Rapid deception detection algorithm based on self-correlation amplitude

Abstract

The invention discloses a fast deception detection algorithm based on an autocorrelation amplitude. The fast deception detection algorithm comprises the following steps: step 1, carrying out data preprocessing on an ACF output by a DLL to generate a sample; 2, inputting the real signal and the deception signal into an LSTM network for model training; and step 3, carrying out deception detection by using the trained LSTM network. According to the method of the invention, detection can be carried out without a large number of samples when deception detection is carried out based on a deep learning method, and rapid detection can be realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of GNSS spoofing detection, and in particular relates to a fast spoofing detection algorithm based on autocorrelation amplitude. Background Art

[0002] SQM (Signal Quality Monitoring) methods are a widely studied class of GNSS spoofing detection methods. They exploit the asymmetry or distortion of the tracking loop correlation values of a spoofed receiver for spoofing detection. Ratio, Delta, and ELP were the three original SQM metrics proposed. These metrics are constructed using the outputs of the E, P, and L correlators in the I and Q branches. However, they can only detect the deflection phase of the spoofed signal, resulting in a low detection rate. This is because the constructed metrics ignore the amplitude variation of the autocorrelation function (ACF) during calculation, and using only three correlators cannot fully extract the distortion information of the ACF in the DLL. To address this issue, SQM methods that add tracking loop correlators to better extract ACF distortion information have been widely studied. Methods based on weighted double ratio metrics use the outputs of two pairs of correlators in the I and Q channels to construct a test metric. This retains the ACF amplitude information during calculation, significantly improving detection coverage and accuracy. The detection method based on the Weighted Second-Order Central Moments metric constructs a test metric called WSCM using five pairs of correlator outputs, the left and right peaks of the I and Q channel correlation peaks. This method can more fully address the ACF distortion caused by the presence of spoofing signals, further improving the accuracy of spoofing detection. In addition to innovations in the SQM metric, good detection results can also be achieved through different test methods. Currently, there is a method that uses a heat map to represent the ACF, and calculates the difference between the heat map of the received signal and the heat map of the true signal to achieve spoofing detection. Another literature proposes a method that uses the KS test to calculate the similarity between the ACF of the received signal and the true signal to achieve spoofing detection. The latest SQM method can achieve a detection accuracy of over 95% on the TEXBAT dataset.

[0003] The process of deceptive signal intrusion into the tracking loop is very short, completing within 5ms. However, current SQM methods share a common problem: they are all based on statistical analysis, which requires a long detection window and a large number of samples to achieve good detection performance. This makes current deception detection algorithms unable to achieve rapid deception detection results. Summary of the Invention

[0004] In view of this, the present invention provides a fast deception detection algorithm based on autocorrelation amplitude, which can achieve fast detection without requiring a large number of samples when performing deception detection based on a deep learning method.

[0005] The technical solutions for implementing the present invention are as follows:

[0006] A fast deception detection algorithm based on autocorrelation amplitude includes the following steps:

[0007] Step 1: Preprocess the ACF output by DLL to generate samples;

[0008] Step 2: Input the real signal and the deceptive signal into the LSTM network for model training;

[0009] Step 3: Use the trained LSTM network for deception detection.

[0010] Furthermore, when generating samples, a 5ms detection window is used for spoofing detection. That is, 5ms ACF values are concatenated to perform spoofing detection. This can ensure that the presence of spoofing signals is detected in a timely manner when spoofing occurs and avoid the misjudgment problem that may occur due to only using the ACF output amplitude once.

[0011] Furthermore, the OAKBAT dataset is used as the training and validation sets in model training, and the TEXBAT dataset is used as the test set to evaluate the detection performance.

[0012] Furthermore, when training the model, RTX 4090GRU was used for training based on the KERAS framework. In order to avoid overfitting during training, EarlyStopping and ReduceLROnPlateau were used to control the iteration process.

[0013] Furthermore, the sample to be tested is input into the trained LSTM network, and the network will output 0 or 1, 0 corresponds to the real signal, and 1 corresponds to the deceptive signal.

[0014] Beneficial effects:

[0015] 1. The method of the present invention uses the 5ms correlator output value for deception detection, eliminating the need for additional detection indicator design and detection threshold calculation. By leveraging the efficient time series signal processing capabilities of the LSTM network, deception detection can be effectively achieved based on the ACF amplitude.

[0016] 2. The method of the present invention can realize rapid detection of correlation peak distortion caused by spoofing signals, especially for high-power spoofing, and can achieve a detection accuracy of 99%.

[0017] 3. The method of the present invention can achieve rapid deception detection within 5ms. When deception occurs, this method can quickly detect the occurrence of deception and issue an early warning. Compared with existing methods, this method can simultaneously achieve rapid early warning and high detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Schematic diagram of real signal samples and deceptive signal samples before and after data deception occurs in the public dataset TEXBAT ds 2.

[0019] Figure 2 Schematic diagram of the network model of the method of the present invention.

[0020] Figure 3 This is the time domain detection result of the LSTM-Detec model on ds2 in an embodiment of the present invention.

[0021] Figure 4 The embodiment of the present invention detects the occurrence of spoofing at 119,705 milliseconds.

[0022] Figure 5 The embodiment of the present invention detects the occurrence of spoofing at 113,985 milliseconds.

[0023] Figure 6 This is the time domain detection result of the embodiment of the present invention on the data set ds5.

[0024] Figure 7 This is the time domain detection result of the embodiment of the present invention on the data set ds6. DETAILED DESCRIPTION

[0025] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0026] The present invention provides a fast deception detection algorithm based on autocorrelation amplitude, comprising the following steps:

[0027] Step 1: Preprocess the data and generate a sample data set

[0028] In order to facilitate the LSTM network to better learn the ACF amplitude distortion characteristics, it is necessary to perform data preprocessing on the ACF. The specific steps are as follows:

[0029] To reduce the noise floor of the input data and highlight the amplitude of the 0-chip delay correlator output, the following operations are performed on the input data:

[0030]

[0031] Among them, ACFNormal k (t) refers to the ACF amplitude after data preprocessing at time t. k(t) refers to the ACF amplitude when the code phase is delayed by * chips at time t, σ(ACF * ) refers to its standard deviation, which can also be solved by the real navigation signal received by the receiver over a long period of time. based (ACF * ) refers to the average ACF amplitude value when the code phase delay is * chips when the receiver receives the real signal. This value can be solved by the real navigation signal received by the receiver over a long period of time. The value of * ranges from -2 chips to 2 chips.

[0032] Sample_f is the sampling frequency of the signal. k represents the power ratio, which is the power ratio of the signal received by the receiver to the signal used during network training. This first step scales the ACF amplitude to the same level as the ACF amplitude of the signal used for LSTM network training.

[0033] When generating samples, the present invention uses a 5ms detection window for deception detection, that is, 5ms ACF values are connected in series to perform deception detection. This can ensure that the existence of deception signals is detected in a timely manner when deception occurs and avoid the misjudgment problem that may occur due to only using the ACF output amplitude once, thereby improving the detection accuracy. Figure 1 A schematic diagram of real signal samples and deceptive signal samples before and after data deception occurs in the public dataset TEXBAT ds 2 is shown.

[0034] Step 2: Model training

[0035] The model uses the OAKBAT dataset as training and validation sets, and the TEXBAT dataset as a test set to evaluate detection performance. The TEXBAT dataset is provided by the Radio Navigation Laboratory at the University of Texas at Austin and contains six datasets (dataset1-dataset6, abbreviated as ds1-ds6) under different spoofing attacks in real attack scenarios.

[0036] Use real signals and deceptive signals to train the constructed LSTM network. The network model diagram is as follows Figure 2 As shown, during model training, we used the RTX 4090 GRU based on the KERAS framework. To avoid overfitting during training, we employed EarlyStopping and ReduceLROnPlateau to control the iteration process. The network model parameters are shown in Table 1. After repeated experiments, we found that the optimal detection results were achieved when the number of nodes in the two LSTM layers was set to 64 and 32, respectively.

[0037] Table 1 Network model parameters

[0038]

[0039] Step 3: Deception Detection

[0040] After performing the first two steps on the ACF of the signal to be tested, the sample to be tested is obtained. The sample to be tested is sent to the LSTM network trained in step 2. The network will output 0 or 1, 0 corresponds to the real signal, and 1 corresponds to the deceptive signal.

[0041] Method validation

[0042] The performance evaluation of the model in this embodiment focuses on the TEXBAT ds2-ds6 datasets. ds2-ds4 represent static deception scenarios, while ds5-ds6 represent dynamic deception scenarios. These comprehensive datasets cover all common possible deception scenarios and are an effective means of validating the detection performance of the proposed method.

[0043] Figure 3 The following figure shows the time-domain detection results of the LSTM-Detect model on ds2. Clearly, when there is no spoofing signal, the LSTM-Detect model outputs a value of 0. However, after the 22,026th detection sample, the output transitions to 1, indicating successful detection of spoofing at 22,026*5=110,130 milliseconds, with a response time of 5 milliseconds.

[0044] Figure 4 The data shows that spoofing was detected at 119,705 milliseconds (calculated as 23941*5). The results show that spoofing signals can be detected within 5 milliseconds. However, before the spoofing occurs, there are 34 false positive points that mistake the true signal for spoofing. This is because the thermal noise level at these points is relatively high and their autocorrelation function (ACF) is different from that of the true signal, causing the LSTM-Detect model to misdiagnose them as spoofing signals.

[0045] Figure 5 The method was shown to detect spoofing at 22,797*5=113,985 milliseconds, with a response time of 3 milliseconds. However, the model failed to achieve accurate detection between 200-210 seconds because the spoofed signal was similar in power to the real signal, making it difficult for the model to accurately distinguish between the spoofed and real signals.

[0046] Figure 6 This method demonstrates time-domain detection results on dataset ds5. The spoof signal was detected at 20,446*5=102,230 milliseconds, with a response time of 3 milliseconds. Similar to ds2, after high-power spoofing, the detection rate of the spoofed signal was 100%. However, before the spoofing occurred, some genuine signals were misclassified as spoofed signals due to the dynamic nature of the receiver and the high thermal noise.

[0047] Figure 7The time-domain detection results of the proposed method on dataset ds6 are shown. Spoofing is detected at 20,876*5=104,380 milliseconds, with a response time of 5 milliseconds. It can be observed that compared to static spoofing scenarios, more genuine signals are misdetected as spoofing signals in dynamic spoofing scenarios. This is because the receiver is in motion and is more susceptible to multipath and thermal noise, which leads to distortion in the autocorrelation function (ACF).

[0048] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A fast deception detection algorithm based on autocorrelation amplitude, characterized in that: The following steps are involved: Step 1: Preprocess the ACF output by DLL to generate samples; Step 2: Input the real signal and the deceptive signal into the LSTM network for model training; Step 3: Use the trained LSTM network for deception detection.

2. The fast deception detection algorithm according to claim 1, wherein: When generating samples, a 5ms detection window is used for spoofing detection. That is, 5ms ACF values are concatenated to perform spoofing detection. This can ensure that the presence of spoofing signals is detected in a timely manner when spoofing occurs and avoid the misjudgment problem that may occur by using only the ACF output amplitude once.

3. The fast deception detection algorithm according to claim 2, wherein: The OAKBAT dataset is used as the training and validation sets in model training, and the TEXBAT dataset is used as the test set to evaluate the detection performance.

4. The fast deception detection algorithm according to claim 2 or 3, wherein: During model training, based on the KERAS framework, RTX 4090GRU was used for training. To avoid overfitting during training, EarlyStopping and ReduceLROnPlateau were used to control the iteration process.

5. The fast deception detection algorithm according to claim 1, wherein: The sample to be tested is input into the trained LSTM network, and the network will output 0 or 1, 0 corresponds to the real signal, and 1 corresponds to the deceptive signal.

Images