A time spoofing detection method based on GPS signal characteristics

Abstract

The application discloses a time deception detection method based on GPS signal characteristics, comprising the following steps: extracting original data from GPS original data; obtaining the variance of the carrier-to-noise ratio of each channel in the time window corresponding to the current time and the variance of the Doppler frequency based on the carrier-to-noise ratio and the Doppler frequency of the K-path channel; updating the abnormal times of the carrier-to-noise ratio variance data based on the relationship between the variance of the carrier-to-noise ratio of each channel and the carrier-to-noise ratio variance threshold, and updating the abnormal times of the Doppler frequency variance data based on the relationship between the variance of the Doppler frequency of each channel and the Doppler frequency variance threshold; simultaneously judging whether the abnormal times of the carrier-to-noise ratio variance data and the abnormal times of the Doppler frequency variance data of each channel reach a preset condition, and if the preset condition is reached, it is indicated that time deception occurs. The application illustrates a continuous detection scheme and under what conditions the multiple data demodulated from the GPS original signal data can be identified as GPS deception interference.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a time spoofing detection method based on GPS signal characteristics. Background Technology

[0002] With the widespread use of GPS, deceiving users seeking location can be achieved by generating or delaying the transmission of GPS signals. Satellite navigation deception jamming technology, as a new type of jamming technique, is characterized by its strong concealment and high threat level. Deception jamming targets timing receivers configured in infrastructure, injecting time errors to disrupt system time synchronization, thus deceiving the system's time and paralyzing power, control, and communication systems.

[0003] GPS not only provides precise positioning services, but also precise time synchronization down to the nanometer level. This is because GPS uses atomic clocks, achieving time accuracy within one billionth of a second. Many time-sensitive systems require GPS signals for precise time synchronization. However, power grids are vulnerable to GPS time spoofing attacks because they rely on precise time synchronization for measurement and state estimation. Large time errors in phasor measurement units can have serious consequences, including power outages. Furthermore, GPS time is used as a transaction timestamp in financial transactions; even nanosecond-level time errors can have severe consequences for global markets. Major communication networks and banking systems also heavily rely on GPS for precise time synchronization. GPS civilian signals are easy to capture, process, and generate. With the continuous improvement of radio frequency hardware and software-defined radio platforms, transmitting and receiving signals in the GPS civilian frequency band is not difficult. Attackers can also extract GPS information using unencrypted GPS civilian signals. Detecting GPS time spoofing can prevent many of these problems, thereby improving GPS security. Therefore, GPS receiver time spoofing detection methods are needed.

[0004] [Liang He, Wei Li, Chengjun Guo, and Ruizhao Niu, “Civilian Unmanned Aerial Vehicle Vulnerability to GPS Spoofing Attacks”, in proc. of the International Symposium on Computational Intelligence and Design (ISCID), Dec. 2014] proposes a GPS spoofing detection scheme based on signal distortion detection. Since the initial phase and C / A code of the GPS signal are relatively stable, the GPS receiver can track the amplitude intensity of the incoming signal. After the attacker's spoofing signal and the original satellite signal are fused, a peak signal will be generated. Based on this, this peak signal can be detected to confirm whether spoofing has occurred.

[0005] [Bin Qian, Ziwen Cai, Yong Xiao, Liang Hong, and Sheng Su. GPS spoofing-based time synchronization attack in advanced metering infrastructure and its protection. The Journal of Engineering 2020, no.9(2020):809-815.] This study found that time synchronization disorder caused by GPS spoofing-based time synchronization attacks (TSA) can disable the front-end system functions of advanced metering infrastructures. A time jitter-based detection algorithm is proposed to identify and defend against GPS time spoofing.

[0006] The GPS spoofing detection method proposed in the patent "Lin Li, Qin Yaohui, Wang Kailun, Wang Jiaxuan, Lin Yitong. GPS Spoofing Detection and Defense Method for Autonomous Navigation UAVs: CN201811448705.4[P].2019-03-08" is based on Kalman filter analysis detection technology and signal-to-noise ratio technology. In the Kalman filter analysis detection stage, the predicted value is calculated using navigation inertia based on the GPS positioning information of the previous moment, and then compared with the actual value to determine whether the difference between the predicted value and the actual value is within a reasonable range. In the carrier-to-noise ratio change detection stage, the difference between the previous moment and the current moment is compared with a threshold for detection.

[0007] The above methods fail to adequately reflect numerical changes in GPS spoofing detection, struggle to determine specific threshold values, and cannot consistently detect time-based spoofing interference over extended periods. Furthermore, they lack the ability to further process the demodulated GPS signal data to improve detection reliability; and they do not propose solutions for situations where undisturbed signals may experience jumps similar to spoofing interference due to various reasons. Summary of the Invention

[0008] To address the aforementioned problems in the prior art, this invention provides a time spoofing detection method based on GPS signal characteristics.

[0009] The technical problem to be solved by this invention is achieved through the following technical solution:

[0010] A time spoofing detection method based on GPS signal characteristics, the time spoofing detection method comprising:

[0011] Step 1: Extract raw data from the GPS raw data, which includes carrier-to-noise ratio, Doppler frequency, and raw reception time;

[0012] Step 2: Based on the carrier-to-noise ratio and the Doppler frequency of the K channels, obtain the variance of the carrier-to-noise ratio and the variance of the Doppler frequency of each channel within the time window corresponding to the current moment;

[0013] Step 3: Update the number of anomalies in the carrier-to-noise ratio variance data of each channel based on the relationship between the variance of the carrier-to-noise ratio and the carrier-to-noise ratio variance threshold; update the number of anomalies in the Doppler frequency variance data of each channel based on the relationship between the variance of the Doppler frequency and the Doppler frequency variance threshold.

[0014] Step 4: Simultaneously determine whether the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data of each channel have reached the preset conditions. If the preset conditions have not been reached, proceed to the time window corresponding to the next moment and determine whether the original reception time has been increased by a fixed duration. If not, directly execute steps 1 to 4. If yes, the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data are reset to zero, and steps 1 to 4 are executed. If the preset conditions are met, it indicates that time spoofing has occurred.

[0015] Optionally, the raw data may also include raw reception time, pseudorange, carrier phase, and PRN code.

[0016] Optionally, based on the carrier-to-noise ratio and the Doppler frequency of the K channels, the variance of the carrier-to-noise ratio and the variance of the Doppler frequency for each channel within the time window corresponding to the current moment are obtained, including:

[0017] Select the carrier-to-noise ratio and the Doppler frequency of K channels, and within the current time window, calculate the variance of the carrier-to-noise ratio and the variance of the Doppler frequency of each channel after n samples.

[0018] Optionally, the step of updating the number of anomalies in the carrier-to-noise ratio variance data of a channel based on the relationship between the carrier-to-noise ratio variance and the carrier-to-noise ratio variance threshold includes:

[0019] Determine whether the variance of the carrier-to-noise ratio of the k-th channel is greater than the carrier-to-noise ratio variance threshold within a first preset time period. If yes, increment the number of anomalies in the carrier-to-noise ratio variance data corresponding to the k-th channel by 1. If no, keep the number of anomalies in the carrier-to-noise ratio variance data corresponding to the k-th channel unchanged, where 1≤k≤K.

[0020] Optionally, the first preset time is 1 second.

[0021] Optionally, the step of updating the number of anomalies in the Doppler frequency variance data of a channel based on the relationship between the variance of the Doppler frequency and the Doppler frequency variance threshold of each channel includes:

[0022] Determine whether the variance of the Doppler frequency of the k-th channel is greater than the Doppler frequency variance threshold within a second preset time period. If yes, increment the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel by 1. If no, keep the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel unchanged, where 1≤k≤K.

[0023] Optionally, the second preset time is 1 second.

[0024] Optionally, determine the relationship between the number of anomalies in the carrier-to-noise ratio variance data of the k-th channel and the minimum and maximum values ​​τ1 and τ3 of the threshold for the number of anomalies in the carrier-to-noise ratio variance data, and whether the relationship between the number of anomalies in the Doppler frequency variance data and the minimum and maximum values ​​τ2 and τ4 of the threshold for the number of anomalies in the Doppler frequency variance data meets a preset condition. If the preset condition is not met, proceed to the time window corresponding to the next moment and determine whether the original reception time has been increased by a fixed duration. If not, directly execute steps 1 to 4. If yes, the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel is reduced to zero, and steps 1 to 4 are executed. If the preset condition is met, it indicates that time spoofing has occurred, 1≤k≤K.

[0025] The preset condition is one of the first condition, the second condition, and the third condition.

[0026] Optionally, the first condition is that the number of anomalies in the carrier-to-noise ratio variance data is greater than the minimum value τ1 of the carrier-to-noise ratio variance anomaly threshold, and the number of anomalies in the Doppler frequency variance data is greater than the minimum value τ2 of the Doppler frequency variance anomaly threshold.

[0027] The second condition is that the number of anomalies in the carrier-to-noise ratio variance data is greater than the maximum value τ3 of the carrier-to-noise ratio variance anomaly threshold.

[0028] The third condition is that the number of anomalies in the Doppler frequency variance data is greater than the maximum value τ4 of the Doppler frequency variance anomaly threshold.

[0029] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0030] 1. Compared to other inventions that fail to continuously detect time spoofing interference over a longer period, this invention first extracts raw data including carrier-to-noise ratio (CNR), Doppler frequency, and original reception time. Based on the CNR and Doppler frequency of k channels, it obtains the variance of CNR and the variance of Doppler frequency within the time window corresponding to the current moment. Then, it updates the number of anomalies in the CNR variance data based on the relationship between the CNR variance and the CNR variance threshold, and updates the number of anomalies in the Doppler frequency variance data based on the relationship between the Doppler frequency variance and the Doppler frequency variance threshold. Finally, it determines whether time spoofing has occurred by judging whether the number of anomalies in the CNR variance data and the Doppler frequency variance data reaches a preset condition. This method specifically illustrates a continuous detection scheme and under what circumstances multiple data points after demodulation of the original GPS signal data can be identified as GPS spoofing interference, and specifically proposes a detection process.

[0031] 2. Compared with other inventions' detection methods, which cannot well reflect numerical changes and have difficulty in determining the specific value of the threshold, this invention uses digital features to quantify the changes in GPS signal data after GPS time spoofing occurs, which makes it easier for computers to use code to detect GPS time spoofing.

[0032] 3. Compared with other inventions that only use one type of GPS signal data, this invention uses both carrier-to-noise ratio and Doppler frequency data to detect GPS spoofing interference.

[0033] 4. Compared with other inventions that only use demodulated GPS signal data, this invention further processes these GPS signal data and calculates the variance of the sampled data within the same time window. This processing method is beneficial for setting specific thresholds and improves the reliability of the detection results.

[0034] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating a time spoofing detection method based on GPS signal characteristics provided in an embodiment of the present invention;

[0036] Figure 2 This is a flowchart illustrating another time spoofing detection method based on GPS signal characteristics provided in an embodiment of the present invention. Detailed Implementation

[0037] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0038] Example 1

[0039] Please see Figure 1 , Figure 1 This is a flowchart illustrating a time spoofing detection method based on GPS signal characteristics provided in an embodiment of the present invention. The present invention provides a time spoofing detection method based on GPS signal characteristics, which includes:

[0040] Step 1: Extract raw data from the GPS raw data. The raw data includes carrier-to-noise ratio, Doppler frequency, and raw reception time.

[0041] Specifically, using a BeiDou / GPS dual-mode software receiver, the raw GPS data is processed by the radio frequency front-end unit, baseband processing unit, and positioning calculation unit to obtain data such as raw reception time, pseudorange, carrier phase, PRN code (pseudo random noise code), carrier-to-noise ratio, and Doppler frequency, and some of these data are analyzed.

[0042] Step 2: Based on the carrier-to-noise ratio and Doppler frequency of the K channels, obtain the variance of the carrier-to-noise ratio and the variance of the Doppler frequency of each channel within the time window (denoted as time_window) corresponding to the current moment.

[0043] Specifically, the carrier-to-noise ratio (CNR) and Doppler frequency of K channels are selected. Within the time window corresponding to the current moment, the variance of the CNR and the variance of the Doppler frequency of n samples within one channel are calculated. The CNR and Doppler frequency of the K channels can be used to detect the strongest signal or to detect multiple signals. If any signal shows abnormal data during detection, the variable recording the abnormality is incremented. The time window is set to 1 second.

[0044] For example, select the carrier-to-noise ratio and Doppler frequency data of the 8 processed channels, and use time_window as the time window to calculate the variance of the n samples of each channel within the time window.

[0045] Step 3: Update the number of anomalies in the carrier-to-noise ratio variance data of each channel based on the relationship between the carrier-to-noise ratio variance and the carrier-to-noise ratio variance threshold. Update the number of anomalies in the Doppler frequency variance data of each channel based on the relationship between the Doppler frequency variance and the Doppler frequency variance threshold.

[0046] In this embodiment, the step of updating the number of anomalies in the carrier-to-noise ratio (CNR) variance data of a channel based on the relationship between the CNR variance and the CNR variance threshold includes:

[0047] Determine whether the variance of the carrier-to-noise ratio (CNR) of the k-th channel is greater than the CNR variance threshold within the first preset time period. If yes, increment the number of anomalies in the CNR variance data corresponding to the k-th channel by 1. If no, keep the number of anomalies in the CNR variance data corresponding to the k-th channel unchanged, where 1 ≤ k ≤ K.

[0048] That is, the variance of the carrier-to-noise ratio (CNR) value in each channel is analyzed. If the variance of the sampled data within the first preset time period is greater than the CNR variance threshold avgthreshold_cn0, then the variable suspect_cn0_varcount, which represents the number of abnormal CNR variance data, is incremented by 1: suspect_cn0_varcount++.

[0049] Optionally, the first preset time is 1 second.

[0050] In this embodiment, the step of updating the number of anomalies in the Doppler frequency variance data of a channel based on the relationship between the variance of the Doppler frequency of each channel and the Doppler frequency variance threshold includes:

[0051] Determine whether the variance of the Doppler frequency of the k-th channel is greater than the Doppler frequency variance threshold within the second preset time period. If yes, increment the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel by 1. If no, keep the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel unchanged.

[0052] That is, the variance of the Doppler frequency values ​​in each channel is analyzed. If the variance of the sampled data within the second preset time period is greater than the Doppler frequency variance threshold avgthreshold_doppler, then the variable suspect_doppler_varcount, which represents the number of anomalies in the Doppler frequency variance data, is incremented by 1: suspect_doppler_varcount++.

[0053] Step 4: Simultaneously determine whether the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data of each channel have reached the preset conditions. If the preset conditions have not been reached, proceed to the time window corresponding to the next moment and determine whether the original reception time has been increased by a fixed duration. If not, directly execute steps 1 to 4. If yes, the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data are reset to zero, and steps 1 to 4 are executed. If the preset conditions are met, it indicates that time spoofing has occurred.

[0054] Here, at time t, with a time window of 1 second, the variance of n samples for each channel within this time window is calculated. Furthermore, whenever the original reception time is increased by a fixed duration, such as return0_time = 25 seconds, the variables `suspect_cn0_varcount` (representing the number of anomalies in the carrier-to-noise ratio variance data for that channel) and `suspect_doppler_varcount` (representing the number of anomalies in the Doppler frequency variance data) are reset to zero. This prevents the reasonable errors of normal data over a long period from being statistically analyzed in large quantities, thus avoiding errors in time spoofing detection.

[0055] In this embodiment, step 4 includes:

[0056] Determine whether the relationship between the number of anomalies in the carrier-to-noise ratio variance data of the k-th channel and the minimum and maximum values ​​τ1 and τ3 of the carrier-to-noise ratio variance anomaly threshold, and whether the relationship between the number of anomalies in the Doppler frequency variance data and the minimum and maximum values ​​τ2 and τ4 of the Doppler frequency variance anomaly threshold meets the preset conditions. If the preset conditions are not met, proceed to the time window corresponding to the next moment and determine whether the original reception time has been increased by a fixed duration. If not, directly execute steps 1 to 4. If yes, the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel are reset to zero, and steps 1 to 4 are executed. If the preset conditions are met, it indicates that time spoofing has occurred.

[0057] The preset condition is one of the first condition, the second condition, and the third condition.

[0058] Optionally, the first condition is that the number of anomalies in the carrier-to-noise ratio variance data is greater than the minimum value τ1 of the carrier-to-noise ratio variance anomaly threshold, and the number of anomalies in the Doppler frequency variance data is greater than the minimum value τ2 of the Doppler frequency variance anomaly threshold.

[0059] The second condition is that the number of outliers in the carrier-to-noise ratio variance data is greater than the maximum value τ3 of the outlier threshold for the carrier-to-noise ratio variance.

[0060] The third condition is that the number of outliers in the Doppler frequency variance data is greater than the maximum value τ4 of the Doppler frequency variance outlier threshold.

[0061] That is, if (suspect_cn0_varcount>τ1&&suspect_doppler_varcount>τ2)||(suspect_cn0_varcount>τ3)||(suspect_doppler_varcount>τ4), then time deception is considered to have occurred.

[0062] Here, the minimum and maximum values ​​of the carrier-to-noise ratio squared anomaly threshold τ1 and τ3, and the minimum and maximum values ​​of the Doppler frequency squared anomaly threshold τ2 and τ4 are determined through extensive data analysis. Preferably, the minimum value of the carrier-to-noise ratio squared anomaly threshold τ1 = 8, the maximum value of the carrier-to-noise ratio squared anomaly threshold τ3 = 13, the minimum value of the Doppler frequency squared anomaly threshold τ2 = 5, and the maximum value of the Doppler frequency squared anomaly threshold τ4 = 10.

[0063] Analysis of a large amount of spoofing data reveals that after spoofing occurs, the carrier-to-noise ratio (CNR) and Doppler frequency exhibit significant numerical fluctuations, which are manifested in this invention through their digital characteristic variance. For the second and third conditions, spoofing can be considered to have occurred when the number of abnormal occurrences in either the Doppler frequency or the CNR exceeds a relatively large threshold. This is because normal data does not exhibit numerous large fluctuations within a suitable time window; therefore, satisfying either the second or third condition is sufficient to confirm GPS spoofing. Regarding the first condition, under normal circumstances, both the CNR and Doppler frequency can cause abnormal changes in the data due to various factors. However, it is highly unlikely that both data will simultaneously generate more than a small threshold of abnormal occurrences within a certain time period. Therefore, satisfying the first condition is sufficient to confirm GPS spoofing interference.

[0064] 1. Compared to other inventions that fail to continuously detect time spoofing interference over a longer period of time, this invention specifically describes a continuous detection scheme and under what circumstances multiple data points after demodulation of the original GPS signal data can be identified as GPS spoofing interference, and proposes a specific detection process.

[0065] 2. Compared with other inventions' detection methods, which cannot well reflect numerical changes and have difficulty in determining the specific value of the threshold, this invention uses digital features to quantify the changes in GPS signal data after GPS time spoofing occurs, which makes it easier for computers to use code to detect GPS time spoofing.

[0066] 3. Compared to other inventions that only use a single GPS signal data point, this invention uses both carrier-to-noise ratio (CNR) and Doppler frequency data to detect GPS spoofing interference. This is because the receiver's CNR is an indicator of the quality of the valid GPS signal received by the receiver. Once the receiver receives a spoofed signal sent by a spoofer, it may attempt to mix these signals with the actual GPS signal. This may cause the receiver to measure an enhanced CNR. The change in CNR after being spoofed differs significantly from the change before being spoofed; therefore, the statistical analysis of the number of anomalies in variance within a time window can be used to detect spoofing. When the distance between the receiver and the satellite changes, the frequency of the GPS signal received by the receiver will change. If the signal received by the receiver is spoofed, its frequency may be outside the frequency of the real GPS signal, meaning the Doppler frequency of the spoofed signal differs from the frequency of the real GPS signal. Under normal circumstances, various factors can cause abnormal changes in CNR and Doppler frequency. Considering only one of these factors can lead to the statistical inclusion of anomalies within a reasonable range, resulting in errors in spoofing detection. The detection method using a combination of these two data points can largely eliminate such errors.

[0067] 4. Compared to other inventions that only use demodulated GPS signal data, this invention further processes this GPS signal data to calculate the variance of the sampled data within the same time window. This processing method is beneficial for setting specific thresholds and improves the reliability of the detection results. This is because, under normal circumstances, the time interval between GPS sampling is extremely short. If the data corresponding to each sampling moment is analyzed and statistically analyzed, the amount of data and computation would be too large. Furthermore, considering data fluctuations, the degree of data jump can be large in some cases and small in others, making it unsuitable for analysis and threshold setting. If the processing results of all data are analyzed, the average calculation of anomalies will be very close to the normal data, making it difficult to detect anomalies and thus impossible to set thresholds. The method in this invention can more clearly observe abnormal data and facilitate statistical analysis, thereby enabling the setting of thresholds.

[0068] Example 2

[0069] This invention provides a specific time spoofing detection method based on GPS signal characteristics, building upon Embodiment 1. The GPS time spoofing detection process described in this invention is as follows: Figure 2 As shown, TEXBAT is a high-fidelity digital real-time GPS L1 C / A code spoofing dataset with multiple spoofing scenarios provided by the Radio Navigation Lab at the University of Texas at Austin. Taking the determination of whether scenario ds2 in the TEXBAT spoofing dataset is subject to time spoofing as an example, the specific steps are as follows:

[0070] Step 1: Preprocess the raw GPS data of the time spoofing scenario ds2 in the TEXBAT spoofing dataset to be detected.

[0071] (1) The raw GPS data from the DS2 is processed by the RF front-end unit, baseband processing unit, and positioning calculation unit using BeiDou / GPS dual-mode software. The raw reception time, pseudorange, carrier phase, PRN code, carrier-to-noise ratio, Doppler frequency, and other data are obtained.

[0072] (2) Select the carrier-to-noise ratio and Doppler frequency data of channel 3 in the DS2 scene. Input the data at each moment into the data processing unit.

[0073] (3) At time t, with time_window = 1s as the time window, calculate the variance of n sampled data within this time window. Furthermore, whenever the original reception time is increased by a fixed duration return0_time = 25s, the variables suspect_cn0_varcount (representing the number of anomalies in the carrier-to-noise ratio variance data) and suspect_doppler_varcount (representing the number of anomalies in the Doppler frequency variance data) are reset to zero. This prevents the reasonable errors of normal data over a long period from being statistically analyzed in large quantities, thus avoiding errors in time deception detection.

[0074] Step 2: Determine whether there are any abnormalities in the carrier-to-noise ratio variance and Doppler frequency variance within 1 second after time t, and record any abnormalities.

[0075] To determine whether the carrier-to-noise ratio variance is abnormal within 1 second after time t, consider the following two examples:

[0076] 1) At time 119s, the variance of the carrier-to-noise ratio sampled data is 0.000181, which is less than the carrier-to-noise ratio variance threshold avgthreshold_cn0 = 0.002. Then, let the variable suspect_cn0_varcount, which represents the number of anomalies in the carrier-to-noise ratio variance data, remain unchanged.

[0077] 2) At time 120s, the variance of the carrier-to-noise ratio sampled data is 0.180380, which is greater than the carrier-to-noise ratio variance threshold avgthreshold_cn0 = 0.002. Then, increment the variable suspect_cn0_varcount, which represents the number of anomalies in the carrier-to-noise ratio variance data, by 1: suspect_cn0_varcount++.

[0078] To determine whether the variance of the Doppler frequency exhibits anomalies within 1 second after time t, consider the following two examples:

[0079] 1) At time 106s, the variance of the Doppler frequency sampling data is 0.081, which is less than the carrier-to-noise ratio variance threshold avgthreshold_doppler = 0.10. Therefore, let the variable suspect_doppler_varcount, which represents the number of anomalies in the carrier-to-noise ratio variance data, remain unchanged.

[0080] 2) At time 110s, the variance of the Doppler frequency sampling data is 0.169, which is greater than the carrier-to-noise ratio variance threshold avgthreshold_doppler = 0.10. Then, increment the variable suspect_cn0_varcount, which represents the number of anomalies in the carrier-to-noise ratio variance data, by 1: suspect_doppler_varcount++.

[0081] Step 3: Determine whether time manipulation has occurred by comparing the values ​​of suspect_cn0_varcount and suspect_cn0_varcount with the threshold.

[0082] (1) Check if `suspect_cn0_varcount` is greater than the minimum threshold value τ1 = 8 for the number of carrier-to-noise ratio square anomalies and if `suspect_doppler_varcount` is greater than the minimum threshold value τ2 = 5 for the number of Doppler frequency square anomalies. If so, time spoofing interference is considered to have occurred. If not, proceed to the next step: Step 3.

[0083] (2); Here are two examples:

[0084] 1) At time 149s, suspect_cn0_varcount = 0 and suspect_doppler_varcount = 0, which are less than τ1 and τ2 respectively; proceed to the next step.

[0085] 2) At time 24s, suspect_cn0_varcount = 10 and suspect_doppler_varcount = 12, which are greater than τ1 and τ2 respectively; it is considered that time spoofing interference has occurred.

[0086] (2) Whether the number of carrier-to-noise ratio square anomalies is greater than the maximum value of the threshold τ3 = 13 or whether the number of Doppler frequency square anomalies is greater than the maximum value of the threshold τ4 = 10;

[0087] If yes, then time manipulation is considered to have occurred; otherwise, return to step 1. Here are two examples:

[0088] 1) At time 24s, suspect_cn0_varcount = 0, which is less than τ3, and suspect_doppler_varcount = 0, which is less than τ4; return to step 1.

[0089] 2) At time 150s, suspect_cn0_varcount = 5 is less than τ3, and suspect_doppler_varcount = 12 is greater than τ4, so time spoofing interference is considered to have occurred.

[0090] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0091] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0092] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings and the disclosure in carrying out the claimed invention. In this specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.

[0093] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A time spoofing detection method based on GPS signal characteristics, characterized in that, The time deception detection method includes: Step 1: Extract raw data from the GPS raw data, which includes carrier-to-noise ratio, Doppler frequency, and raw reception time; Step 2: Based on the carrier-to-noise ratio and the Doppler frequency of the K channels, obtain the variance of the carrier-to-noise ratio and the variance of the Doppler frequency of each channel within the time window corresponding to the current moment; Step 3: Update the number of anomalies in the carrier-to-noise ratio variance data of each channel based on the relationship between the variance of the carrier-to-noise ratio and the carrier-to-noise ratio variance threshold; update the number of anomalies in the Doppler frequency variance data of each channel based on the relationship between the variance of the Doppler frequency and the Doppler frequency variance threshold. Step 4: Determine the relationship between the number of anomalies in the carrier-to-noise ratio variance data of the k-th channel and the minimum and maximum values ​​τ1 and τ3 of the carrier-to-noise ratio variance anomaly threshold, and whether the relationship between the number of anomalies in the Doppler frequency variance data and the minimum and maximum values ​​τ2 and τ4 of the Doppler frequency variance anomaly threshold meets a preset condition. If the preset condition is not met, proceed to the next time window and determine whether the original reception time has increased by a fixed duration. If not, directly execute steps 1 to 4. If yes, the number of anomalies in the carrier-to-noise ratio variance data and the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel is reset to zero, and steps 1 to 4 are executed. If the preset condition is met, it indicates that time spoofing has occurred, 1≤k≤K; the preset condition is one of the first, second, and third conditions. The first condition is that the number of anomalies in the carrier-to-noise ratio variance data is greater than the minimum value τ1 of the carrier-to-noise ratio variance anomaly threshold, and the number of anomalies in the Doppler frequency variance data is greater than the minimum value τ2 of the Doppler frequency variance anomaly threshold. The second condition is that the number of anomalies in the carrier-to-noise ratio variance data is greater than the maximum value τ3 of the carrier-to-noise ratio variance anomaly threshold. The third condition is that the number of anomalies in the Doppler frequency variance data is greater than the maximum value τ4 of the Doppler frequency variance anomaly threshold.

2. The time spoofing detection method based on GPS signal characteristics according to claim 1, characterized in that, The raw data also includes the raw reception time, pseudorange, carrier phase, and PRN code.

3. The time spoofing detection method based on GPS signal characteristics according to claim 1, characterized in that, Based on the carrier-to-noise ratio (CNR) and Doppler frequency of the K channels, the variance of the CNR and the variance of the Doppler frequency for each channel within the current time window are obtained, including: Select the carrier-to-noise ratio and the Doppler frequency of K channels, and within the current time window, calculate the variance of the carrier-to-noise ratio and the variance of the Doppler frequency of each channel after n samples.

4. The time spoofing detection method based on GPS signal characteristics according to claim 1, characterized in that, The step of updating the number of anomalies in the carrier-to-noise ratio (CNR) variance data of a channel based on the relationship between the CNR variance and the CNR variance threshold for each channel includes: Determine whether the variance of the carrier-to-noise ratio of the k-th channel is greater than the carrier-to-noise ratio variance threshold within a first preset time period. If yes, increment the number of anomalies in the carrier-to-noise ratio variance data corresponding to the k-th channel by 1. If no, keep the number of anomalies in the carrier-to-noise ratio variance data corresponding to the k-th channel unchanged, where 1≤k≤K.

5. The time spoofing detection method based on GPS signal characteristics according to claim 4, characterized in that, The first preset time is 1 second.

6. The time spoofing detection method based on GPS signal characteristics according to claim 1, characterized in that, The step of updating the number of anomalies in the Doppler frequency variance data of a channel based on the relationship between the variance of the Doppler frequency of each channel and the Doppler frequency variance threshold includes: Determine whether the variance of the Doppler frequency of the k-th channel is greater than the Doppler frequency variance threshold within a second preset time period. If yes, increment the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel by 1. If no, keep the number of anomalies in the Doppler frequency variance data corresponding to the k-th channel unchanged, where 1≤k≤K.

7. The time spoofing detection method based on GPS signal characteristics according to claim 6, characterized in that, The second preset time is 1 second.

Images