GNSS spoofing interference detection method, device, equipment and storage medium

Abstract

The present invention provides a GNSS spoofing interference detection method, apparatus, device, and storage medium. The method comprises: inputting a GNSS signal to be detected into a GNSS software receiver to obtain an advanced output, an immediate output, and a delayed output of a correlator in the GNSS software receiver; calculating a characteristic sequence; and inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected. The present invention has the following beneficial effects: Compared with traditional inspection methods and SVM-based model detection methods, it improves overall detection performance while maintaining a low false alarm rate and high generalization capability, and improves effectiveness and robustness in diverse spoofing interference scenarios.

Description

Technical Field

[0001] The present invention relates to the field of satellite navigation, and in particular to a GNSS deception interference detection method, device, equipment and storage medium. Background Art

[0002] The Global Navigation Satellite System (GNSS), a space-based radio navigation and positioning system, provides all-weather, high-precision three-dimensional positioning, navigation, and timing (PNT) services to users on Earth's surface and in near-Earth space through a constellation-based network. This system demonstrates irreplaceable application value in a wide range of military and civilian sectors, including intelligent traffic management, mobile communication network synchronization, industrial automation control, and the modern information-based battlefield. The significant application value of GNSS in civilian infrastructure and national defense security has made it a key target for deception by malicious actors, driven by both demand and technology.

[0003] However, the inherent vulnerabilities of GNSS systems are becoming increasingly prominent as their scope of application expands. First, the publicly available Interface Control Document (ICD) lacks the necessary signal authentication mechanism, making the signal structure predictable. Second, the downlink signal power is lower than the background noise, making it susceptible to spoofing interference. Third, the popularity of Software Defined Radio (SDR) technology has made spoofing interference equipment low-cost and dynamically reconfigurable. In addition, the multipath effect in the electromagnetic propagation environment produces multipath signals that share physical characteristics with spoofing interference signals, which greatly increases the complexity of spoofing interference detection. The combination of these technical flaws and environmental factors makes the GNSS system present significant security risks when facing spoofing attacks.

[0004] The models used in existing machine learning deception detection methods are relatively simple, the deception scenarios studied are not sufficient, and the models lack certain generalization capabilities. Summary of the Invention

[0005] The main purpose of the present invention is to provide a GNSS spoofing interference detection method, device, equipment and storage medium, aiming to solve the problems that the model used in the existing machine learning deception detection method is relatively simple, the deception scenarios studied are not sufficient, and the model lacks a certain generalization ability.

[0006] The present invention provides a GNSS spoofing interference detection method, comprising:

[0007] Inputting the GNSS signal to be detected into a GNSS software receiver to obtain an advanced output, an immediate output, and a delayed output of a correlator in the GNSS software receiver;

[0008] Based on the leading output, the immediate output and the lagging output, a characteristic sequence is calculated according to a preset algorithm;

[0009] Inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected;

[0010] The step of inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected includes:

[0011] Inputting the feature sequence into a preset transformer model to map the feature sequence into a continuous vector space, encoding it using sinusoidal positions, and obtaining a feature sequence vector;

[0012] The feature sequence vector is processed using a multi-head attention mechanism, and the outputs of each attention head are integrated to obtain the analysis result of the GNSS signal to be detected.

[0013] Furthermore, the preset algorithm is any one of a delta factor method, an improved quality detection factor method, and a composite detection factor method.

[0014] Furthermore, the step of calculating the characteristic sequence based on the leading output, the immediate output and the lagging output according to a preset algorithm includes:

[0015] The method further comprises calculating different characteristic subsequences based on the advanced output, the immediate output and the delayed output according to different algorithms;

[0016] The feature subsequences are weighted and fused to obtain the feature sequence.

[0017] Furthermore, before the step of weighted fusion of the characteristic subsequences to obtain the characteristic sequence, the method further includes:

[0018] Analyzing the Doppler frequency and carrier phase of the GNSS signal to be detected by a preset GNSS software receiver;

[0019] The Doppler frequency and the carrier phase are divided into a characteristic subsequence.

[0020] Furthermore, before the step of inputting the characteristic sequence into a preset converter model for processing to obtain the analysis result of the GNSS signal to be detected, the method further includes:

[0021] Retrieving a specified amount of signal data from a preset signal database and dividing the signal data into training signal data and verification signal data according to a preset ratio; wherein the signal data comprises a GNSS signal and an artificial identifier corresponding to the GNSS signal, the artificial identifier indicating whether the signal is a spoofed signal or not;

[0022] Inputting the training signal data into a preset transformer initial encoder for training, thereby obtaining a transformer temporary encoder;

[0023] Verifying the temporary encoder of the converter using the verification signal data to obtain a verification result, and determining whether the verification result is verification passed;

[0024] If the verification result is that the verification is passed, the converter temporary encoder is recorded as the preset converter model.

[0025] The present invention also provides a GNSS deception interference detection device, comprising:

[0026] An input module, configured to input a GNSS signal to be detected into a GNSS software receiver to obtain an advanced output, an immediate output, and a delayed output of a correlator in the GNSS software receiver;

[0027] A calculation module, configured to calculate a characteristic sequence based on the leading output, the immediate output, and the lagging output according to a preset algorithm;

[0028] The processing module is used to input the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected.

[0029] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0030] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0031] The present invention achieves the following beneficial effects: By inputting the GNSS signal to be detected into a GNSS software receiver, the advanced output, immediate output, and delayed output of the correlator in the GNSS software receiver are obtained, a characteristic sequence is calculated, and this characteristic sequence is input into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected. Compared with traditional detection methods and SVM-based model detection methods, this method improves overall detection performance while maintaining a low false alarm rate and high generalization capability, and enhances effectiveness and robustness in diverse deceptive jamming scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a schematic diagram of a GNSS spoofing jamming scenario according to an embodiment of the present invention;

[0033] Figure 2 : is a schematic diagram of the GNSS deception interference induction process according to an embodiment of the present invention; wherein, Figure 2 (a) is a schematic diagram of spoofing signal injection; Figure 2 (b) is a schematic diagram of deceptive signal alignment; Figure 2 (c) is a schematic diagram of deceptive signal separation; Figure 2 (d) is a schematic diagram of deceptive signal control;

[0034] Figure 3 1 is a flow chart of a GNSS spoofing interference detection method according to an embodiment of the present invention;

[0035] Figure 4 : is a schematic diagram of comparison curves of various feature observations in real and deceptive scenarios according to an embodiment of the present invention; wherein, Figure 4 (a) is a schematic diagram of the comparison curve with the carrier phase as the characteristic vector; Figure 4 (b) is a schematic diagram of the comparison curve with Doppler frequency as the characteristic vector; Figure 4 (c) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (d) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (e) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (f) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (g) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (h) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (i) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4(j) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (k) is is a schematic diagram of the comparison curve of the characteristic vector; Figure 4 (l) is is a schematic diagram of the comparison curve of the characteristic vector;

[0036] Figure 5 FIG. 1 is a schematic diagram of a deception detection method based on a hypothesis testing method according to an embodiment of the present invention; wherein, Figure 5 (a) Schematic diagram of deception detection using the hypothesis testing method in the TEXBAT-ds2 deception scenario; Figure 5 (b) is a schematic diagram of deception detection using the hypothesis testing method in the TEXBAT-ds5 deception scenario;

[0037] Figure 6 This is a comparison chart of AUCs of different fraud detection methods according to an embodiment of the present invention;

[0038] Figure 7 : is an ROC curve diagram of different data sets tested in different deception scenarios according to an embodiment of the present invention; wherein, Figure 7 (a) is the ROC curve of the deception scene ds2; Figure 7 (b) is the ROC curve of the deception scenario ds5; Figure 7 (c) is the ROC curve of the deception scenario os3; Figure 7 (d) is the ROC curve of the deception scenario Targeted DFMC;

[0039] Figure 8 This is a schematic block diagram of a GNSS spoofing interference detection method according to an embodiment of the present invention;

[0040] Figure 9 is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention;

[0041] Figure 10 Schematic diagram of the relationship between the F1 score and running time of the Transformer according to an embodiment of the present invention.

[0042] In the accompanying drawings: 10, input module; 20, calculation module; 30, processing module.

[0043] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0044] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0045] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative position relationship, movement status, etc. between the various components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly. The connection can be a direct connection or an indirect connection.

[0046] The term "and / or" in the present invention is merely a description of the association relationship between associated objects, indicating that there may be three relationships. For example, A and B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone.

[0047] In addition, in the present invention, descriptions such as "first" and "second" are for descriptive purposes only and should not be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but this must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0048] According to the deception signal generation method, deception jamming can be divided into forwarding deception jamming and generating deception jamming. Deception jamming scenarios such as Figure 1 As shown in the figure, generative spoofing jamming transmits a spoofed signal with higher power than the real signal and requires detailed information about the satellite navigation signal, such as its structure and modulation method. Relay spoofing jamming simply amplifies the signal's power and prolongs its arrival time. However, it doesn't require knowledge of the satellite navigation signal's specific structure, making it easier to achieve wide-area jamming coverage.

[0049] The deceptive party copies the carrier, spread spectrum code, navigation message and other information of each open GNSS signal. The deceptive interference model can be expressed as:

[0050]

[0051] in, To spoof the number of satellite signals, For the The power of a spoof satellite. and Respectively represent The navigation message bit stream of the spoofed satellite and Spread spectrum code; 、 、 、 are the corresponding intermediate frequency, code phase, carrier phase, and Doppler shift, is the imaginary unit, is a natural constant.

[0052] The satellite navigation receiver captures and tracks satellite signals by correlating the received signal with a local copy. When the receiver is in a stable tracking state, the coherent integration value of the I and Q branch channels of the received signal is:

[0053]

[0054]

[0055] in, and denote the correlator spacing and coherent integration time, respectively. represents the noise power variance, and All have mean zero and variance The random normal noise, is the coherent integral value of the I branch channel, is the coherent integration value of the Q branch channel, is the carrier-to-noise ratio, is the phase difference between the local carrier and the received signal carrier.

[0056] The deception jamming induction process in the tracking phase can be divided into four stages, such as Figure 2 As shown: Figure 2 (a) Injecting deceptive signals; Figure 2 (b) Alignment of deceptive signals; Figure 2 (c) signal separation for deception; Figure 2 (d) Spoofing signal control. The spoofing signal starts at low power and then gradually increases in power, adjusting the carrier frequency and code phase until it is fully synchronized with the code phase of the real signal. The spoofing signal leverages its power advantage to gradually weaken the target receiver's ability to track the real signal, ultimately causing the target receiver to completely transition its tracking to the spoofing signal, achieving complete control over the target receiver.

[0057] During signal acquisition, when the carrier frequency and code delay of the real satellite signal match the parameters of the local signal, the correlation result reaches a maximum value. Similarly, if the carrier frequency and code delay of the deceptive interference signal are consistent with the local signal parameters, the correlation result of the deceptive interference will also form a peak. Furthermore, when the power of the deceptive interference signal is stronger than that of the real satellite signal, the peak-to-peak value of the correlation of the deceptive interference will even exceed the maximum value of the correlation peak of the real signal. In this case, the receiver is very likely to mistakenly capture the deceptive interference signal, resulting in signal tracking failure. Assuming that the deceptive interference signal has the same frequency as the real GPS signal, the integral accumulation result of the in-phase branch (I branch) and the quadrature branch (Q branch) can be expressed as:

[0058] in, , is the A / D sampling rate, is the pre-detection integration time, is the estimated frequency difference, and denote the phase difference between the estimated satellite signal and the spoofing signal, 、 are the time delays of deceptive jamming and real satellite signals, is the autocorrelation function of the C / A code, is the gain factor of the deceptive jamming signal strength relative to the real satellite signal, For in time The navigation data code, Indicates the delay of the local code, Indicates the satellite signal strength. Indicates time.

[0059] During the acquisition phase, if the power of the deceptive signal is greater than the power of the real signal, then the captured signal will be the rough code phase and carrier Doppler frequency shift of the deceptive signal. After entering the tracking loop, the impact of deceptive interference on the tracking loop is mainly reflected in the carrier tracking loop and the code tracking loop. When deceptive interference and real satellite signals coexist in an environment, the in-phase and quadrature branches of the tracking loop of a typical GPS receiver are affected. 、 、 The coherent integration output of the correlator is:

[0060]

[0061]

[0062]

[0063]

[0064]

[0065]

[0066] Where, 、 Represent the code delay and code phase of the real satellite signal respectively, 、 are the delay and phase of the local code, 、 are the code delay and code phase of the spoofing signal, is the spacing between the lead and lag correlators.

[0067] There are many existing detection methods. This paper uses the hypothesis testing method as an example. The real and imaginary parts of the early, immediate, and late code correlation outputs are independent random variables, and all six branches follow a Gaussian distribution with the same variance but different means. Asymmetric distortion in the GNSS correlator output affects the mean. The distortion of the signal correlator output can be determined by comparing the measured detection factor with a threshold. According to the Neyman-Pearson criterion, the GNSS spoofing jamming detection problem can be viewed as a binary hypothesis testing problem.

[0068] Real satellite signal (assuming ) and deceptive jamming signals (assuming ) under the condition of test statistic Obey different Gaussian distributions.

[0069]

[0070] in, and represent the mean of the Gaussian distribution of the real satellite signal and the deceptive interference signal, is the common variance.

[0071] Under the Neyman-Pearson criterion, the verdict is The likelihood ratio test statistic for is:

[0072]

[0073] Where, and Respectively expressed in and Assume that the test statistic The probability density function of It can be obtained by the following formula:

[0074]

[0075] Where, represents the complementary error function, is the given false alarm probability.

[0076] Reference Figure 3 The present invention proposes a GNSS spoofing interference detection method, comprising:

[0077] S1: Inputting a GNSS signal to be detected into a GNSS software receiver to obtain an advance output, an immediate output, and a delayed output of a correlator in the GNSS software receiver;

[0078] S2: Based on the advanced output, the immediate output, and the delayed output, a characteristic sequence is calculated according to a preset algorithm;

[0079] S3: Inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected.

[0080] As described in step S1 above, the GNSS signal to be detected is input into a GNSS software receiver to obtain the lead output, immediate output, and delayed output of the correlator in the GNSS software receiver. Specifically, the GNSS signal to be detected is input into one or more correlators to obtain the lead output, immediate output, and delayed output, where the lead output is the signal a period of time before the current time point; the immediate output is the signal at the current time point; and the delayed output is the signal a period of time after the current time point. It should be noted that the lead output, immediate output, and delayed output are all time series.

[0081] As described in step S2 above, based on the leading output, the immediate output, and the lagging output, a characteristic sequence is calculated according to a preset algorithm. In a specific embodiment, the preset algorithm is any one of a delta factor method, an improved quality detection factor method, and a composite detection factor method.

[0082] Traditional signal quality monitoring methods include the Delta factor method, Ratio, ) Factor Method and Early-Late Phase, ) factor method, respectively defined as:

[0083]

[0084]

[0085]

[0086] in, 、 、 are respectively the leading, immediate and lagging outputs of the in-phase branch of the correlator, and are the leading and lagging outputs of the orthogonal branches of the correlator. In the absence of deceptive interference, the correlation peak is symmetrical and flat. Approaches zero. When the correlation function is asymmetric, the difference between the leading and lagging is not zero. The larger the difference, the more serious the correlation peak distortion. Under normal circumstances, the energy distribution of the three is stable. The values ​​fluctuate within a certain range, and spoofing signals can disrupt this ratio. and All by dividing Normalizing the detection statistics eliminates the impact of received signal amplitude changes on deception detection, but it also fails to reflect power changes. In real signal scenarios, the phase difference between the leading and lagging outputs is stable, and the intrusion of deceptive signals will cause phase jumps or phase inconsistencies.

[0087] Since the above three detection factors do not fully utilize the full output of the correlator, the prior art proposes an improved signal quality monitoring (ISQM), whose detection factor can be expressed as:

[0088]

[0089] The ISQM detection factor can more robustly reflect the distortion of the correlator output, and and The inverse tangent function used in the detection factor can play a nonlinear amplification role in the distortion of the correlation peak and has strong robustness in detecting covert deception.

[0090] In a complex electromagnetic environment, even if there is no deceptive interference signal, external random disturbances will affect the signal-related parameters directly output during the tracking phase, resulting in random fluctuations and misjudgment. By averaging the data within a data window through a sliding window mechanism, random fluctuations caused by instantaneous noise or electromagnetic interference can be effectively suppressed, highlighting the long-term trend of signal quality. The observations processed by the moving average are more effective in detecting weak fluctuations and are more suitable for detecting slow-pulling deception attacks. The variance can reflect the degree of fluctuation of the data within the window. The intrusion of a deceptive attack will cause the variance of the detection factor to increase significantly. Deception can be quickly detected within a short period of time after the deception is injected, thereby improving the real-time performance of deception detection. The moving mean and moving variance of the composite SQM are defined as:

[0091]

[0092]

[0093] in Indicates the window moving step size, is the selected window length. It is an important indicator for identifying deceptive interference, and The moving average of can reflect the long-term changes in signal strength, and the deceptive interference injection will cause Sudden fluctuations and increased variance can be used as indicators to detect sudden anomalies. The moving mean and moving variance of can be expressed as:

[0094]

[0095]

[0096] In a specific embodiment, the step S2 of calculating the characteristic sequence based on the leading output, the immediate output, and the lagging output according to a preset algorithm includes:

[0097] S201: obtaining different characteristic subsequences based on the advanced output, the immediate output, and the delayed output by calculating using different algorithms;

[0098] S202: Perform weighted fusion on each feature subsequence to obtain the feature sequence.

[0099] As described in the above steps S201-S202, a single indicator is often difficult to fully reflect the dynamic changes of the signal. The combination of the moving mean and the moving variance can simultaneously capture the trend changes and fluctuation characteristics of the signal. In the process of selecting training parameters, the present invention constructs a feature vector by multi-parameter weighted fusion and uses it as the input of the training model. This method not only realizes the fusion of multi-dimensional features and constructs a feature system from multiple dimensions, thereby improving the comprehensiveness and robustness of detection, but also effectively reduces the input dimension of model training and accelerates the training process of the model. The feature vector after multi-parameter weighted fusion is defined as follows:

[0100] .

[0101] Table 1:

[0102] Multi-parameter weighted coefficients under different deception scenarios

[0103]

[0104] In one embodiment, before the step S202 of weighted fusion of the characteristic subsequences to obtain the characteristic sequence, the method further includes:

[0105] S2011: Analyzing the Doppler frequency and carrier phase of the GNSS signal to be detected by a preset GNSS software receiver;

[0106] S2012: Divide the Doppler frequency and the carrier phase into a characteristic subsequence.

[0107] As described in the above steps S2011-S2012, the above-mentioned feature vectors, namely [ , , , , , , , , , ] and 12 vectors of Doppler frequency and carrier phase are used as subset vectors, and then any two or more are selected as subset vectors for weighted summation, where the weight of each subset vector can be set arbitrarily, as long as the sum of all weights is equal to 1.

[0108] In order to intuitively demonstrate the superiority of the features selected by the model, a comparison curve of the time-varying feature parameters in the real navigation signal scenario and the deception interference scenario is drawn. The results are shown in Figure 2. Figure 4 (a)- Figure 4 (l) shows the blue line representing the true signal and the orange line representing the spoofing signal. The experiments used two datasets: TEXBAT's clean_static (no spoofing interference scenario) and the ds2 spoofing scenario. The experimental results show that the output values ​​of various feature observations after spoofing injection differ significantly from the signal output values ​​in the true navigation scenario. Specifically, the more significant the difference in feature observations, the stronger the model's ability to distinguish between true navigation and spoofing interference scenarios, and the better the spoofing detection performance.

[0109] In order to fully explore the influence of different feature parameter combinations on the model effect, the present invention systematically set up 8 groups of comparative experiments. Please refer to Table 2 for details. The feature parameter combinations of each group of experiments are different, and the specific settings are shown in Table 2. By comparing and analyzing the experimental results of each group, it is intended to identify the key feature parameters that have a significant impact on the model performance. At the same time, according to the final training results of the model, the optimal input feature parameter combination of the model will be selected. Parameter selection follows the following principle: achieve optimal model performance with the least number of features and the shortest training time. This principle not only helps to reduce model complexity and improve computational efficiency, but also enhances the generalization ability of the model and ensures its stability and reliability in different scenarios. The more streamlined the feature parameter combination, the higher the generalization ability and computational efficiency of the model, thereby meeting real-time requirements while ensuring detection accuracy.

[0110] Table 2: Different combinations of characteristic parameters

[0111]

[0112] To fully verify the generalization ability of the model, this paper selected three representative datasets for training and testing, including TEXBAT, OAKBAT, and FGISpoofRepo. The specific selections are as follows:

[0113] TEXBAT dataset: ds2 with static high-power time deviation and ds5 with dynamic high-power time deviation are selected to cover the characteristics of deception signals in different scenarios. OAKBAT dataset: os3 scenario is selected. Since the power of the deception signal in the os3 scenario is closest to the real signal and is more difficult to detect, it is used as the key dataset for performance evaluation. FGISpoofRepo dataset: Targeted DFMC deception scenario is selected. This scenario generates deception signals by synchronizing the initial time and position with the real receiver and injecting the latest available ephemeris, which has high practical application value. Through the diversified selection of the above datasets, the present invention aims to comprehensively evaluate the detection performance of the model in different deception scenarios and verify its generalization ability and robustness.

[0114] In order to verify the effectiveness of the traditional hypothesis testing method in the deception detection problem, this paper selects ds2 and ds5 in the TEXBAT dataset as deception data for experiments. In order to reflect the change of detection probability with the deception process, the deception interference data is divided into sub-windows, each window outputs A fixed number of sample points are generated, and each sample point is compared with the detection threshold. By calculating the number of sample points exceeding the threshold and the total number of sample points in the window The detection probability is output once. Each time the detection probability is calculated, the window slides once, and the sliding windows do not overlap. Finally, a series of deception detection probability curves that change over time are output, such as Figure 5 (Note: 0 seconds is the moment of deception injection).

[0115] Depend on Figure 5 (a) and Figure 5 (b) It can be seen that the detection probability of each detection factor in the ds2 scenario is low in the range of 0-25s, and between 100s and 200s. and The factor has a detection probability of approximately 90% and the detection probability curve is relatively smooth, but and The detection probability of the factor is low. The performance of the detection probability in the ds5 scenario is excellent. and Factor, the detection probability is relatively stable in the range of 130s to 200s, while and Factors have poor ability to detect deception.

[0116] As shown in Table 3, the present invention evaluates the accuracy of the Transformer model and the traditional hypothesis testing method in deception detection by comparing and analyzing different satellite data. Figure 6 As shown in the figure, the detection performance of the two methods is compared using the AUC (Area Under Curve) metric. Experiments show that the Transformer model outperforms the hypothesis testing method in detecting spoofing on all six GPS satellites. Even when receiving signals from satellites PRN-06 and PRN-19, where quality is poor, the Transformer model maintains excellent detection performance, maintaining a stable accuracy rate despite fluctuations in signal quality. This result demonstrates the robustness and superiority of the Transformer model in complex spoofing scenarios.

[0117] Table 3: Deception detection probability of Transformer model and hypothesis testing method among different satellites

[0118]

[0119] Table 4: Confusion Matrix

[0120]

[0121] In machine learning, ROC (Receiver Operating Characteristic) and AUC (Area Under the Curve) are important metrics for evaluating the performance of binary classification models. The closer the curve is to the upper left corner, the better the model performance (higher TPR, lower FPR). The confusion matrix is ​​shown in Table 4. TP and TN represent the number of correctly identified spoofed and true samples, respectively. FP represents the number of true samples identified as spoofed, and FN represents the number of spoofed samples identified as true. The true positive rate (TPR) and false positive rate (FPR) are defined as:

[0122] ;

[0123] .

[0124] Figure 7 The ROC curves of the trained model tested on various deception scenarios of different data sets are shown in Figure 2, where: Figure 7(a) is the ROC curve of the deception scene ds2; Figure 7 (b) is the ROC curve of the deception scenario ds5; Figure 7 (c) is the ROC curve of the deception scenario os3; Figure 7 (d) is the ROC curve for the Targeted DFMC deception scenario; it is used to evaluate the classifier performance of the model on different datasets. The specific analysis is as follows:

[0125] 1. Parameter combination and performance comparison:

[0126] Blue, yellow, green, and red correspond to the parameter combinations of cases 1 to 4. In all four deception scenarios, cases 5 to 8 achieved near-100% accuracy, demonstrating that these parameter combinations have high detection performance in specific scenarios.

[0127] exist Figure 7 In (a), case 3 (AUC = 0.97) shows the best performance, which indicates that the distortion of the detection correlation peak plays a significant role in improving the accuracy of spoofing detection.

[0128] exist Figure 7 In (b), the performance of case 4 is better than that of case 1 to case 3, indicating that multi-parameter weighted fusion can effectively realize multi-dimensional feature fusion, reducing the number of training features while improving detection accuracy.

[0129] exist Figure 7 (c) and Figure 7 In (d), the AUC of case 4 is significantly higher than that of case 1 to case 3, further verifying the effectiveness of the multi-parameter weighted fusion mechanism in deception detection.

[0130] 2. Verification of the effect of feature fusion:

[0131] A comparative analysis of the AUC metrics for case 6 and case 7 with case 1, case 2, and case 4 revealed that the AUC value for using multi-parameter weighted fusion features alone did not yet achieve optimal detection performance. However, by integrating Doppler and carrPhase features for feature fusion, perfect classification performance of AUC = 1.0 was achieved in both case 6 and case 7.

[0132] In the four deception scenarios, the AUCs of case 6, case 7, and case 8 all reached 1.0. This result verifies the effectiveness of the multi-parameter weighted feature fusion method proposed in this paper in anti-deception detection, especially in dealing with multi-dimensional collaborative attack scenarios, showing excellent robustness.

[0133] By training the Transformer model and the SVM model in different scenarios, we evaluated their detection performance in various deception scenarios. The specific indicators are shown in Tables 5-8.

[0134] Table 5: Parameter selection comparison and performance evaluation of the Transformer model and SVM model in the TEXBAT-ds2 spoofing scenario

[0135]

[0136] Table 6: Parameter selection comparison and performance evaluation of the Transformer model and SVM model in the TEXBAT-ds5 spoofing scenario

[0137] .

[0138] Table 7: Parameter selection comparison and performance evaluation of the Transformer model and SVM model in the OAKBAT-os3 deception scenario

[0139] .

[0140] Table 8: Parameter selection comparison and performance evaluation of the Transformer model and SVM model in the Targeted DFMC deception scenario

[0141] .

[0142] Reference Figure 10 In the TEXBAT-ds2 and ds5 scenarios, the Transformer model outperformed the SVM model in detection accuracy for cases 1-4. For these two deception scenarios, the optimal parameter combination (cases 5-8) enabled the Transformer model to achieve 100% accuracy, precision, recall, and F1 score, with a 0% false alarm rate and a Cohen's kappa coefficient of 1.00. The SVM model's detection accuracy ranged from 99% to 100%, which was inferior to the Transformer model. Experimental results for the OAKBAT-os3 and Targeted DFMC deception scenarios reached the same conclusion, validating the Transformer model's generalizability across a variety of deception interference scenarios.

[0143] Overall, the experimental results from Cases 5-8 fully demonstrate the Transformer model's excellent adaptability and stability under different feature parameter combinations. Whether it's static or dynamic deception, or complex multi-frequency attacks, the Transformer model demonstrates strong generalization and robustness, and outperforms the SVM model in deception detection.

[0144] In simulation experiments using the TEXBAT-ds2 spoofing scenario, parameter combinations from Case 5 to Case 8 achieved a 100% F1 score (a metric used to evaluate classification model performance), with runtimes ranging from 336.79 to 404.43 seconds (using a 10th-generation Core i7-10510U CPU). This demonstrates that the optimized parameter combinations can achieve excellent detection performance while maintaining a limited computational cost. As shown in Table 5, the Transformer model achieved optimal performance while maintaining the shortest runtime (336.79 seconds) in Case 5, demonstrating a balance between time and performance. In contrast, parameter combinations such as Case 1 and Case 2, despite their shorter runtimes, exhibited significant decreases in F1 scores. Case 8 had the longest runtime (404.43 seconds), reflecting the introduction of the most feature parameters during training. Appropriately increasing the number of features and reducing training time is a necessary trade-off to ensure the model can adapt to complex input environments while maintaining effective detection capabilities.

[0145] In one embodiment, the step S3 of inputting the characteristic sequence into a preset converter model for processing to obtain the analysis result of the GNSS signal to be detected includes:

[0146] S301: Inputting the feature sequence into a preset converter model to map the feature sequence into a continuous vector space, encoding it using sinusoidal positions, and obtaining a feature sequence vector;

[0147] S302: Use a multi-head attention mechanism to process the feature sequence vector and integrate the outputs of each attention head to obtain the analysis result of the GNSS signal to be detected.

[0148] As described in steps S301-S302 above, the Transformer model consists of two main components: Encoder and Decoder. In one embodiment of the present invention, the encoder module of the Transformer model is used to detect spoofing signals. Each layer contains the following core modules:

[0149] (1) Input Embedding & Positional Encoding

[0150]

[0151] in Using sinusoidal position encoding: , , Represents the embedding of the input vector.

[0152] Represents the embedding dimension of the model, that is, the dimension of each position encoding vector. and It is used to alternately generate sine and cosine values, ensuring that adjacent dimensions of each position-encoded vector have complementary properties. Input embedding maps discrete satellite signal characteristics, such as carrier phase, Doppler shift, signal-to-noise ratio, and correlator output, into a continuous vector space. Since satellite signals have strict time series characteristics, the presence of spoofing signals can manifest as time synchronization anomalies. Position encoding preserves signal timing characteristics and captures anomalies in signal temporal coherence, such as timestamp jumps in spoofing signals.

[0153] (2) Multi-head self-attention mechanism

[0154]

[0155]

[0156]

[0157] Where, the query vector in the attention mechanism ( ), key vector ( ) and the value vector ( ) are obtained by performing a linear transformation on the input sequence. and The similarity score is calculated by dot product, and then normalized to prevent the dot product from being too large and causing the gradient to disappear. Finally, the weight is used to calculate the similarity score. Perform weighted summation to obtain the attention output. By using multiple independent Module, which enables the model to establish global feature associations, analyze the mutual influence of different time signal features, and learn diverse feature representations from different subspaces. Representative The trainable parameter matrix of the attention heads, It is the output projection matrix that integrates the outputs of multiple attention heads.

[0158] (3) Residual Connection & Layer Normalization

[0159]

[0160] Residual connections prevent vanishing or exploding gradients, while also preventing deep networks from losing subtle deceptive features, such as subtle distortions of low-power deceptive signals. In each sublayer of the Transformer model, the input is directly added to the output via a residual connection, allowing the network to more easily learn the difference between input and output, ensuring that the model's performance during training is no less than that of the original model. Finally, the samples are subjected to layer normalization.

[0161] (4) Feedforward Neural Network

[0162]

[0163] In the formula, the features are mapped to high-dimensional space and The activation function enhances the model's expressiveness, captures high-order nonlinear deception features, separates the distribution of real satellite signals and deception signals in the feature space, and finally maps the features back to the original dimension.

[0164] (5) Stacked encoder layers

[0165]

[0166] Here, the shallow network is used to extract local temporal patterns, while the deep network is used to integrate global contextual information.

[0167] In one embodiment, before step S3 of inputting the characteristic sequence into a preset converter model for processing to obtain the analysis result of the GNSS signal to be detected, the method further includes:

[0168] S211: Retrieving a specified amount of signal data from a preset signal database, and dividing the signal data into training signal data and verification signal data according to a preset ratio, wherein the signal data comprises a GNSS signal and an artificial identifier corresponding to the GNSS signal, the artificial identifier indicating whether the signal is a spoofed signal or not;

[0169] S212: Inputting the training signal data into a preset transformer initial encoder for training, thereby obtaining a transformer temporary encoder;

[0170] S213: Verifying the temporary encoder of the converter using the verification signal data to obtain a verification result, and determining whether the verification result is verification passed;

[0171] S214: If the verification result is passed, the transformer temporary encoder is recorded as a preset transformer model.

[0172] As described in steps S211-S214 above, a preset signal database can be pre-established, containing samples of various types of GNSS signals, including normal signals and signals with spoofing interference. The signal data is divided into two parts according to a preset ratio (e.g., 80% for training and 20% for validation). Ensure that each part contains sufficient normal and spoofed signal samples to ensure the generalization capability of the model. The training signal data is then fed into the initial encoder of the designed converter model. This encoder processes the input signal data features, extracts valid information, and gradually optimizes the model parameters using a backpropagation algorithm using an appropriate loss function (e.g., cross-entropy loss). The validation signal data is then input into the converter's temporary encoder for testing. If the validation result is positive, the converter's temporary encoder is recorded as the preset converter model. It should be noted that since the converter model preset in the aforementioned steps analyzes feature sequences, the input layer of the preset converter model must be configured to extract features from GNSS signals. In one embodiment, the signal data may also be composed of a feature sequence and an artificial identifier corresponding to the feature sequence. The training method is the same as the training method of the above-mentioned GNSS signal. After the training is completed, the feature sequence of the GNSS signal to be detected can be extracted in advance and then input into the model to obtain the analysis results.

[0173] To address the poor adaptability of traditional hypothesis testing and single-feature parameter detection methods, this paper proposes a GNSS spoofing jamming detection method based on Transformer multi-parameter weighted fusion. First, the SQM indicator and carrier-to-noise ratio features extracted during the tracking phase are subjected to sliding window processing using a moving mean and moving variance, as well as multi-feature weighted fusion to enhance the feature representation capability. Second, the processed feature parameters are trained using a Transformer model capable of capturing anomaly patterns in time series. This multi-parameter weighted fusion mechanism not only improves the model's sensitivity to features but also accelerates model training. Experimental results demonstrate that the proposed method outperforms traditional single-parameter detection and hypothesis testing methods in overall detection performance. On three spoofing datasets, TEXBAT, OAKBAT, and FGISpoofRepo, the proposed method achieves high detection accuracy and F1-score, while maintaining a low false alarm rate and high generalization capability. This further validates the method's effectiveness and robustness in diverse spoofing jamming scenarios.

[0174] Reference Figure 8 The present invention also provides a GNSS deception interference detection device, comprising:

[0175] An input module 10 is configured to input a GNSS signal to be detected into a GNSS software receiver to obtain an advanced output, an immediate output, and a delayed output of a correlator in the GNSS software receiver;

[0176] A calculation module 20 is configured to calculate a characteristic sequence based on the leading output, the immediate output, and the lagging output according to a preset algorithm;

[0177] The processing module 30 is configured to input the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected.

[0178] Other embodiments of the GNSS spoofing interference detection device provided by the present invention are the same as the above-mentioned GNSS spoofing interference detection method and will not be repeated here.

[0179] The present invention achieves the following beneficial effects: By inputting the GNSS signal to be detected into a GNSS software receiver, the advanced output, immediate output, and delayed output of the correlator in the GNSS software receiver are obtained, a characteristic sequence is calculated, and this characteristic sequence is input into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected. Compared with traditional detection methods and SVM-based model detection methods, this method improves overall detection performance while maintaining a low false alarm rate and high generalization capability, and enhances effectiveness and robustness in diverse deceptive jamming scenarios.

[0180] Reference Figure 9 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 9 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store various GNSS signals, etc. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it can implement the GNSS deception interference detection method described in any of the above embodiments.

[0181] Those skilled in the art will understand that Figure 9 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0182] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the GNSS spoofing interference detection method described in any of the above embodiments can be implemented.

[0183] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware using a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media provided herein and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).

[0184] It should be noted that, in the present invention, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, apparatus, article, or method comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, apparatus, article, or method. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, apparatus, article, or method comprising the element.

[0185] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of the claims.

Claims

1. A GNSS spoofing interference detection method, characterized in that: include: Inputting the GNSS signal to be detected into a GNSS software receiver to obtain an advanced output, an immediate output, and a delayed output of a correlator in the GNSS software receiver; Based on the leading output, the immediate output and the lagging output, a characteristic sequence is calculated according to a preset algorithm; Inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected; The step of inputting the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected includes: Inputting the feature sequence into a preset transformer model to map the feature sequence into a continuous vector space, encoding it using sinusoidal positions, and obtaining a feature sequence vector; Using a multi-head attention mechanism to process the feature sequence vector and integrating the outputs of each attention head to obtain the analysis result of the GNSS signal to be detected; The step of calculating a characteristic sequence based on the leading output, the immediate output, and the lagging output according to a preset algorithm comprises: Calculate each characteristic subsequence according to the formula: and Doppler frequency With carrier phase ;in, 、 、 are respectively the leading, immediate and lagging outputs of the in-phase branch of the correlator, is the carrier-to-noise ratio, and are the leading and lagging outputs of the orthogonal branches of the correlator, respectively, where Indicates the window moving step size, is the selected window length; The characteristic sequence is calculated according to any of the following formulas 。 2. The GNSS deception interference detection method according to claim 1, wherein: Before the step of inputting the characteristic sequence into a preset converter model for processing to obtain the analysis result of the GNSS signal to be detected, the method further includes: Retrieving a specified amount of signal data from a preset signal database and dividing the signal data into training signal data and verification signal data according to a preset ratio; wherein the signal data comprises a GNSS signal and an artificial identifier corresponding to the GNSS signal, the artificial identifier indicating whether the signal is a spoofed signal or not; Inputting the training signal data into a preset transformer initial encoder for training, thereby obtaining a transformer temporary encoder; Verifying the temporary encoder of the converter using the verification signal data to obtain a verification result, and determining whether the verification result is verification passed; If the verification result is that the verification is passed, the converter temporary encoder is recorded as the preset converter model.

3. A GNSS spoofing interference detection device, characterized in that: include: An input module, configured to input a GNSS signal to be detected into a GNSS software receiver to obtain an advanced output, an immediate output, and a delayed output of a correlator in the GNSS software receiver; A calculation module, configured to calculate a characteristic sequence based on the leading output, the immediate output, and the lagging output according to a preset algorithm; a processing module, configured to input the characteristic sequence into a preset converter model for processing to obtain an analysis result of the GNSS signal to be detected; The processing module includes: An input submodule, configured to input the feature sequence into a preset converter model to map the feature sequence into a continuous vector space, encode the feature sequence using sinusoidal positions, and obtain a feature sequence vector; A processing submodule, configured to process the feature sequence vector using a multi-head attention mechanism and integrate the outputs of each attention head to obtain an analysis result of the GNSS signal to be detected; The computing module includes: Calculate each characteristic subsequence according to the formula: and Doppler frequency With carrier phase ;in, 、 、 are respectively the leading, immediate and lagging outputs of the in-phase branch of the correlator, is the carrier-to-noise ratio, and are the leading and lagging outputs of the orthogonal branches of the correlator, respectively, where Indicates the window moving step size, is the selected window length; The characteristic sequence is calculated according to any of the following formulas 。 4. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 2 are implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

Images