A global navigation satellite system security monitoring method, device, equipment and medium

Abstract

The present application discloses a global navigation satellite system security monitoring method, device, equipment and medium, which relates to the field of satellite positioning technology. It includes: obtaining the original global navigation satellite system signal and the corresponding NMEA protocol data, and performing signal processing operations on the original global navigation satellite system signal; if the signal strength is continuously or suddenly weakened, it indicates that there is an abnormality in the global navigation satellite receiving device to be monitored, and sends a corresponding alarm message to the central processing node; if there is no abnormality in the global navigation satellite receiving device to be monitored, then the abnormality detection process is executed based on the multi-navigation system cross-validation technology and the abnormality detection machine learning algorithm, and the obtained abnormality detection results are sent to the central processing node so that the central processing node executes the corresponding abnormality processing process. It can support the receiving device with limited power consumption, and ensure that GNSS signal anomalies can be accurately detected in both fixed and mobile scenarios.

Description

Technical Field

[0001] The present invention relates to the field of satellite positioning technology, and in particular to a global navigation satellite system security monitoring method, device, equipment and medium. Background Art

[0002] The Global Navigation Satellite System (GNSS) uses satellite signals for positioning, navigation, and timing. GNSS systems include, but are not limited to, the following four major satellite systems: GPS (the US Global Positioning System), BeiDou (China's Global Navigation Satellite System), Galileo (Europe's Global Navigation Satellite System), and GLONASS (Russia's Global Navigation Satellite System). GNSS signals are widely used in various fields, including transportation, military, and urban management. The reliability and accuracy of GNSS data are crucial to the safety and efficiency of these systems.

[0003] With the development of satellite positioning technology, GNSS is increasingly being used in digital cities, traffic management, logistics, military, and other fields. However, the reliability and security of GNSS signals face various threats, such as GNSS spoofing attacks: spoofed satellite signals are sent to mislead receiving devices, resulting in positioning errors. GNSS interference: interference from other signal sources can cause GNSS signal quality to degrade or even fail. In fixed scenarios, the location and environment of GNSS receiving devices are relatively stable, and anomalies can be identified by comparing received GNSS signals with known preset location data. However, in mobile scenarios, device locations are constantly changing. Traditional GNSS anomaly detection methods struggle to adapt to the complex signal environment during mobility, and high-power devices cannot meet the requirements of mobile devices. Existing GNSS anomaly detection solutions require high-performance, dedicated receiving devices, which are typically large, power-hungry, and expensive, making them impractical for widespread application on small mobile devices. A low-cost GPS spoofing detection technology for Android phones has been proposed, but this method is only applicable to specific devices and is limited to GPS spoofing detection, making it unsuitable for broad application to other GNSS systems or mobile scenarios.

[0004] As can be seen from the above, how to support anomaly detection in both mobile and fixed scenarios while maintaining limited device power consumption and ensure that the device can still accurately detect GNSS data anomalies during movement is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, the present invention aims to provide a global navigation satellite system security monitoring method, apparatus, device, and medium that can support anomaly detection in both mobile and fixed scenarios while maintaining limited device power consumption, ensuring that the device can still accurately detect anomalies in GNSS data while in motion. The specific solution is as follows:

[0006] In a first aspect, the present application provides a global navigation satellite system security monitoring method, which is applied to an edge computing node, comprising:

[0007] Obtaining raw global navigation satellite system signals and corresponding NMEA protocol data, and performing signal processing operations on the raw global navigation satellite system signals to obtain signal characteristics and protocol key fields of the raw global navigation satellite system signals, wherein the raw global navigation satellite system signals are signals sent by several target navigation systems;

[0008] determining, based on the signal strength of the original global navigation satellite system signal, whether the global navigation satellite receiving device to be monitored has an abnormality caused by a hardware problem of the device itself or an environmental factor; if the signal strength continuously or suddenly weakens, indicating that the global navigation satellite receiving device to be monitored has the abnormality, and sending corresponding alarm information to a central processing node so that the central processing node executes a corresponding abnormality handling process based on the alarm information;

[0009] If the global navigation satellite receiving device to be monitored does not have the abnormal situation, executing the corresponding abnormality detection process according to the type of the edge computing node to obtain an abnormality detection result; the type of the edge computing node includes a fixed edge computing node and a mobile edge computing node;

[0010] The abnormality detection result is sent to the central processing node so that the central processing node executes a corresponding abnormality processing process based on the abnormality detection result.

[0011] Optionally, the edge computing node is used to perform anomaly detection of global navigation satellite system data in the global navigation satellite receiving device to be monitored; the central processing node is used to collect detection results from the edge computing node, and perform statistical analysis and result display based on the detection results;

[0012] The mobile edge computing node can independently perform statistical analysis and display results.

[0013] Optionally, performing a signal processing operation on the original global navigation satellite system signal to obtain a signal characteristic and a protocol key field of the original global navigation satellite system signal includes:

[0014] removing high-frequency noise and interference from the original GNSS signal using a low-pass filter and a noise suppression algorithm, and extracting signal features of the original GNSS signal;

[0015] The original global navigation satellite system signal is subjected to protocol parsing based on NMEA protocol data, and key fields are extracted to obtain the protocol key fields.

[0016] Optionally, the sending the anomaly detection result to the central processing node so that the central processing node executes a corresponding anomaly handling process based on the anomaly detection result includes:

[0017] sending an abnormality detection result indicating that the data is normal and a reference time of the navigation system to the central processing node so that the central processing node stores the original global navigation satellite system signal in a preset storage space;

[0018] Alternatively, the anomaly detection result characterized as data anomaly and the corresponding abnormal data content are sent to the central processing node, so that the central processing node records the abnormal data content and displays the abnormal location, time and satellite information.

[0019] Optionally, executing a corresponding anomaly detection process for the fixed edge computing node to obtain an anomaly detection result includes:

[0020] Determining whether the position of the current global navigation satellite receiving device to be monitored is consistent with a preset fixed reference position based on the signal characteristics and protocol key fields of the original global navigation satellite system signal;

[0021] If the position of the global navigation satellite receiving device to be monitored is consistent with the preset fixed reference position, an abnormality detection result indicating that the data is normal is obtained;

[0022] If the current position of the global navigation satellite receiving device to be monitored is inconsistent with the preset fixed reference position, an abnormality detection result characterized as data abnormality is obtained.

[0023] Optionally, executing a corresponding anomaly detection process for the mobile edge computing node to obtain an anomaly detection result includes:

[0024] Performing a data consistency check based on the signal characteristics of the original global navigation satellite system signal and the key fields of the protocol to obtain a data consistency check result; the data consistency check includes a signal-to-noise ratio check, a satellite status check, a signal status check, and a change rate and change trend check;

[0025] performing a multi-navigation system cross-validation on the original global navigation satellite system signal based on the data consistency check result to obtain a verification result of the multi-navigation system cross-validation; the multi-navigation system cross-validation is performing a comparative analysis on the time and position data of the plurality of target navigation systems;

[0026] The target navigation systems are classified according to the verification results of the multi-navigation system cross-validation, and anomaly detection is performed on the global navigation satellite system signals corresponding to the classified target navigation systems using an anomaly detection machine learning algorithm model to obtain the anomaly detection results.

[0027] Optionally, the central processing node trains the anomaly detection machine learning algorithm model based on the received anomaly detection results and corresponding anomaly data, and updates the trained model parameters to the mobile edge computing node.

[0028] In a second aspect, the present application provides a global navigation satellite system security monitoring device, which is applied to an edge computing node, including:

[0029] an original GNSS signal acquisition module, configured to acquire original GNSS signals and corresponding NMEA protocol data, and perform signal processing operations on the original GNSS signals to obtain signal characteristics and protocol key fields of the original GNSS signals; the original GNSS signals being signals sent by several target navigation systems;

[0030] a global navigation satellite receiving device anomaly detection module, configured to determine, based on the signal strength of the original global navigation satellite system signal, whether the monitored global navigation satellite receiving device has an anomaly caused by a hardware problem of the device itself or an environmental factor; if the signal strength continuously or suddenly weakens, it indicates that the monitored global navigation satellite receiving device has the anomaly; and transmit corresponding alarm information to a central processing node so that the central processing node executes a corresponding anomaly handling process based on the alarm information;

[0031] an original global navigation satellite system signal anomaly detection module, configured to, if the monitored global navigation satellite receiving device does not have the anomaly, execute a corresponding anomaly detection process according to the type of the edge computing node to obtain an anomaly detection result; the type of the edge computing node includes a fixed edge computing node and a mobile edge computing node;

[0032] The abnormality detection result sending module is used to send the abnormality detection result to the central processing node so that the central processing node executes the corresponding abnormality processing process based on the abnormality detection result.

[0033] In a third aspect, the present application provides an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] The processor is configured to execute the computer program to implement the aforementioned global navigation satellite system security monitoring method.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned global navigation satellite system security monitoring method when executed by a processor.

[0037] The present application provides a global navigation satellite system security monitoring method, which first obtains an original global navigation satellite system signal and corresponding NMEA protocol data, and performs signal processing operations on the original global navigation satellite system signal to obtain signal characteristics and protocol key fields of the original global navigation satellite system signal; the original global navigation satellite system signal is a signal sent by several target navigation systems; then, based on the signal strength of the original global navigation satellite system signal, it is determined whether there is an abnormality in the global navigation satellite receiving device to be monitored; if the signal strength continuously or suddenly weakens, it indicates that there is an abnormality in the global navigation satellite receiving device to be monitored, and corresponding alarm information is sent to a central processing node so that the central processing node executes a corresponding abnormality handling process based on the alarm information; then, if there is no abnormality in the global navigation satellite receiving device to be monitored, a corresponding abnormality detection process is executed according to the type of the edge computing node to obtain an abnormality detection result; the type of the edge computing node includes a fixed edge computing node and a mobile edge computing node; finally, the abnormality detection result is sent to the central processing node so that the central processing node executes a corresponding abnormality handling process based on the abnormality detection result.

[0038] As can be seen from the above, this application completes the GNSS spoofing detection process through the edge computing nodes and central processing nodes, reducing the burden on the central processing nodes, improving the system's response speed, and lowering device power consumption. Different anomaly detection processes are also adopted based on the motion state of the global navigation satellite device. In other words, the dynamic behavior of the global navigation satellite device (such as acceleration and velocity) is combined with the changing characteristics of the GNSS signal to improve the accuracy and robustness of GNSS spoofing attack detection. This allows for support of anomaly detection in both mobile and fixed scenarios while maintaining limited device power consumption, ensuring that the device can accurately detect GNSS data anomalies even while in motion. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 This is a flow chart of a global navigation satellite system security monitoring method applied to edge computing nodes disclosed in this application;

[0041] Figure 2 This is an architecture diagram of a global navigation satellite system security monitoring system disclosed in this application;

[0042] Figure 3 This is a schematic diagram of the internal structure of an edge computing node disclosed in this application;

[0043] Figure 4 A calculation flow chart of a central processing node disclosed in this application;

[0044] Figure 5 This is a flowchart of a specific global navigation satellite system security monitoring method applied to edge computing nodes disclosed in this application;

[0045] Figure 6 This is a schematic diagram of a global navigation satellite system security monitoring device applied to an edge computing node disclosed in this application;

[0046] Figure 7 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0048] With the development of satellite positioning technology, GNSS is increasingly used in digital cities, traffic management, logistics, military and other fields. However, the reliability and security of GNSS signals face various threats, such as GNSS spoofing attacks: misleading receiving devices by sending false satellite signals, resulting in positioning errors. GNSS interference: interference from other signal sources may cause the GNSS signal quality to degrade or even fail. In fixed scenarios, the position and environment of the GNSS receiving device are relatively stable, and anomalies can be identified by comparing the received GNSS signal with the known preset position data. In mobile scenarios, the position of the device is constantly changing, and traditional GNSS anomaly detection methods are difficult to adapt to the complex signal environment during movement, and high-power devices cannot meet the needs of mobile devices. In the existing technology, many GNSS anomaly detection schemes require high-performance, dedicated receiving devices, which are usually large in size, high in power consumption, and expensive, and cannot be widely used in small mobile devices. To this end, the present application provides a global navigation satellite system security monitoring solution that can support anomaly detection in mobile and fixed scenarios with limited device power consumption, ensuring that the device can still accurately detect anomalies in GNSS data during movement.

[0049] See also Figure 1 As shown, the embodiment of the present application discloses a global navigation satellite system security monitoring method, which is applied to an edge computing node, including:

[0050] Step S11: acquiring an original global navigation satellite system signal and corresponding NMEA protocol data, and performing a signal processing operation on the original global navigation satellite system signal to obtain signal characteristics and protocol key fields of the original global navigation satellite system signal.

[0051] In this embodiment, the original global navigation satellite system signals are signals sent by several target navigation systems, and the several target navigation systems include but are not limited to GPS, BeiDou, Galileo and GLONASS.

[0052] See also Figure 2As shown, the edge computing node is used to perform anomaly detection of global navigation satellite system data in the global navigation satellite receiving device to be monitored; that is, it is used to perform anomaly detection of GNSS data in a local device (such as a mobile terminal), which is divided into a fixed scene mode and a mobile scene mode. Among them, the mobile edge computing node can independently perform statistical analysis and result display, and can operate independently without interacting with the central processing node. The central processing node is used to collect the detection results from the edge computing node, and perform statistical analysis and result display based on the detection results; that is, collect the detection results from the edge computing node, perform statistical analysis and result display. Among them, if the central processing node cannot process the detection result of the edge computing node, the edge computing node can independently output the detection result.

[0053] See also Figure 3 As shown, the edge computing node obtains the original global navigation satellite system signal and the corresponding NMEA protocol data through a multi-mode GNSS antenna, and processes the system signal and the corresponding NMEA protocol data. Specifically, the signal processing operation on the original global navigation satellite system signal to obtain the signal characteristics and protocol key fields of the original global navigation satellite system signal can include: using a low-pass filter and a noise suppression algorithm to remove high-frequency noise and interference in the original global navigation satellite system signal, and extracting the signal characteristics of the original global navigation satellite system signal; performing protocol parsing on the original global navigation satellite system signal based on the NMEA protocol data, and extracting key fields to obtain the protocol key fields. Among them, the key fields of the protocol include but are not limited to timestamp information (time tag of each signal), location coordinates (current latitude, longitude and altitude information of the GNSS device), satellite status (satellite operating status, such as signal quality indicator) and signal quality (received signal strength, such as C / N0 value); the signal characteristics include but are not limited to spectrum distribution, main frequency, bandwidth, harmonic components, noise power density, spectrum sharpness, signal energy concentration, instantaneous frequency change trend, phase characteristics, signal in-band interference characteristics and other signal characteristics. It is worth mentioning that the specific method of extracting the signal characteristics of the original global navigation satellite system signal is not limited to extracting the signal characteristics of the original global navigation satellite system signal through Fourier transform, wavelet transform and other methods.

[0054] Step S12: Based on the signal strength of the original global navigation satellite system signal, it is determined whether the global navigation satellite receiving device to be monitored has an abnormality caused by a hardware problem of the device itself or environmental factors; if the signal strength continuously or suddenly weakens, it indicates that the global navigation satellite receiving device to be monitored has the abnormality, and a corresponding alarm message is sent to the central processing node so that the central processing node executes a corresponding abnormality handling process based on the alarm message.

[0055] In this embodiment, it is determined whether there is an abnormality in the monitored global navigation satellite receiving device based on the signal strength of the original global navigation satellite system signal. If the signal strength continuously or suddenly weakens (the SNR decreases and the amplitude becomes smaller), an alarm message indicating that the abnormality is caused by a fault in the GNSS receiving device itself, weather or environmental obstruction is output to the central processing node.

[0056] Step S13: If the global navigation satellite receiving device to be monitored does not have the abnormal situation, a corresponding abnormality detection process is executed according to the type of the edge computing node to obtain an abnormality detection result.

[0057] In this embodiment, the types of edge computing nodes include fixed edge computing nodes and mobile edge computing nodes. Accordingly, the anomaly detection process includes an anomaly detection process for fixed edge computing nodes and an anomaly detection process for mobile edge computing nodes. Specifically, executing the corresponding anomaly detection process for the fixed edge computing node to obtain an anomaly detection result may include: judging whether the position of the current global navigation satellite receiving device to be monitored is consistent with the preset fixed reference position based on the signal characteristics and protocol key fields of the original global navigation satellite system signal; if the position of the current global navigation satellite receiving device to be monitored is consistent with the preset fixed reference position, obtaining an anomaly detection result characterized as normal data; if the position of the current global navigation satellite receiving device to be monitored is inconsistent with the preset fixed reference position, obtaining an anomaly detection result characterized as abnormal data. That is, judging whether the data is normal by comparing the receiving time and position coordinates with the preset fixed reference position.

[0058] Correspondingly, executing the corresponding anomaly detection process for the mobile edge computing node to obtain an anomaly detection result may include: performing data consistency verification based on the signal characteristics of the original global navigation satellite system signal and the key fields of the protocol to obtain a data consistency verification result; the data consistency verification includes signal-to-noise ratio verification, satellite status verification, signal status verification, and change rate and change trend verification; performing multi-navigation system cross-validation on the original global navigation satellite system signal based on the data consistency verification result to obtain a verification result of the multi-navigation system cross-validation; the multi-navigation system cross-validation is to compare and analyze the time and position data of the several target navigation systems; that is, to analyze whether the timestamps and position coordinates provided by the four navigation systems are consistent; classifying the several target navigation systems according to the verification result of the multi-navigation system cross-validation, that is, classifying the navigation systems with data deviation at the same time, and using the anomaly detection machine learning algorithm model to perform anomaly detection on the global navigation satellite system signals corresponding to the classified target navigation systems to obtain the anomaly detection result. Among them, the signal-to-noise ratio verification is to determine whether the signal reception is abnormal based on the fluctuation of the real-time signal-to-noise ratio (C / N0) data; the satellite status verification is to detect whether the received satellite trajectory matches the navigation ephemeris data; the signal status verification is to verify the signal characteristics obtained after Fourier transform; the change rate and change trend verification is to analyze the change trend and distribution characteristics of the signal to identify potential anomalies.

[0059] In one specific embodiment, using an anomaly detection machine learning algorithm model to perform anomaly detection on the GNSS signal corresponding to the classified target navigation system to obtain the anomaly detection result may include: inputting multi-dimensional features of the protocol and the original signal, including but not limited to time and location information consistency features, signal-to-noise ratio and signal strength features, Fourier spectrum features (main frequency, harmonics, interference frequency, etc.), and satellite trajectory consistency features; using an anomaly detection machine learning algorithm to combine time domain and frequency domain features, and using a machine learning model (such as inverse reinforcement learning or a neural network) to perform anomaly detection and classification. Specifically, the anomaly detection algorithm outputs the likelihood of an anomaly signal and classifies the anomaly type (e.g., interference signal, spoofing signal, equipment failure, etc.).

[0060] It's important to note that the central processing node trains the anomaly detection machine learning algorithm model based on the received anomaly detection results and corresponding anomaly data, and updates the trained model parameters to the mobile edge computing nodes. That is, the edge computing nodes regularly receive the latest algorithm model parameters pushed by the central processing node and automatically load the new model parameters to optimize their adaptability to dynamic interference environments.

[0061] Step S14: Send the abnormality detection result to the central processing node so that the central processing node executes a corresponding abnormality processing process based on the abnormality detection result.

[0062] In this embodiment, see Figure 4 As shown, the central processing node receives GNSS anomaly alarm data from the edge computing node and further processes the data. Specifically, the sending of the anomaly detection result to the central processing node so that the central processing node executes the corresponding anomaly processing process based on the anomaly detection result may include: sending the anomaly detection result characterized as normal data and the reference time of the navigation system to the central processing node so that the central processing node stores the original global navigation satellite system signal in a preset storage space; or, sending the anomaly detection result characterized as data anomaly and the corresponding abnormal data content to the central processing node so that the central processing node records the abnormal data content and displays the abnormal position, time and satellite information. That is, if the edge computing node detects an anomaly, the central processing node will record the information and display the abnormal position, time and satellite information; otherwise, record the normal data flow.

[0063] It's worth noting that the central processing node trains the anomaly detection machine learning algorithm model based on the received anomaly detection results and corresponding anomaly data, and updates the trained model parameters to the mobile edge computing nodes. Specifically, the model is trained based on the new dataset, and the updated model parameters are transmitted to the edge computing nodes. This allows the edge computing nodes to regularly receive the latest algorithm model parameters pushed by the central processing node and automatically load the new model parameters to optimize their adaptability to dynamic interference environments.

[0064] As can be seen from the above, the embodiments of the present application utilize the edge computing nodes and central processing nodes to complete the GNSS spoofing detection process, reducing the burden on the central processing nodes, improving system response speed, and lowering device power consumption. Furthermore, different anomaly detection processes are implemented based on the motion state of the global navigation satellite device. In other words, the dynamic behavior of the global navigation satellite device (e.g., acceleration and velocity) is combined with the changing characteristics of the GNSS signal to enhance the accuracy and robustness of GNSS spoofing attack detection. By receiving multiple GNSS signal sources, the system's tolerance to signal anomalies and detection accuracy are significantly improved. A real-time detection-based alert mechanism is provided, supporting multiple alert methods (SMS, email, and app push notifications), ensuring that when a GNSS spoofing attack is detected, the user is promptly notified and countermeasures can be taken. This allows for anomaly detection in both mobile and fixed scenarios while maintaining limited device power consumption, ensuring that the device can accurately detect GNSS data anomalies even while in motion.

[0065] See also Figure 5 As shown, the embodiment of the present application discloses a global navigation satellite system security monitoring method, which is applied to an edge computing node, including:

[0066] In this embodiment, NMEA protocol data and raw GNSS signals are received by GPS, Beidou, Galileo, and GLONASS receiver modules. The decoded navigation message is parsed according to the NMEA protocol, and the NMEA protocol data is extracted. The NMEA protocol data includes, but is not limited to, the following key fields: timestamp information, used to obtain the time tag of each signal; location coordinates, used to extract the current latitude, longitude, and altitude information of the GNSS device; satellite status, used to obtain the satellite operating status (such as a signal quality indicator); and signal quality, used to analyze the received signal strength (such as the C / N0 value). The raw digital signal is then subjected to signal denoising and filtering. Specifically, a low-pass filter and noise suppression algorithm are used to remove high-frequency noise and interference from the signal. The signal is then analyzed in the frequency domain using a Fourier transform to extract signal features. These signal features include, but are not limited to, spectral distribution, dominant frequency, bandwidth, harmonic components, noise power density, spectral sharpness, signal energy concentration, instantaneous frequency variation trends, phase characteristics, and in-band interference characteristics.

[0067] In this embodiment, it is determined whether there is an abnormality in the global navigation satellite receiving device to be monitored based on the signal strength of the original GNSS signal. If the signal strength continuously or suddenly weakens (the SNR decreases and the amplitude becomes smaller), an alarm message indicating that the abnormality is caused by a failure of the GNSS receiving device itself, weather or environmental obstruction is output to the central processing node.

[0068] Furthermore, the device is determined to be a fixed-location scenario edge node. If so, the received time and location coordinates are compared with a preset fixed reference location to determine their consistency. If the device is a mobile scenario edge node, preliminary anomaly detection is performed on the protocol data's time, location information, signal strength, and other features, as well as the original signal characteristics. This may include determining signal reception anomalies based on fluctuations in real-time signal-to-noise ratio (C / N0); checking whether the received satellite trajectory matches the navigation ephemeris data; analyzing signal trends and distribution characteristics to identify potential anomalies; and detecting whether the aforementioned features, obtained after Fourier transformation, are anomalies. A comparative analysis is performed on time and location data from the four major navigation systems: GPS, Beidou, Galileo, and GLONASS. Specifically, the consistency of the timestamps and location coordinates provided by the four navigation systems is analyzed. Navigation systems with data deviations at the same time are classified. Anomaly detection machine learning algorithms are applied to the classified navigation system data. Specifically, these include multidimensional features of the input protocol and the original signal; these include, but are not limited to, consistency of time and location information; signal-to-noise ratio and signal strength; Fourier spectrum features (main frequency, harmonics, interference frequencies, etc.); and satellite trajectory consistency. The algorithm combines time-domain and frequency-domain features, utilizing machine learning models (such as inverse reinforcement learning or neural networks) to determine the likelihood of anomaly outputs and classify anomaly types (such as interference signals, spoofing signals, and equipment failures). It is important to note that the latest algorithm model parameters pushed by the central node must be regularly received and loaded to optimize adaptability to dynamic interference environments.

[0069] In this embodiment, if an abnormal GNSS signal is detected, an abnormality alert message is output, along with detailed abnormality data (such as the abnormal satellite number and the abnormal signal time period). If the detected signal is normal, reliable navigation information is output and the navigation system time is adjusted to the reference time, improving system time synchronization accuracy.

[0070] As can be seen from the above, the embodiments of the present application significantly improve the system's fault tolerance and detection accuracy for signal anomalies by receiving multiple GNSS signal sources. By combining the dynamic behavior of the device (such as acceleration and velocity) with the changing characteristics of the GNSS signal, it can effectively detect anomalies in both static and dynamic scenarios. This is suitable for high-speed mobile scenarios such as drones and vehicle-mounted devices, improving the accuracy and robustness of GNSS spoofing attack detection. An efficient computing process design is provided, and the design of edge computing nodes can reduce the burden on central nodes, improve the system's response speed, and accurately detect GNSS data anomalies without increasing device power consumption. An alarm mechanism based on real-time detection is provided, and multiple alarm methods (SMS, email, and app push) are supported, ensuring that when a GNSS spoofing attack is detected, the user is promptly notified and countermeasures can be taken. This enables support for anomaly detection in both mobile and fixed scenarios while maintaining limited device power consumption, ensuring that the device can still accurately detect GNSS data anomalies while in motion.

[0071] Accordingly, see Figure 6 As shown, an embodiment of the present application provides a global navigation satellite system security monitoring device, which is applied to an edge computing node, including:

[0072] an original GNSS signal acquisition module 11, configured to acquire original GNSS signals and corresponding NMEA protocol data, and perform signal processing operations on the original GNSS signals to obtain signal characteristics and protocol key fields of the original GNSS signals; the original GNSS signals are signals sent by several target navigation systems;

[0073] a global navigation satellite receiving device anomaly detection module 12, configured to determine, based on the signal strength of the original global navigation satellite system signal, whether the monitored global navigation satellite receiving device has an anomaly caused by a hardware problem of the device itself or an environmental factor; if the signal strength continuously or suddenly weakens, it indicates that the monitored global navigation satellite receiving device has the anomaly, and to send a corresponding alarm message to a central processing node so that the central processing node executes a corresponding anomaly handling process based on the alarm message;

[0074] an original GNSS signal anomaly detection module 13, configured to, if the GNSS receiving device to be monitored does not have the anomaly, execute a corresponding anomaly detection process according to the type of the edge computing node to obtain an anomaly detection result; the type of the edge computing node includes a fixed edge computing node and a mobile edge computing node;

[0075] The abnormality detection result sending module 14 is used to send the abnormality detection result to the central processing node so that the central processing node executes the corresponding abnormality processing process based on the abnormality detection result;

[0076] Among them, the mobile edge computing node can independently perform statistical analysis and display results; the central processing node trains the anomaly detection machine learning algorithm model based on the received anomaly detection results and corresponding anomaly data, and updates the trained model parameters to the mobile edge computing node.

[0077] As can be seen from the above, the embodiment of the present application completes the GNSS spoofing detection process through the edge computing node and the central processing node, reducing the burden on the central processing node, improving the response speed of the system, and reducing the power consumption of the device; and adopts different anomaly detection processes according to the motion state of the global navigation satellite device. In other words, the dynamic behavior of the global navigation satellite device and the changing characteristics of the GNSS signal are combined to improve the accuracy and robustness of GNSS spoofing attack detection. Therefore, it is possible to support anomaly detection in mobile scenarios and fixed scenarios with limited device power consumption, ensuring that the device can still accurately detect anomalies in GNSS data during movement.

[0078] In some specific implementations, the original global navigation satellite system signal acquisition module 11 may specifically include:

[0079] a signal feature extraction unit, configured to remove high-frequency noise and interference from the original GNSS signal using a low-pass filter and a noise suppression algorithm, and extract signal features of the original GNSS signal;

[0080] The protocol key field extraction unit is used to perform protocol parsing on the original global navigation satellite system signal based on the NMEA protocol data, and extract key fields to obtain the protocol key fields.

[0081] In some specific implementations, the original GNSS signal anomaly detection module 13 may specifically include:

[0082] A fixed edge computing node anomaly detection submodule is configured to execute a corresponding anomaly detection process for the fixed edge computing node to obtain an anomaly detection result;

[0083] The mobile edge computing node anomaly detection submodule is used to execute the corresponding anomaly detection process for the mobile edge computing node to obtain an anomaly detection result.

[0084] Furthermore, the fixed edge computing node anomaly detection submodule may specifically include:

[0085] a position information determination unit, configured to determine whether the position of the current global navigation satellite receiving device to be monitored is consistent with a preset fixed reference position based on the signal characteristics and protocol key fields of the original global navigation satellite system signal;

[0086] a first anomaly detection result obtaining unit, configured to obtain an anomaly detection result indicating that the data is normal if the current position of the global navigation satellite receiving device to be monitored is consistent with the preset fixed reference position;

[0087] The second anomaly detection result obtaining unit is configured to obtain an anomaly detection result indicating a data anomaly if the current position of the global navigation satellite receiving device to be monitored is inconsistent with the preset fixed reference position.

[0088] Furthermore, the mobile edge computing node anomaly detection submodule may specifically include:

[0089] a data consistency check unit, configured to perform a data consistency check based on the signal characteristics of the original global navigation satellite system signal and the key protocol fields to obtain a data consistency check result; the data consistency check includes a signal-to-noise ratio check, a satellite status check, a signal status check, and a change rate and change trend check;

[0090] a multi-navigation system cross-validation unit, configured to perform multi-navigation system cross-validation on the original global navigation satellite system signal based on the data consistency check result to obtain a verification result of the multi-navigation system cross-validation; the multi-navigation system cross-validation is to compare and analyze the time and position data of the multiple target navigation systems;

[0091] a third anomaly detection result acquisition unit, configured to classify the target navigation systems according to the verification results of the multi-navigation system cross-validation, and perform anomaly detection on the global navigation satellite system signals corresponding to the classified target navigation systems using an anomaly detection machine learning algorithm model to obtain the anomaly detection results.

[0092] In some specific implementations, the abnormality detection result sending module 14 may specifically include:

[0093] a first anomaly detection result processing unit, configured to send the anomaly detection result indicating that the data is normal and a reference time of the navigation system to the central processing node, so that the central processing node stores the original global navigation satellite system signal in a preset storage space;

[0094] The second anomaly detection result processing unit is used to send the anomaly detection result characterized as data anomaly and the corresponding abnormal data content to the central processing node, so that the central processing node records the abnormal data content and displays the abnormal position, time and satellite information.

[0095] In some specific implementations, the global navigation satellite system security monitoring device may further include:

[0096] An edge computing unit is configured to perform anomaly detection on global navigation satellite system data in the global navigation satellite receiving device to be monitored;

[0097] The central processing unit is used to collect the detection results from the edge computing nodes and perform statistical analysis and result display based on the detection results.

[0098] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of use of this application. The electronic device 20 may include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the global navigation satellite system security monitoring method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0099] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0100] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0101] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the global navigation satellite system security monitoring method performed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 may further include a computer program capable of implementing other specific tasks.

[0102] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned global navigation satellite system security monitoring method. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0103] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0104] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0105] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0106] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0107] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A global navigation satellite system security monitoring method, characterized in that: Applied to edge computing nodes, including: Obtaining raw global navigation satellite system signals and corresponding NMEA protocol data, and performing signal processing operations on the raw global navigation satellite system signals to obtain signal characteristics and protocol key fields of the raw global navigation satellite system signals, wherein the raw global navigation satellite system signals are signals sent by several target navigation systems; determining, based on the signal strength of the original global navigation satellite system signal, whether the global navigation satellite receiving device to be monitored has an abnormality caused by a hardware problem of the device itself or an environmental factor; if the signal strength continuously or suddenly weakens, indicating that the global navigation satellite receiving device to be monitored has the abnormality, and sending corresponding alarm information to a central processing node so that the central processing node executes a corresponding abnormality handling process based on the alarm information; If the global navigation satellite receiving device to be monitored does not have the abnormal situation, executing the corresponding abnormality detection process according to the type of the edge computing node to obtain an abnormality detection result; the type of the edge computing node includes a fixed edge computing node and a mobile edge computing node; Sending the abnormality detection result to the central processing node so that the central processing node executes a corresponding abnormality processing process based on the abnormality detection result; The process of executing a corresponding anomaly detection process for the mobile edge computing node to obtain an anomaly detection result includes: Performing a data consistency check based on the signal characteristics of the original global navigation satellite system signal and the key fields of the protocol to obtain a data consistency check result; the data consistency check includes a signal-to-noise ratio check, a satellite status check, a signal status check, and a change rate and change trend check; performing a multi-navigation system cross-validation on the original global navigation satellite system signal based on the data consistency check result to obtain a verification result of the multi-navigation system cross-validation; the multi-navigation system cross-validation is performing a comparative analysis on the time and position data of the plurality of target navigation systems; The target navigation systems are classified according to the verification results of the multi-navigation system cross-validation, and anomaly detection is performed on the global navigation satellite system signals corresponding to the classified target navigation systems using an anomaly detection machine learning algorithm model to obtain the anomaly detection results.

2. The method for monitoring global navigation satellite system security according to claim 1, wherein: The edge computing node is used to perform anomaly detection of global navigation satellite system data in the global navigation satellite receiving device to be monitored; the central processing node is used to collect detection results from the edge computing node, and perform statistical analysis and result display based on the detection results; The mobile edge computing node can independently perform statistical analysis and display results.

3. The method for monitoring global navigation satellite system security according to claim 1, wherein: The performing a signal processing operation on the original global navigation satellite system signal to obtain a signal characteristic and a protocol key field of the original global navigation satellite system signal includes: removing high-frequency noise and interference from the original GNSS signal using a low-pass filter and a noise suppression algorithm, and extracting signal features of the original GNSS signal; The original global navigation satellite system signal is subjected to protocol parsing based on NMEA protocol data, and key fields are extracted to obtain the protocol key fields.

4. The method for monitoring global navigation satellite system security according to claim 1, wherein: The sending of the abnormality detection result to the central processing node so that the central processing node executes a corresponding abnormality processing process based on the abnormality detection result includes: sending an abnormality detection result indicating that the data is normal and a reference time of the navigation system to the central processing node so that the central processing node stores the original global navigation satellite system signal in a preset storage space; Alternatively, the anomaly detection result characterized as data anomaly and the corresponding abnormal data content are sent to the central processing node, so that the central processing node records the abnormal data content and displays the abnormal location, time and satellite information.

5. The method for monitoring global navigation satellite system security according to claim 1, wherein: Executing a corresponding anomaly detection process for the fixed edge computing node to obtain an anomaly detection result includes: Determining whether the position of the current global navigation satellite receiving device to be monitored is consistent with a preset fixed reference position based on the signal characteristics and protocol key fields of the original global navigation satellite system signal; If the position of the global navigation satellite receiving device to be monitored is consistent with the preset fixed reference position, an abnormality detection result indicating that the data is normal is obtained; If the current position of the global navigation satellite receiving device to be monitored is inconsistent with the preset fixed reference position, an abnormality detection result characterized as data abnormality is obtained.

6. The method for monitoring the safety of a global navigation satellite system according to any one of claims 1 to 5, characterized in that: The central processing node trains the anomaly detection machine learning algorithm model according to the received anomaly detection results and corresponding anomaly data, and updates the trained model parameters to the mobile edge computing node.

7. A global navigation satellite system security monitoring device, characterized in that: Applied to edge computing nodes, including: an original GNSS signal acquisition module, configured to acquire original GNSS signals and corresponding NMEA protocol data, and perform signal processing operations on the original GNSS signals to obtain signal characteristics and protocol key fields of the original GNSS signals; the original GNSS signals being signals sent by several target navigation systems; a global navigation satellite receiving device anomaly detection module, configured to determine, based on the signal strength of the original global navigation satellite system signal, whether the monitored global navigation satellite receiving device has an anomaly caused by a hardware problem of the device itself or an environmental factor; if the signal strength continuously or suddenly weakens, it indicates that the monitored global navigation satellite receiving device has the anomaly; and transmit corresponding alarm information to a central processing node so that the central processing node executes a corresponding anomaly handling process based on the alarm information; an original global navigation satellite system signal anomaly detection module, configured to, if the monitored global navigation satellite receiving device does not have the anomaly, execute a corresponding anomaly detection process according to the type of the edge computing node to obtain an anomaly detection result; the type of the edge computing node includes a fixed edge computing node and a mobile edge computing node; An anomaly detection result sending module is used to send the anomaly detection result to the central processing node so that the central processing node executes a corresponding anomaly processing process based on the anomaly detection result; The original global navigation satellite system signal anomaly detection module includes: a data consistency check unit, configured to perform a data consistency check based on the signal characteristics of the original global navigation satellite system signal and the key protocol fields to obtain a data consistency check result; the data consistency check includes a signal-to-noise ratio check, a satellite status check, a signal status check, and a change rate and change trend check; a multi-navigation system cross-validation unit, configured to perform multi-navigation system cross-validation on the original global navigation satellite system signal based on the data consistency check result to obtain a verification result of the multi-navigation system cross-validation; the multi-navigation system cross-validation is to compare and analyze the time and position data of the multiple target navigation systems; a third anomaly detection result acquisition unit, configured to classify the target navigation systems according to the verification results of the multi-navigation system cross-validation, and perform anomaly detection on the global navigation satellite system signals corresponding to the classified target navigation systems using an anomaly detection machine learning algorithm model to obtain the anomaly detection results.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the global navigation satellite system security monitoring method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the global navigation satellite system security monitoring method according to any one of claims 1 to 6 is implemented.

Images