A method for defending against satellite navigation positioning spoofing signals

Abstract

The present invention discloses a method for defending against satellite navigation and positioning deception signals, which relates to the technical field of satellite navigation and positioning deception signal defense, and includes three stages: a data preprocessing stage, a time series data prediction stage, and anomaly detection stage. First, by recording a set of satellite positioning time series data, learning its changing trend and predicting it, a predicted value is given, and then a dynamic threshold is generated according to the predicted value and anomaly detection is performed, and whether deception occurs is determined according to the anomaly detection result. The beneficial effects of the present invention are: no additional hardware overhead is introduced, and no additional features are collected and used. The detection of satellite navigation and positioning deception signals can be completed only by relying on the positioning results of the receiver; the dynamic threshold method adopted is highly flexible and adaptable, and the dynamic threshold parameters can be freely set to meet different security demand scenarios; in the field of satellite navigation and positioning deception defense technology, this method has extremely low application cost and broad application prospects.

Description

Technical Field

[0001] The present invention belongs to the technical field of satellite navigation positioning spoofing signal defense, and relates to a satellite navigation positioning spoofing signal defense method, and specifically to a satellite navigation positioning spoofing detection method based on base station time series data prediction and anomaly detection. Background Art

[0002] The Global Navigation Satellite System (GNSS) is a general term for all satellite navigation systems, including global systems, regional systems, and augmentation systems. GNSS was originally used mainly in the military field and played an important role in control and command. With the further development of science and technology and the increasingly urgent needs in various fields, satellite navigation and positioning services have developed from the military field to the civil field. At present, they have been widely used in various fields such as transportation, meteorological observation and reporting, communication systems, power systems, hydrological monitoring, agriculture, forestry, animal husbandry and fishery, and have produced significant economic and social benefits. From the military field to the civil field, from the national economy to personal life, satellite navigation and positioning services are now almost indispensable at every moment, and the importance of satellite navigation and positioning technology can be seen.

[0003] However, the satellite constellation in space needs to transmit signals to ground receivers through the ionosphere, troposphere and atmosphere. After a long-distance transmission of more than 20,000 kilometers, the satellite navigation signal attenuates very seriously. Generally, the signal power is only about -160dBW after reaching the ground, and it is extremely susceptible to various interferences in the environment, making the receiver unable to work normally.

[0004] It is inevitable that GNSS signals are subject to natural interference and electromagnetic interference. Usually, the impact is not significant, and some means can be used to reduce or eliminate interference. The real threat to the receiver is human interference. GNSS signals include both military signals and civilian signals. Military signals have a confidential structure and are relatively safe, while the civilian signal system is public, including information such as carrier frequency and modulation method. This kind of transmission signal with a public data format and no security verification mechanism is extremely vulnerable to spoofing attacks, which can deceive the target into the position set by the attacker without realizing it.

[0005] If scammers use this technology to attack infrastructure such as transportation systems, power systems, and civil aviation systems, it will cause immeasurable losses to people's normal lives, economic and property security, and even personal safety.

[0006] Therefore, we invented a satellite navigation positioning deception detection method based on time series data prediction and anomaly detection. We proposed the concept of jump coefficient, introduced deep learning technology, defined the anomaly judgment formula, and achieved better detection results without adding any hardware cost. Summary of the invention

[0007] The present invention adopts the following technical solutions

[0008] A satellite navigation positioning deception detection method based on time series data prediction and anomaly detection includes: a data preprocessing stage, a time series data prediction stage and anomaly detection stage.

[0009] Among them, in the data preprocessing stage, a set of time series data is feature extracted, and the jump coefficient is used to convert the multi-dimensional features into a single dimension to simplify the prediction model. In order to improve the learning rate of subsequent time series data prediction, the extracted jump coefficient needs to be normalized; in the time series data prediction stage, the LSTM neural network is used to model and analyze the preprocessed time series data to give the jump coefficient predicted by the algorithm; in the anomaly detection stage, the predicted jump coefficient is first denormalized and converted into the same dimension as the original data to serve as a basis for subsequent threshold comparison. The processed prediction value is input into the anomaly judgment formula to calculate the dynamic threshold. For the original time series data, the threshold comparison is performed one by one. If it is less than the threshold, it is judged as normal, and if it is greater than the threshold, it is judged as abnormal. As long as there is at least one abnormal point, it can be judged that there is deception.

[0010] The technical idea is to record a set of satellite positioning time series data, learn its changing trend and make predictions, give prediction values, generate dynamic thresholds according to the formula of the invention based on the prediction values ​​for anomaly detection, and determine whether deception occurs based on the anomaly detection results. The specific steps are as follows:

[0011] 1. Input time series longitude and latitude data. For the convenience of explanation, a set of data is expressed as (x t ,y t ), where x t is the longitude, y t is the latitude, and t is the time when this set of time series longitude and latitude data is generated.

[0012] 2. Calculate the jump coefficient. The jump coefficient is a concept proposed by the present invention, which is used to describe the degree of change between two positioning results. Its definition formula is as follows:

[0013]

[0014] Among them, J t is the jump coefficient at time t, x t is the longitude of the receiver at time t, y tis the latitude of the receiver at time t, x t-1 is the longitude value of the receiver at time t-1, which is the moment before time t, y t-1 is the latitude of the receiver at time t-1, and Δt is the number of seconds between time t and time t-1. Under normal circumstances, the jump coefficient is extremely small, generally in the order of 10 -4 Considering the calculation accuracy of different devices, it is necessary to multiply by a constant C. In this invention, C=10 4 .

[0015] 3. Normalize the calculated jump coefficient, and the formula is expressed as

[0016]

[0017] in, is the normalized jump coefficient, J min and J max The minimum and maximum values ​​of this set of jump coefficients respectively.

[0018] 4. Split the normalized jump coefficients into training set and test set in half, input them into LSTM neural network for training and prediction, and get the prediction result as follows:

[0019] 5. Denormalize the predicted value to restore it to the original dimension, and the formula is:

[0020]

[0021] Among them, J max and J min are the minimum and maximum values ​​of the input time series data, which have the same meaning as in the normalization formula. The prediction result after denormalization is E t .

[0022] 6. Based on the predicted value and the dynamic threshold formula given in this paper, a set of decision thresholds are obtained, and the calculation method is shown in the following formula.

[0023] T t =α×E t +β

[0024] Among them, T t is the dynamic threshold, E tis the prediction result after inverse normalization. α and β are constants and can be adjusted according to the actual situation. α mainly reflects the impact of the prediction value on the threshold. This value usually needs to be greater than 1. When the receiver is often in a fast motion, the threshold is mainly affected by the α value. The β value is usually greater than 0. When the receiver is stationary for a long time or moves slowly, the threshold is mainly affected by β. Therefore, by adjusting α and β, the calculated threshold can be adapted to receivers in different motion states to obtain better detection performance. Under normal circumstances, it is recommended that α = 1.5 and β = 75.

[0025] 7. By adjusting the original input jump coefficient J t Each point in the threshold is compared one by one. If J t ≤T t , it means that the value is consistent with the predicted result and there is no abnormality. t >T t , it means that the value is significantly different from the predicted value and there is an anomaly, that is, it is under attack.

[0026] Beneficial Effects

[0027] Compared with the existing deception detection technology, the present invention does not introduce any additional hardware overhead, nor does it collect and use any additional features. It can complete the detection of satellite navigation positioning deception signals by relying solely on the positioning results of the receiver. In addition, the dynamic threshold method adopted by the present invention is highly flexible and adaptable, and the dynamic threshold parameters can be freely set to meet different security requirements. Therefore, in the field of satellite navigation positioning deception defense technology, this method has extremely low application cost and broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flow chart of the satellite navigation positioning deception detection method based on time series data prediction and anomaly detection.

[0029] Figure 2 This is a schematic diagram of the LSTM neural network structure of the present invention.

[0030] Figure 3 A typical plot of the dynamic threshold versus true value for a non-deceptive receiver.

[0031] Figure 4 A typical plot of the dynamic threshold versus true value for a receiver that is spoofed. DETAILED DESCRIPTION

[0032] like Figure 1 As shown in FIG. 1 , a satellite navigation positioning spoofing detection method based on time series data prediction and anomaly detection is shown in FIG. 1 . Figure 1As shown in the figure, it includes the following three stages, namely, data preprocessing stage, time series data prediction stage and anomaly detection stage. Among them, the data preprocessing stage mainly extracts features from a set of time series data, and uses the jump coefficient defined in this paper to convert multi-dimensional features into single dimensions, thereby simplifying the prediction model. In order to improve the learning rate of subsequent time series data prediction, it is necessary to normalize the extracted jump coefficients; the time series data prediction stage uses the LSTM neural network to model and analyze the preprocessed time series data, and gives the jump coefficients predicted by the algorithm; the anomaly detection stage first denormalizes the predicted jump coefficients and converts them into the same dimension as the original data, which serves as the basis for subsequent threshold comparison. The processed prediction value is input into the anomaly judgment formula given in this paper to calculate the dynamic threshold. For the original time series data, the thresholds are compared one by one. If it is less than the threshold, it is judged as normal, and if it is greater than the threshold, it is judged as abnormal. As long as there is at least one abnormal point, it can be judged as deception.

[0033] like Figure 2 As shown, it is a schematic diagram of the LSTM neural network structure used in this embodiment. It is an LSTM neural network with an input step size of 4 and an output sequence of 1. During the working process, each time point can be regarded as a fully connected neural network. The network has a hidden layer composed of a layer of LSTM units. The hidden layer states h and C of the previous moment will be transmitted to the next moment to complete the long short-term memory training.

[0034] The following is combined with Figure 3 , 4 Specific embodiments of the present invention are described.

[0035] Example 1

[0036] When the receiver is not deceived, first, the system continuously collects satellite navigation signals, calculates the positioning position, and records the positioning time as a set of data. Multiple sets of data are combined to form time series data, and the jump coefficient is calculated according to the following formula:

[0037]

[0038] The calculated jump coefficients are normalized to speed up the training of the time series data prediction phase and reduce the convergence time. The normalization formula is shown below:

[0039]

[0040] The normalized jump coefficients are split into training set and test set in half, respectively, and input into LSTM neural network for training and prediction to obtain the predicted value.

[0041] The predicted value is denormalized to restore it to its original dimension to facilitate the comparison of thresholds in subsequent anomaly detection. The denormalization formula is shown below:

[0042]

[0043] Finally, the dynamic threshold formula given by the present invention is used to generate the dynamic threshold according to the denormalized predicted value. The dynamic threshold formula is shown as follows:

[0044] T t =α×E t +β

[0045] Using the calculated dynamic threshold, the original time series data is compared with the threshold one by one. If it is less than the threshold, it is considered normal, and if it is greater than the threshold, it is considered abnormal. As long as there is at least one abnormal point, it can be judged that there is fraud. Figure 3 The figure shows the relationship between the dynamic threshold and the true value when the receiver is not deceiving. The solid line in the figure represents the true value, and the dotted line represents the calculated dynamic threshold. All the true values ​​are less than the dynamic threshold, so it is determined that no deceiving occurs.

[0046] Example 2

[0047] When the receiver is deceived, first, the system continuously collects satellite navigation signals, calculates the positioning position, and records the positioning time as a set of data. Multiple sets of data are combined to form time series data, and the jump coefficient is calculated according to the following formula:

[0048]

[0049] The calculated jump coefficients are normalized to speed up the training of the time series data prediction phase and reduce the convergence time. The normalization formula is shown below:

[0050]

[0051] The normalized jump coefficients are split into training set and test set in half, respectively, and input into LSTM neural network for training and prediction to obtain the predicted value.

[0052] The predicted value is denormalized to restore it to its original dimension to facilitate the comparison of thresholds in subsequent anomaly detection. The denormalization formula is shown below:

[0053]

[0054] Finally, the dynamic threshold formula given by the present invention is used to generate the dynamic threshold according to the denormalized predicted value. The dynamic threshold formula is shown as follows:

[0055] Tt =α×E t +β

[0056] Using the calculated dynamic threshold, the original time series data is compared with the threshold one by one. If it is less than the threshold, it is considered normal, and if it is greater than the threshold, it is considered abnormal. As long as there is at least one abnormal point, it can be judged that there is fraud. Figure 4 The figure shows the relationship between the dynamic threshold and the true value in a typical case where the receiver is deceived. The solid line in the figure represents the true value, and the dotted line represents the calculated dynamic threshold. It can be seen that at the 24th observation point on the horizontal axis, the receiver is deceived, causing a drastic change in the jump coefficient value, which does not conform to the prediction result of the LSTM neural network based on its movement trend, causing the true value to exceed the dynamic threshold, so it is determined to be deception.

Claims

1. A satellite navigation positioning deception detection method, characterized in that: include: Data preprocessing stage, time series data prediction stage and anomaly detection stage; In the data preprocessing stage, a set of time series data is subjected to feature extraction, and the multi-dimensional features are converted into a single dimension using jump coefficients, the prediction model is simplified, and the extracted jump coefficients are normalized; In the time series data prediction stage, an LSTM neural network is used to model and analyze the preprocessed time series data to provide a jump coefficient predicted by the algorithm; In the anomaly detection stage, the predicted jump coefficient is first denormalized and converted into the same dimension as the original data, which serves as the basis for subsequent threshold comparison. The processed predicted value is input into the anomaly judgment formula to calculate the dynamic threshold. For the original time series data, the thresholds are compared one by one to determine whether there is deception. The specific steps include: S1: Input time series longitude and latitude data; S2: Calculate the jump coefficient; S3: normalize the calculated jump coefficient; S4: Split the normalized jump coefficients into a training set and a test set in half, input them into the LSTM neural network for training and prediction, and obtain the predicted value; S5: Denormalize the predicted value to restore it to the original dimension; S6: Obtain a set of decision thresholds according to the predicted value and the dynamic threshold formula; S7: By comparing the thresholds of each point in the original input jump coefficient one by one, if it is less than the threshold, it is judged as normal, and if it is greater than the threshold, it is judged as abnormal. As long as there is at least one abnormal point, it is judged that there is fraud; The step S1 specifically includes: Express a set of data as (x t ,y t ), where x t is the longitude, y t is the latitude, and t is the time when this set of time series longitude and latitude data is generated; The step S2 specifically includes: The jump coefficient is used to describe the degree of change between two positioning results. Its definition formula is as follows: Among them, J t is the jump coefficient at time t, x t is the longitude of the receiver at time t, y t is the latitude of the receiver at time t, x t-1 is the longitude value of the receiver at time t-1, which is the moment before time t, y t-1 is the latitude of the receiver at time t-1, and Δt is the number of seconds between time t and time t-1. Since the jump coefficient is extremely small, the order of magnitude is 10 -4 Considering the calculation accuracy of different devices, we need to multiply it by a constant C, C = 10 4 ; The step S3 specifically includes: The calculated jump coefficient is normalized, and the formula is expressed as in, is the normalized jump coefficient, J min and J max The minimum and maximum values ​​of this set of jump coefficients respectively; The step S4 specifically includes: The normalized jump coefficients are split into training set and test set in half, and input into LSTM neural network for training and prediction. The prediction result is: The step S5 specifically includes: The predicted value is denormalized to restore the original dimension, and the formula is expressed as Among them, J max and J min are the minimum and maximum values ​​of the input time series data, which have the same meaning as in the normalization formula; the prediction result after denormalization is E t ; The step S6 specifically includes: According to the predicted value and the given dynamic threshold formula, a set of decision thresholds are obtained, and the calculation method is shown in the following formula: T t =α×E t +b Among them, T t is the dynamic threshold, E t is the prediction result after denormalization; α and β are constants, which are adjusted according to the actual situation. α mainly reflects the influence of the prediction value on the threshold. This value needs to be greater than 1. When the receiver is often in a fast motion, the threshold is mainly affected by the α value; β value is greater than 0. When the receiver is stationary for a long time or moves slowly, the threshold is mainly affected by β. Therefore, by adjusting α and β, the calculated threshold is adapted to receivers in different motion states to obtain better detection performance, α = 1.5, β = 75.

2. A satellite navigation positioning fraud detection method according to claim 1, characterized in that: The step S7 specifically includes: By adjusting the original input jump coefficient J t Each point in the threshold is compared one by one. If J t ≤T t , it means that the value is consistent with the predicted result and there is no abnormality. t >T t , it means that the value is significantly different from the predicted value and there is an anomaly, that is, it is under attack.

Images