150) can cause the unmanned aerial vehicle (10) to refer to the GPS signal. Meanwhile, if the radio frequency signal is a spoofing signal, the mission execution module (150) can cause the unmanned aerial vehicle (10) to ignore the spoofing signal. In addition, if a spoofing state is detected, the mission execution module (150) can provide a control command to the unmanned aerial vehicle (10). For example, the mission execution module (150) can cause the unmanned aerial vehicle (10) to automatically leave its current location. As another example, the mission execution module (150) can cause the unmanned aerial vehicle (10) to automatically destroy data stored internally.

[0026] FIG. 4 is a flowchart illustrating a GPS spoofing detection method according to the present disclosure.

[0027] Referring to FIG. 4, the GPS spoofing detection device (100) can receive a radio frequency signal at step 210. Specifically, a receiving module (110) can receive a radio frequency signal. At this time, the receiving module (110) can receive a radio frequency signal from an unmanned aerial vehicle (10). The unmanned aerial vehicle (10) can receive a radio frequency signal containing GPS information while in operation and transmit it to the receiving module (110). Then, a processing module (120) can process the radio frequency signal. Specifically, the processing module (120) can detect an analysis section from the radio frequency signal and transform it into a predetermined format.

[0028] Next, the GPS spoofing detection device (100) can extract radio frequency fingerprinting features from a radio frequency signal in step 220. Specifically, the feature extraction module (130) can extract radio frequency fingerprinting features from a radio frequency signal. Here, the radio frequency fingerprinting features can be extracted using at least one of the distribution of frequency peaks in the frequency domain for the radio frequency signal, the fourth moment in frequency, the co-occurrence matrix, or the backbone of a one-dimensional neural network.

[0029] Next, the GPS spoofing detection device (100) can determine whether a radio frequency signal is a spoofing signal based on radio frequency fingerprinting features by using a pre-trained model in step 230. Specifically, by using a pre-trained model (141), it can determine whether a radio frequency signal is a spoofing signal by analyzing radio frequency fingerprinting features.

[0030] The trained model (141) may be trained to classify satellites (20) using radio frequency fingerprinting features extracted from radio frequency signals from multiple (e.g., 24 or more) satellites (20). Here, the reliability of the satellites (20), i.e., the radio frequency fingerprinting features, is detected, and this reliability may be set as a reference reliability. For example, the trained model (141) may be implemented using a one-dimensional CNN (convolutional neural network) algorithm (e.g., Resnet, etc.), and the reliability of the result of the one-dimensional CNN's feedforward algorithm on the radio frequency fingerprinting features may be set as a reference reliability.

[0031] More specifically, the detection module (140) can determine that the radio frequency signal is a spoofed signal if the reliability of the radio frequency fingerprinting features is less than the reliability of the radio frequency fingerprinting features, i.e., the reference reliability. At this time, the detection module (140) can detect the reliability of the radio frequency fingerprinting features using the learned model (141). For example, the reliability of the result of the execution of the one-dimensional CNN algorithm on the radio frequency fingerprinting features of the learned model (141) can be detected as the reliability of the radio frequency fingerprinting features. Then, the detection module (140) can compare this reliability with the reference reliability. As a result, if this reliability is less than the reference reliability, the detection module (140) can determine that the radio frequency signal is a spoofed signal. Meanwhile, if this reliability is greater than or equal to the reference reliability, the detection module (140) can determine that the radio frequency signal is a GPS signal.

[0032] In addition, the mission execution module (150) can notify the unmanned aerial vehicle (10) whether the radio frequency signal is a spoofing signal. At this time, if the radio frequency signal is a normal GPS signal, the mission execution module (150) can cause the unmanned aerial vehicle (10) to refer to the GPS signal. Meanwhile, if the radio frequency signal is a spoofing signal, the mission execution module (150) can cause the unmanned aerial vehicle (10) to ignore the spoofing signal.

[0033] Continuing, the GPS spoofing detection device (100) can determine whether a predetermined time has elapsed in step 240. If it is determined that the predetermined time has not elapsed in step 240, the GPS spoofing detection device (100) can repeat steps 210 through 240. In this way, the GPS spoofing detection device (100) can accumulate determination results regarding whether a radio frequency signal received during a predetermined time is a spoofing signal.

[0034] When it is determined that a set time has elapsed in step 240, the GPS spoofing detection device (100) can detect whether a spoofing state exists based on the judgment results accumulated during the set time in step 250. Specifically, the detection module (140) can detect a spoofing state if it is determined that a predetermined ratio of radio frequency signals received during a predetermined time consists of spoofing signals. That is, the detection module (140) can detect a spoofing state, i.e., whether the unmanned aerial vehicle (10) is in a spoofing situation, based on the accumulated judgment results regarding radio frequency signals received during a predetermined time. Here, if radio frequency signals exceeding a predetermined ratio are determined to be spoofing signals, the detection module (140) can detect a spoofing state. Meanwhile, if radio frequency signals below a predetermined ratio are determined to be spoofing signals, the detection module (140) can detect a normal state, not a spoofing state.

[0035] Finally, the GPS spoofing detection device (100) can perform a mission depending on whether there is a spoofing state at step 260. Specifically, if a spoofing state is detected, the mission execution module (150) can provide control commands to the unmanned aerial vehicle (10). For example, the mission execution module (150) can cause the unmanned aerial vehicle (10) to automatically leave its current location. For another example, the mission execution module (150) can cause the unmanned aerial vehicle (10) to automatically destroy data stored inside.

[0036] The existing GPS spoofing defense system and GPS spoofing attack system are an infinitely repeating process of developing technology while evading each other's functions. According to the present disclosure, a GPS spoofing detection device (100) can distinguish between a GPS signal from a satellite (20) and a spoofing signal from a spoofing device (30) using wireless signal fingerprinting technology. That is, the GPS spoofing detection device (100) can clearly distinguish between the identifiers of the satellite (20) and the spoofing device (30) using wireless signal fingerprinting technology. Thus, the GPS spoofing detection device (100) can be mounted on an unmanned aerial vehicle (10) to neutralize all GPS spoofing attacks on the unmanned aerial vehicle (10) induced by the spoofing device (30).

[0037] The device described above may be implemented as a hardware component, a software component, and / or a combination of a hardware component and a software component. For example, the device and components described in the embodiments may be implemented using one or more general-purpose or special-purpose computers, such as a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing unit may execute an operating system (OS) and one or more software applications executed on said operating system. Additionally, the processing unit may access, store, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, the processing unit may be described as being used as a single unit, but those skilled in the art will understand that the processing unit may include multiple processing elements and / or multiple types of processing elements. For example, the processing unit may include multiple processors or one processor and one controller. Additionally, other processing configurations, such as parallel processors, are also possible.

[0038] Software may include computer programs, code, instructions, or a combination of one or more of these, and may configure a processing unit to operate as desired or instruct the processing unit independently or collectively. Software and / or data may be embodied in any type of machine, component, physical device, computer storage medium, or device so as to be interpreted by the processing unit or to provide instructions or data to the processing unit. Software may be distributed over networked computer systems and may be stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

[0039] Methods according to various embodiments may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. In this case, the medium may continuously store a program executable by a computer, or temporarily store it for execution or download. Furthermore, the medium may be various recording or storage means in the form of a single or several combined hardware, and may not be limited to a medium directly connected to a computer system but may exist distributed over a network. Examples of media may include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and media configured to store program instructions, including ROM, RAM, and flash memory. Additionally, other examples of media may include recording or storage media managed by app stores that distribute applications or sites and servers that supply or distribute various other software.

[0040] The various embodiments of this document and the terms used therein are not intended to limit the technology described in this document to specific embodiments and should be understood to include various modifications, equivalents, and / or substitutions of such embodiments. In relation to the description of the drawings, similar reference numerals may be used for similar components. A singular expression may include a plural expression unless the context clearly indicates otherwise. In this document, expressions such as "A or B," "at least one of A and / or B," "A, B or C," or "at least one of A, B and / or C" may include all possible combinations of items listed together. Expressions such as "first," "second," "first," or "second" may modify the components, regardless of order or importance, and are used only to distinguish one component from another and do not limit the components. When it is mentioned that a certain (e.g., first) component is "(functionally or telecommunicationally) connected" or "connected" to another (e.g., second) component, said certain component may be directly connected to said other component or connected through another component (e.g., third component).

[0041] According to various embodiments, each component (e.g., module or program) of the described components may include a singular or multiple entities. According to various embodiments, one or more of the aforementioned components or steps may be omitted, or one or more other components or steps may be added. Generally or additionally, multiple components (e.g., module or program) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the multiple components in the same or similar manner as they were performed by the corresponding component among the multiple components prior to integration. According to various embodiments, steps performed by the module, program, or other components may be executed sequentially, in parallel, iteratively, or heuristically; one or more of the steps may be executed in a different order; omitted; or one or more other steps may be added.

Claims

Claim 1 A method for detecting GPS spoofing in a device mounted on an unmanned aerial vehicle, comprising: a step of extracting radio frequency fingerprinting features from a received radio frequency signal; and a step of analyzing the radio frequency fingerprinting features to determine whether the radio frequency signal is a spoofing signal, wherein the step of extracting radio frequency fingerprinting features comprises: a step of generating a co-occurrence matrix for the radio frequency signal; a step of generating cumulative distributions in the diagonal and horizontal directions of the co-occurrence matrix; and a step of extracting the mean and variance at each of the cumulative distributions as radio frequency fingerprinting features. Claim 2 A method according to claim 1, wherein the step of determining whether the radio frequency signal is the spoofing signal is performed using a pre-trained model, and the trained model is trained to classify the satellites based on radio frequency fingerprinting features extracted from radio frequency signals from a plurality of satellites. Claim 3 In claim 2, the step of determining whether the radio frequency signal is the spoofing signal comprises the step of determining that the radio frequency signal is the spoofing signal if the reliability of the radio frequency fingerprinting feature is less than the reliability of the radio frequency fingerprinting feature. Claim 4 delete Claim 5 A method according to claim 1, further comprising the step of detecting a spoofing state when a predetermined ratio of radio frequency signals received during a predetermined time is determined to be spoofing signals. Claim 6 A device for detecting GPS spoofing mounted on an unmanned aerial vehicle, comprising: a receiving module configured to receive a radio frequency signal; a feature extraction module configured to extract radio frequency fingerprinting features from the radio frequency signal; and a detection module configured to analyze the radio frequency fingerprinting features to determine whether the radio frequency signal is a spoofing signal, wherein the feature extraction module is configured to generate a co-occurrence matrix for the radio frequency signal, generate cumulative distributions in the diagonal and horizontal directions of the co-occurrence matrix, and extract the mean and variance at each of the cumulative distributions as radio frequency fingerprinting features. Claim 7 In claim 6, the detection module is configured to determine whether the radio frequency signal is the spoofing signal using a pre-trained model, and the trained model is trained to classify the satellites using radio frequency fingerprinting features extracted from radio frequency signals from a plurality of satellites.

Images