A SVM-based deception detection algorithm based on relevant domain information

Abstract

The present application relates to an SVM-induced deception detection algorithm based on correlation domain information. The method includes: obtaining a signal generated by a signal source in an interference scenario and capturing and solving the signal generated by the signal source to obtain output data; the output data includes the moving average of the IQ branch output of the ELP correlator and related detection index data; performing correlation analysis on the output data and feature screening based on the contribution of the feature to the label to obtain input feature combinations with different feature numbers; randomly selecting part of the data from the input feature combinations with different feature numbers as a training set, and the remaining data as a test set, using the training set to solve the SVM model parameters to construct a classifier for detecting GNSS deception and multipath interference; using the test set to classify and predict the classifier, evaluate the detection performance of the SVM model, and perform deception detection based on the trained SVM model. The use of this method can improve the deception detection performance.

Description

Technical Field

[0001] The present application relates to the field of satellite navigation technology, and in particular to an SVM inductive deception detection algorithm based on relevant domain information. Background Art

[0002] Satellite navigation technology is widely used worldwide, with most devices relying on it for precise positioning and navigation. However, as this technology becomes more widespread, spoofing attacks against satellite navigation systems are increasing, becoming a significant concern. In civilian emergency services, ensuring the authenticity and accuracy of navigation signals is crucial for equipment effectiveness and operational safety. Therefore, research and development of effective satellite navigation spoofing detection technologies to address evolving security threats is essential to ensure the safety and reliability of navigation systems.

[0003] Traditional satellite navigation spoofing techniques can be categorized as simple, intermediate, and complex. Simple spoofing involves sending a false signal that resembles the real thing to confuse the receiver; complex spoofing, by completely simulating the real navigation signal, is more sophisticated. Among these, intermediate-level deceptive spoofing has become a research hotspot due to its excellent deceptive effectiveness and ease of implementation. This technique gradually adjusts the signal's power and bit rate to deflect the receiver from the real signal, ultimately locking onto the spoofed signal. Its strong concealment and high success rate make it more feasible than complex methods and superior to simple ones. Consequently, deceptive spoofing has found widespread application in civilian applications. Its stealth and effectiveness have made it a key area of ​​navigation deception research and, as a result, a mainstream deception technique, making it a key target for deception detection research.

[0004] Inductive spoofing attacks primarily manipulate the receiver by slowly shifting the loop tracking point, thereby achieving loop control. To counter these attacks, many researchers have constructed various metrics in the correlation domain for spoofing detection. Some have proposed classic metrics such as Delta, Ratio, and ELP, which can accurately detect induced spoofing once it enters the loop correlator spacing. Others have proposed the novel SQM (Signal Quality Monitoring) metric, which significantly improves spoofing detection performance on public datasets compared to traditional Delta, Ratio, and ELP metrics. However, because the distortion caused by induced spoofing on the loop correlation peak is very similar to multipath interference, these traditional metrics are prone to misidentifying multipath as spoofing in multipath environments, resulting in a high number of false alarms. To address this issue, traditional correlation domain signal quality monitoring techniques for spoofing detection still suffer from high false alarm rates when dealing with multipath interference. Others have introduced wavelet transforms to extract features from correlation peaks and combined them with fuzzy classifiers to distinguish multipath from spoofing signals. Others have proposed using the SVM algorithm combined with multi-domain information for direct spoofing detection. On public datasets such as TEXBAT, the spoofing detection accuracy and AUC values ​​improved by 30.82% and 0.24, respectively, compared to the Delta algorithm, demonstrating superior performance over traditional SQM methods. Building on this, some have evaluated the impact of the number of input features on the SVM algorithm and added tests on the OAKBAT dataset to evaluate spoofing detection performance across all data scenarios. Scenario 7 achieved the best performance, with a spoofing detection accuracy of 97.02% and an AUC of 0.99.

[0005] However, existing studies have all used manual selection in feature selection, lacking a systematic analysis of feature contribution and correlation, and insufficient evaluation of the model's generalization ability, resulting in poor deception detection performance. Summary of the Invention

[0006] Based on this, it is necessary to provide an SVM-induced deception detection algorithm based on relevant domain information that can improve the deception detection performance in order to address the above technical problems.

[0007] An SVM-based deception detection algorithm based on relevant domain information, the method comprising:

[0008] Obtain the signal generated by the signal source in the interference scenario and capture and solve the signal generated by the signal source to obtain output data; the output data includes the moving average output of the IQ branch of the ELP correlator and related detection index data;

[0009] Perform correlation analysis on the output data and feature screening based on the contribution of features to the label to obtain input feature combinations with different feature quantities;

[0010] A random selection of data from input feature combinations with different numbers of features is used as the training set, and the remaining data is used as the test set. The training set is used to solve the SVM model parameters and build a classifier for detecting GNSS spoofing and multipath interference. The test set is used to classify and predict the classifier, evaluate the detection performance of the SVM model, and perform spoofing detection based on the trained SVM model.

[0011] The above-mentioned SVM-induced deception detection algorithm based on correlation domain information automatically selects the feature combination of the target quantity through feature correlation analysis and mutual information calculation, thereby learning the temporal regularity of correlation peak distortion and the joint relationship between multiple features, fully mining the correlation domain information, and through training on synchronous, asynchronous, and multipath interference data sets, deeply learning the joint relationship between multiple features and their temporal evolution. Using the training set to solve the SVM model parameters to construct a classifier for detecting GNSS deception and multipath interference can effectively distinguish multipath interference from deception signals, and performs well in simultaneous deception detection. The model also shows a certain degree of migration ability, without the need for retraining in each scenario, which significantly improves its practicality and wide adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 1 is a flow chart of an SVM-based deception detection algorithm based on relevant domain information in one embodiment;

[0013] Figure 2 FIG1 is a flowchart of an SVM classification algorithm based on related domain features in one embodiment;

[0014] Figure 3 A schematic diagram of the working principle of a support vector machine in one embodiment;

[0015] Figure 4 Schematic diagram of the change process of the feature Delta-avg in two scenarios in another embodiment;

[0016] Figure 5 1. A diagram showing the change process of the feature iE-avg in two scenarios in one embodiment;

[0017] Figure 6 Graph showing analysis results of feature correlation and tag contribution in one embodiment;

[0018] Figure 7 A graph showing changes in the Ratio detection amount for a Spoofing1 deception scenario in one embodiment;

[0019] Figure 8 This is a graph showing the change in Delta detection value for the Spoofing1 deception scenario in one embodiment;

[0020] Figure 9 This is the result of Spoofing1 traditional inductive deception detection in one embodiment;

[0021] Figure 10 This is a graph showing the Delta detection value changes in the Multipath1 multipath interference scenario in one embodiment;

[0022] Figure 11 This is a graph showing changes in the Ratio detection value in a Multipath1 multipath interference scenario in an embodiment;

[0023] Figure 12 1 is an ROC curve diagram of the CD-SVM algorithm under different feature numbers in one embodiment;

[0024] Figure 13 1 is an ROC curve diagram of a traditional SVM algorithm under different numbers of features in one embodiment;

[0025] Figure 14 1 is a ROC curve diagram of a traditional SQM algorithm in one embodiment;

[0026] Figure 15 The following is the detection result of the SVM algorithm under the evaluation data set in one embodiment. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0028] In one embodiment, Figure 1 and Figure 2 As shown, an SVM-based deception detection algorithm based on relevant domain information is provided, including the following steps:

[0029] Step 102: Acquire the signal generated by the signal source in the interference scenario and capture and solve the signal generated by the signal source to obtain output data; the output data includes the moving average output of the IQ branch of the ELP correlator and related detection index data.

[0030] In GNSS spoofing and multipath interference scenarios, the model reads the signal generated by the signal source, configures parameters for each stage of the software receiver, runs signal acquisition, signal tracking, and position, velocity, and time (PVT) calculation functions, and outputs raw data, including the IQ branch output of the ELP correlator, Ratio, Delta, ELP, and other detection indicators. The model's input features are the moving mean of the IQ branch output of the ELP correlator in the correlation domain, and the moving mean and moving difference of Ratio, Delta, and ELP. The specific features are shown in Table 1.

[0031] Table 1

[0032]

[0033] The signal generated by the signal source in the interference scenario is captured, captured, and resolved, resulting in output data including the moving average of the IQ branch outputs of the ELP correlator and related detection metrics. This data is directly relevant to actual signal processing and reflects key signal characteristics such as signal strength and phase. Correlation analysis and feature screening of this data yield more targeted input feature combinations with varying numbers of features, which better meet the practical needs of spoofing detection and multipath interference differentiation.

[0034] Step 104 , performing correlation analysis on the output data and feature screening based on the contribution of the features to the labels, to obtain input feature combinations with different numbers of features.

[0035] The final model selects input features based on correlation analysis of the original 12 features and their contribution to the label. Based on the feature contribution ranking, the correlation between different features and the amount of raw information they contain are considered as the selection criteria for feature combinations with different feature counts. Feature correlation analysis and mutual information calculation are used to automatically select the target number of feature combinations. This differs from traditional manual feature selection methods in that automatic selection can more comprehensively and systematically mine relevant domain information. In complex satellite navigation signal environments, there may be multiple potential features associated with spoofing signals and multipath interference. Manual selection can easily miss important features or select features with weak correlation. Automatic selection, however, comprehensively considers multiple factors, learning the temporal patterns of correlation peak distortion and the joint relationships between multiple features. This allows for the precise selection of the most representative and discriminative feature combinations for spoofing detection. Furthermore, it fully mines relevant domain information. In satellite navigation signal processing, the relevant domain contains a rich set of signal characteristics, such as signal correlation and phase information. Through the automatic selection process, we can deeply learn the joint relationship between these information and their temporal evolution, so that the selected features can better reflect the true state of the signal, including the differences between deceptive signals and normal signals and multipath interference, thereby providing stronger support for subsequent deception detection.

[0036] Step 106: Randomly select some data from the input feature combinations with different numbers of features as the training set, and the remaining data as the test set. Use the training set to solve the SVM model parameters and build a classifier for detecting GNSS spoofing and multipath interference; use the test set to classify and predict the classifier, evaluate the detection performance of the SVM model, and perform spoofing detection based on the trained SVM model.

[0037] The team rationally partitioned the input feature sets into training and test sets, randomly selecting 80% as the training set and 20% as the test set. The training set was used to solve the SVM model parameters and construct a classifier for detecting GNSS spoofing and multipath interference. This rational data partitioning allows the model to better learn the relationship between features and labels (spoofed signals or normal signals). Furthermore, using the test set to evaluate the SVM model's detection performance through classification and prediction, the model can be continuously optimized, enabling more accurate judgments in real-world spoofing detection tasks, thereby reducing false alarms and improving spoofing detection accuracy.

[0038] The above-mentioned SVM-induced deception detection algorithm based on correlation domain information automatically selects the feature combination of the target quantity through feature correlation analysis and mutual information calculation, thereby learning the temporal regularity of correlation peak distortion and the joint relationship between multiple features, fully mining the correlation domain information, and through training on synchronous, asynchronous, and multipath interference data sets, deeply learning the joint relationship between multiple features and their temporal evolution. Using the training set to solve the SVM model parameters to construct a classifier for detecting GNSS deception and multipath interference can effectively distinguish multipath interference from deception signals, and performs well in simultaneous deception detection. The model also shows a certain degree of migration ability, without the need for retraining in each scenario, which significantly improves its practicality and wide adaptability.

[0039] In one embodiment, the relevant detection index data includes the moving average and moving difference of Ratio, Delta and ELP.

[0040] In one embodiment, performing correlation analysis on the output data includes:

[0041] The Pearson coefficient was used to perform correlation analysis on the output data. The formula is as follows:

[0042]

[0043] Where, Represents the Pearson correlation coefficient, which is used to measure the variables and The linear correlation between them, that is, the correlation between the 12 features in Table 1, and Representing variables and No. observations, variable The average value of , Indicates the time from the first observation to the The cumulative sum of observations.

[0044] In one embodiment, the process of calculating the contribution of a feature to a tag includes:

[0045] Calculate the contribution between the feature value and the category label in the output data as

[0046]

[0047] in, Represents the characteristic variable, that is, the characteristic value in the output data, Indicates the classification result of the category label, i.e., whether it is deceived and whether it contains multipath. represents the joint probability distribution, express The marginal probability distribution of .

[0048] In a specific embodiment, by calculating the contribution between the feature values ​​and the category labels in the output data, a higher mutual information value indicates that the correlation between the feature and the target variable is stronger, and therefore these features are more helpful for the classification task.

[0049] In one embodiment, the sample sets of the training set and the test set are

[0050]

[0051] in, Indicates the mixed signal after being processed by the receiver. Time-dependent domain output -dimensional feature vector, where , A feature selected from a combination of input features with different feature numbers, that is, the input obtained after processing the received mixed signal, Represents the output result, that is, the category of the signal at the current moment, m Indicates the number of training set data, n Indicates the number of test set data.

[0052] In one embodiment, using a training set to solve for SVM model parameters and construct a classifier for detecting GNSS spoofing and multipath interference includes:

[0053] The kernel function is used to map the features in the training set from the original feature space to a higher-dimensional space, and the optimal separating hyperplane corresponding to the SVM model is found. A classifier for detecting GNSS spoofing and multipath interference is constructed based on the optimal separating hyperplane. The classifier divides samples of different categories into the highest intervals in the high-dimensional feature space.

[0054] In one embodiment, the kernel function is

[0055]

[0056] in, Represents the original feature space Mapping function to high-dimensional feature space, Represents the inner product operation.

[0057] In one embodiment, a classifier for detecting GNSS spoofing and multipath interference is constructed based on the optimal separating hyperplane:

[0058]

[0059]

[0060] in, is the normal vector of the hyperplane, representing the mean vector of the hyperplane, is the offset, which represents the distance between the hyperplane and the origin, Represents input feature combinations with different numbers of features in high-dimensional feature space, Represents the output result, that is, the category of the signal at the current moment, m Indicates the number of training set data.

[0061] In a specific embodiment, the hyperplane can correctly divide the training data set and maximize the geometric margin. Figure 3 As shown, the green and orange points represent positive and negative classes respectively, and the points with red borders represent support vectors. The support vectors are the sample points closest to the hyperplane and determine the position and direction of the hyperplane.

[0062] In one embodiment, simulation experiments were conducted. Existing public deception datasets cover synchronous deception scenarios, while the self-developed deception dataset in this application includes both synchronous and asynchronous deception scenarios. Furthermore, the simulated dataset is intended to provide a more comprehensive testing platform, ensuring the algorithm performs well across a variety of deception scenarios. By not relying on existing public datasets, the experiments maintain a higher level of independence and innovation, enabling unrestricted exploration of new signal processing techniques and algorithms.

[0063] This application simulates two real-world dynamic scenarios: static user positions and dynamic user motion. The static user's position is (-2836275, 3333782, 4623813) in the Earth-centered, Earth-fixed (ECEF) coordinate system. The dynamic user starts at (-2836275, 3333782, 4623813) and moves at a constant speed of 10 m / s along the y-axis. For the static user, initial pseudocode phase offsets of -0.75 and -0.25 chips are set, followed by code phase shifts of 0.1 and 0.5 chips / s for induced spoofing. For the dynamic user, a pseudocode phase offset of -10 chips is set, followed by a gradual approach to the real target at a rate of 0.5 chips / s, and finally a shift is implemented. Multipath interference is simulated by adding code phase delay and Doppler to the original signal. The scenario parameter configuration for the experimental dataset is shown in Table 2. The training set includes Spoofing1, Spoofing2, Multipath1, and Multipath2, and the model evaluation set includes Spoofing3 and Multipath3. Spoofing1 spoofs dynamic users. Because the start code phase is greater than the correlator spacing (1 chip), it is an asynchronous deceptive deceptive dataset. Spoofing2 and Spoofing3 spoof static users, and because the start code phase is less than the correlator spacing, they are synchronous deceptive deceptive datasets. Multipath1, Multipath2, and Multipath3 all implement multipath interference on static users.

[0064] For the scenario dataset used in the simulation experiments of this application, Table 2 details parameters such as the duration of the mixed signal, the carrier-to-noise ratio of the navigation signal, the cut-in time of the spoofing signal, the power gain, the initial pseudo-code phase delay, the pseudo-code deviation rate, and the Doppler frequency offset. For the multipath interference dataset, information such as the power attenuation, cut-in time, delay, and Doppler frequency offset of the multipath interference is provided.

[0065] Table 2

[0066]

[0067] The input features of the model include the moving mean, ratio, delta of the IQ branch output of the correlation domain ELP correlator, and the moving mean and moving difference of ELP, totaling 12 features. For the same target, the impact of Spoofing2 deception and Multipath1 multipath interference on these features is as follows: Figure 4 and Figure 5 shown. Figure 4It shows the changing trend of the feature Delta-avg in the above two cases. Figure 5 This reveals the changing patterns of the characteristic iE-avg under two circumstances. Specifically, before deception and multipath interference, the detection value remains stable; once deception or multipath interference is introduced, the detection value undergoes a significant sudden change. In particular, after deception, the detection value undergoes a period of dynamic fluctuations before returning to a stable state. However, after multipath interference is introduced, the detection value stabilizes and remains at a specific value.

[0068] In order to determine the final input features selected by the model, this application first conducted a detailed correlation analysis on the original 12 features and evaluated their importance by their contribution to the label. The Pearson coefficient was used to conduct a correlation analysis on the original 12 features listed in Table 1, and the mutual information method was used to analyze the actual contribution of the features to the result label. The detailed analysis results are as follows: Figure 6 As shown. Figure 6 The correlation analysis on the left shows that the moving average detection values ​​of Delta and Ratio show a negative correlation, while their difference shows a positive correlation, and the correlation between the two is particularly prominent. Figure 6 A comprehensive assessment of the contribution histogram on the right reveals that despite a strong negative correlation between Delta and Ratio, both measurements contribute significantly to the final result. A closer look at the I / Q output characteristics reveals a strong positive correlation between the I and Q information, with the I-channel's contribution significantly higher than both the ELP and Q-channel measurements. This result is consistent with the physical principle that the I-channel serves as an effective energy channel and the Q-channel as a noise channel.

[0069] First, feature selection was performed by calculating the mutual information between features and labels, as well as the correlation between features. This process identified optimal combinations ranging from two to six features, which are listed in Table 3. Subsequently, the model was trained and tested using these different feature combinations. Although the I_P_Avg feature contributed less than the Delta_Diff feature, it was prioritized over the I_P_Avg feature in feature selection because Delta_Diff is the first-order difference component of the Delta_Avg feature.

[0070] Table 3

[0071]

[0072] When using SQM technology for deceptive jamming detection, it is necessary to understand the statistical characteristics of the SQM indicator to obtain its probability density function and determine the decision threshold based on the set false alarm probability. Existing research shows that under high signal-to-noise ratio conditions, the SQM indicator approximately follows a normal distribution.

[0073] In this application's simulation experiments, the Ratio and Delta metrics, after motion smoothing, were used to detect spoofing and multipath interference. The false alarm probability was set at 5%, resulting in a spoofing detection threshold. Detection accuracy was defined as the ratio of the number of samples exceeding the detection threshold to the total number of samples, calculated every 100 milliseconds.

[0074] The traditional SQM spoofing detection algorithm was used to accurately detect the first and fourth signal groups in Table 2. The first signal group was Spoofing1, an induced spoofing signal with an initial pseudo-code phase difference of -0.25 chips and a deflection rate of 0.1 chips / s. The Spoofing1 mixed signal lasted for 100 seconds, with the first 30 seconds consisting of a pure navigation signal, and the mixed signal after the 30th second consisting of a combination of spoofing and navigation signals. The second signal group was Multipath1, a multipath interference signal with a pseudo-code delay difference of -0.5 chips. The Multipath1 mixed signal also lasted for 100 seconds, with the first 30 seconds consisting of a pure navigation signal, and the next 30 seconds consisting of a mixture of multipath and navigation signals.

[0075] The changes in Ratio and Delta detection in the Spoofing1 deception scenario are as follows Figure 7 and Figure 8 Observing these graphs clearly shows that during the navigation-only phase, before the spoofing signal is introduced, the detection rate remains within the detection threshold. However, once the spoofing signal is introduced, the detection rate rapidly climbs and exceeds the detection threshold. Over time, once the spoofing signal fully controls the loop, the detection rate stabilizes again.

[0076] Test results such as Figure 9As shown. At about 30 seconds, the deception detection accuracy quickly jumped from 0% to 100%, indicating that the algorithm successfully identified the deception signal at this stage, which is completely consistent with the setting of the actual deception scenario, proving the excellent performance of the algorithm. However, at about 50 seconds, the deception detection accuracy quickly dropped from 100% to 0%, indicating that the algorithm now believes that there is no deception in the signal, but the actual situation is that the deception signal continues to exist, resulting in an error in the algorithm detection. The reason for this phenomenon is that in the scenario configuration, the intervention time of the deception signal is the 30th second. From the 30th to the 50th second, the deception signal and the navigation signal compete fiercely for the control of the code loop, resulting in the distortion of the correlation peak. However, after the 50th second, the deception signal has completely controlled the loop, and the distortion of the correlation peak disappears. Therefore, the algorithm's detection accuracy quickly rose from 0% to 100% at 30 seconds, but after the deception signal completely controlled the loop, the detection accuracy dropped to 0%. The traditional SQM deception detection algorithm was used to detect the Multipath1 multipath interference scenario in Table 3 in the same way. The detection quantity change curve is shown in the figure below. Figure 10 and Figure 11 As shown in the figure, in the pure navigation signal phase, before multipath interference, the detection value remains within the detection threshold. However, when multipath interference enters, the detection value rapidly climbs, exceeding the detection threshold and persists. This causes traditional SQM spoofing detection algorithms to generate a large number of false alarms in multipath scenarios.

[0077] On the same dataset, the CD-SVM deception detection algorithm is compared with the traditional SVM deception detection algorithm and the traditional SQM deception detection algorithm. The traditional SVM algorithm uses artificial random feature selection [20, 21], while the traditional SQM algorithm uses the moving average detection quantity deception detection algorithm proposed by Phelts et al.

[24] .

[0078] The experimental dataset used the progressive spoofing scenarios (Spoofing1 and Spoofing2) and multipath scenarios (Multipath1 and Multipath2) listed in Table 2 as training data, containing a total of 13 signals. Each signal lasted 100 seconds, with 100ms as a data point. During the experiment, the signals were processed by a software receiver and data was extracted from the correlation domain features output by the tracking loop. The time units of these features were milliseconds. Therefore, each millisecond of signal corresponded to multiple feature values. Subsequently, data preprocessing and feature engineering were performed on these feature values ​​to generate the training dataset. Signal labels for periods without interference were set to 0, for periods with spoofing interference to 1, and for periods with multipath interference to 2. 80% of the dataset was randomly selected for training, and the remaining 20% ​​was used for testing. The detection performance of the CD-SVM algorithm was compared with that of the traditional SVM algorithm, and the classification performance of each algorithm was visually demonstrated using ROC (Receiver Operating Characteristic Curve) and AUC (Area Under the Curve) values. The ROC curve is a commonly used performance evaluation tool that reflects the relationship between a model's true positive rate (TPR) and false positive rate (FPR) at different thresholds. The closer a model's ROC curve approaches the upper left corner, the better the model's performance, while maintaining a high TPR and a low FPR. The AUC is a metric used to measure the performance of a classification model; values ​​closer to 1 indicate stronger classification capabilities. Figure 12 shows the ROC curves of the CD-SVM (Correlation Domain Support Vector Machine) algorithm proposed in this application for different numbers of features. The three sub-figures in Figure 12 represent the ROC results of the SVM algorithm for pure navigation signals (Nav-only), a mixture of spoofed and navigation signals (Nav+spoof), and a mixture of multipath interference and navigation signals (Nav+Multipath). Analysis of the ROC curves reveals that the SVM algorithm's ROC curve gradually shifts toward the upper left corner as the number of features increases, particularly in the multipath interference classification task, where the curve reaches near optimality. This shows that SVM can more accurately distinguish positive and negative samples under high-dimensional feature combinations, especially in the identification of multipath interference.

[0079] Therefore, in practical applications, it is recommended to give priority to the combination with a feature number of 6 to maximize the classification performance of SVM, and further optimize the features for the classification task of deceptive interference to improve the recognition accuracy.

[0080] Combined with the AUC results corresponding to the ROC curve in Table 5, it can be seen that the AUC values ​​of the SVM algorithm when the number of features increases from 2 to 6 show that as the number of features increases, its AUC values ​​in various classification tasks show an overall upward trend. In particular, the AUC value of multipath interference (Nav+Multipath) increased from 0.9639 to 0.9971, indicating that the SVM exhibits extremely strong classification capabilities under high-dimensional feature combinations. This phenomenon is also significant in Nav-only and Nav+Spoof, increasing from 0.9479 to 0.9939 and from 0.7291 to 0.9789, respectively. By randomly selecting different numbers of feature combinations from the existing 12 features, the features selected for the experiment are shown in Table 4 below. Observation Figure 13 The experimental results show that compared with Figure 12 The ROC curve results for the CD-SVM algorithm are shown in Figure 2. The CD-SVM algorithm's ROC curve is closer to the upper left corner, indicating better performance. Experimental results show that randomly selecting feature combinations results in ROC curve performance not increasing with the number of features, increasing the complexity of manual traversal testing.

[0081] Table 4

[0082]

[0083] The data in Table 5 shows that CD-SVM generally outperforms traditional SVMs across a wide range of feature counts. Specifically, as the number of features increases, CD-SVM's accuracy improves from 0.8813 to 0.9561, demonstrating its strong generalization capabilities. Similarly, CD-SVM demonstrates significant improvements in precision, recall, and F1 score, particularly when the number of features is 6, where all metrics reach their highest values ​​of 0.9561, 0.9561, and 0.9561, respectively, demonstrating its robust and efficient performance in classification tasks.

[0084] Further observation of the AUC values ​​reveals that CD-SVM outperforms traditional SVMs across a wide range of feature counts. As the number of features increases, the CD-SVM's AUC significantly improves from 0.9479 with two features to 0.9971 with six features, demonstrating its high adaptability to feature combinations and strong generalization capabilities. In contrast, the traditional SVM's AUC values ​​fluctuate significantly across different feature counts, reaching a maximum of 0.9733 (with four features) and a minimum of only 0.5955 (with two features), indicating that it is less stable and efficient than the CD-SVM in terms of feature selection and model performance.

[0085] Notably, CD-SVM achieved high performance in all metrics (including Nav-only_AUC and Nav+spoof_AUC) when the number of features was 4 and 6. When the number of features was 6, all metrics performed particularly well, reaching 0.9939, 0.9789, and 0.9971, respectively. This further validates the superior performance of CD-SVM with complex feature combinations. While traditional SVMs also perform well with certain feature combinations, overall, their stability and accuracy when processing high-dimensional feature data are still inferior to CD-SVMs.

[0086] In summary, CD-SVM has obvious advantages in feature selection and model training, and can better utilize different numbers of feature combinations for classification tasks, thereby significantly improving the prediction performance and robustness of the model.

[0087] Table 5

[0088]

[0089] The traditional signal quality measurement (SQM) method is used to detect deception in the dynamic target asynchronous deception dataset Spoofing1 scenario. This application uses the traditional Ratio detection method and sets the false alarm probability to 1%. The experimental results are shown in Figure 14 Observing these results, we can see that when dealing with the binary detection problem of only deception and non-deception, the traditional detection algorithm has an AUC value of 0.8750, while according to the data in Table 5, the CD-SVM has an AUC value of 0.9789. This shows that even in the single deception scene detection task, the performance of the traditional SQM algorithm still lags significantly behind that of the CD-SVM algorithm.

[0090] This result further emphasizes the superiority of the CD-SVM algorithm in handling complex deception detection tasks. In particular, when considering the key performance indicator of AUC value, CD-SVM can more accurately distinguish between deception and non-deception states, demonstrating its efficient and stable detection capabilities.

[0091] To further evaluate the performance of the trained SVM model, a CD-SVM model with six input features was loaded and a migration test was performed using the evaluation datasets in the experimental scenarios in Table 3. The experimental results are shown in Figure 15. The left vertical axis represents the manually annotated true labels, the lower horizontal axis represents the model-predicted labels, and the diagonal line represents the accuracy of three detection targets: no spoofing (Nav-only), spoofing (Nav+spoof), and multipath interference (Nav+Multipath).

[0092] As shown in Figure 15, the SVM algorithm achieved a classification accuracy of 99.0% for Nav+Multipath in the evaluation dataset, and 93.7% and 90.5% for Nav-only and Nav+spoof respectively.

[27] The classification results were evaluated, and the evaluation results of Accuracy, Precision, Recall, and F1 were 0.9043, 0.9106, 0.9043, and 0.8939, respectively.

[0093] The CD-SVM model with 6 feature inputs is also tested on the TEXBAT dataset, using the ds2 scenario [5] The CD-SVM model was trained and used to test the ds3 scenario. The specific results are shown in Table 6 below.

[0094] Table 6

[0095]

[0096] It can be found that in the training scenario of ds2, the 6-feature CD-SVM model is used for training and testing. The detection indicators such as accuracy and precision all reach above 99%. The detection indicators on the evaluation test set ds3 are also above 98%.

[0097] The above results prove that the CD-SVM model proposed in the simulation experiment of this application not only has good performance in detecting induced deception in multipath scenarios, but also has certain migration capabilities.

[0098] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0099] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0100] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and such modifications and improvements are intended to fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A SVM-based deception detection method based on related domain information, characterized in that: The method comprises: Obtaining a signal generated by a signal source in an interference scenario and capturing and solving the signal generated by the signal source to obtain output data; the output data includes a moving average output of an IQ branch of the ELP correlator and related detection index data; Performing correlation analysis on the output data and feature screening based on the contribution of features to the label to obtain input feature combinations with different numbers of features; Randomly selecting a portion of data from the input feature combinations with different numbers of features as a training set and the remaining data as a test set, using the training set to solve SVM model parameters to construct a classifier for detecting GNSS spoofing and multipath interference; using the test set to classify and predict the classifier, evaluate the detection performance of the SVM model, and perform spoofing detection based on the trained SVM model; The training set is used to solve the SVM model parameters and build a classifier for detecting GNSS spoofing and multipath interference, including: Mapping the features in the training set from the original feature space to a higher-dimensional space using a kernel function, finding an optimal separating hyperplane corresponding to the SVM model, and constructing a classifier for detecting GNSS spoofing and multipath interference based on the optimal separating hyperplane. The classifier divides samples of different categories into a maximum-interval partition in the high-dimensional feature space. The kernel function is: in, Represents the original feature space Mapping function to high-dimensional feature space, represents the inner product operation; The classifier for detecting GNSS spoofing and multipath interference is constructed based on the optimal separating hyperplane: in, is the normal vector of the hyperplane, representing the mean vector of the hyperplane, is the offset, which represents the distance between the hyperplane and the origin, Represents input feature combinations with different numbers of features in high-dimensional feature space, Represents the output result, that is, the category of the signal at the current moment, m Indicates the number of training set data.

2. The method according to claim 1, characterized in that The relevant detection index data include the moving average and moving difference of Ratio, Delta and ELP.

3. The method according to claim 1, characterized in that Performing correlation analysis on the output data, including: The Pearson coefficient was used to perform correlation analysis on the output data, and the formula is as follows: Where, Represents the Pearson correlation coefficient, which is used to measure the variables and The linear correlation between and Representing variables and No. observations, variable The average value of , Indicates the time from the first observation to the The cumulative sum of observations, variable The average value of .

4. The method according to claim 1, wherein The calculation process of the contribution of the feature to the label includes: The contribution between the feature value and the category label in the output data is calculated as: in, Represents the characteristic variable, that is, the characteristic value in the output data, Indicates the classification result of the category label, i.e., whether it is deceived and whether it contains multipath. represents the joint probability distribution, express The marginal probability distribution of express The marginal probability distribution of .

5. The method according to claim 1, wherein The sample sets of the training set and test set are: in, Indicates the mixed signal after being processed by the receiver. Time-dependent domain output -dimensional feature vector, where , A feature selected from a combination of input features with different feature numbers, that is, the input obtained after processing the received mixed signal, Represents the output result, that is, the category of the signal at the current moment, m Indicates the number of training set data, n Indicates the number of test set data.

Images