GNSS deception detection method, device and equipment based on LSTM-Transformer model and medium

Abstract

The invention discloses a GNSS deception detection method and device based on an LSTM-Transformer model, equipment and a medium, and relates to the technical field of satellite navigation, and the method comprises the steps: building a GNSS receiver tracking loop multi-correlator structure, obtaining a correlator output sequence under multi-code phase offset, calculating an autocorrelation function amplitude sequence, and obtaining a GNSS deception detection result; and inputting a double-branch time sequence model containing an LSTM branch, a Transform branch, a cross attention fusion module and a deception detection classification module, and outputting a deception detection result through feature extraction, fusion and classification discrimination. The generalization and the accuracy of GNSS deception detection in a complex scene are enhanced by fully capturing distortion and time sequence characteristics of an autocorrelation function and fusing the advantages of double models.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of satellite navigation technology, in particular to a GNSS spoofing detection method and device based on an LSTM-Transformer model, equipment and medium. BACKGROUND

[0002] The existing GNSS spoofing detection methods are mainly divided into three categories: the first category is based on signal power characteristics, ranging consistency or correlation function form to construct a detection quantity, and determines whether the spoofing signal exists through a statistical threshold; the second category is based on array signal processing technology, uses the spatial characteristics of multiple antennas to determine the signal wave direction, and compares the differences to identify spoofing; the third category is based on multi-source information fusion technology, combines inertial navigation, visual navigation and other device data with GNSS positioning results for space-time consistency verification. With the development of deep learning technology, time sequence models such as LSTM and Transformer are gradually applied to this field. Some schemes use a single LSTM or Transformer model to combine the detection quantities output by the three correlator structure for spoofing detection, trying to improve the detection performance by mining time sequence characteristics.

[0003] The existing technology has obvious limitations: on the one hand, the traditional three-correlator structure is not sufficient to capture the distortion of the autocorrelation function (ACF) under the action of the spoofing signal, the utilization rate of the detection quantity information is low, and it is difficult to reflect the differences between true and false signals in detail; on the other hand, the existing deep learning schemes mostly rely on a single model, and do not fully combine the advantages of different models. Although LSTM is good at processing long sequence local dependence, it is not good at capturing global time sequence correlation, and although Transformer can capture global features, it has a short board in modeling local time sequence dependence.

[0004] Therefore, how to combine the advantages of different models to realize the deep fusion of local and global features and improve the accuracy and generalization of GNSS spoofing detection in complex scenarios has become a problem to be solved. SUMMARY

[0005] The main purpose of the present application is to provide a GNSS spoofing detection method, device and equipment based on an LSTM-Transformer model, and medium, aiming to solve the technical problem of how to improve the accuracy and generalization of GNSS spoofing detection in complex scenarios.

[0006] To achieve the above purpose, the present application provides a GNSS spoofing detection method based on an LSTM-Transformer model, comprising: constructing a multi-correlator structure in the GNSS receiver tracking loop, and obtaining a correlator output sequence under multiple code phase offsets; The autocorrelation function magnitude sequence is obtained by calculating based on the output sequence of the correlator. The autocorrelation function magnitude sequence is input into the LSTM-Transformer dual-branch time series model for processing to obtain the deception detection result. The LSTM-Transformer dual-branch time series model includes an LSTM branch, a Transformer branch, a cross-attention fusion module, and a deception detection classification module. The LSTM branch includes two layers of long short-term memory network, a Dropout layer, and an average pooling layer. The Transformer branch includes two layers of encoder and an attention pooling layer. The encoder includes, in sequence, a multi-head self-attention layer, a residual connection and a layer normalization layer, a feedforward neural network layer, and a residual connection and a layer normalization layer. The deception detection classification module includes, in sequence, a fully connected layer, a ReLU activation function layer, a Dropout layer, and a fully connected layer. The step of inputting the autocorrelation function amplitude sequence into an LSTM-Transformer dual-branch time series model for processing to obtain the deception detection result includes: Based on the autocorrelation function magnitude sequence, the features are extracted by inputting them into the LSTM branch and the Transformer branch respectively to obtain the first time-series feature and the second time-series feature. The first temporal feature and the second temporal feature are fused using a cross-attention fusion module to obtain a fused feature; The fused features are then detected by the deception detection and classification module to obtain the deception detection results.

[0007] In one embodiment, the step of constructing a multi-correlator structure in the GNSS receiver tracking loop and obtaining correlator output sequences under multiple code phase offsets includes: Based on the autocorrelation function characteristics of GNSS signals, multiple sets of correlators are uniformly set within the range of two chips to the left and right of the instantaneous code, according to a preset step size, to construct a multi-correlator array covering the effective code phase offset range. The multi-correlator array includes an instantaneous correlator, a leading correlator group, and a lagging correlator group. A control command is sent to the GNSS receiver so that the GNSS receiver tracking loop decomposes the received mixed signal into in-phase branch signals and quadrature branch signals after frequency mixing, and inputs the in-phase branch signals and the quadrature branch signals into the multicorrelator array; The in-phase branch signal and the quadrature branch signal are correlated with local codes with different code phase offsets by each group of correlators in the multi-correlator array, and the coherent integration operation is completed within a preset coherent integration time to obtain the coherent integration output of the in-phase correlation result and the coherent integration output of the quadrature correlation result corresponding to each group of correlators. The results are combined to obtain the initial output value corresponding to each group of correlators. The initial output values ​​of all correlators are sorted according to a preset order to obtain a correlator output sequence corresponding to multiple code phase offsets, wherein the preset order is the sequential order of the leading correlator group, the instantaneous correlator, and the lagging correlator group.

[0008] In one embodiment, the step of calculating the autocorrelation function magnitude sequence based on the correlator output sequence includes: Extract the in-phase branch output component and quadrature branch output component corresponding to each group of correlators from the correlator output sequence under multiple code phase offsets; Based on the square root algorithm, the output components of the in-phase branch and the output components of the quadrature branch corresponding to each code phase offset are incoherently synthesized to obtain the initial autocorrelation amplitude. The initial autocorrelation amplitude of different samples is filtered in the time dimension using a convolutional moving average processing algorithm to suppress noise and reduce local fluctuations, resulting in filtered autocorrelation amplitudes. The filtering operation is to smooth the autocorrelation function amplitude sequence in time through the convolution operation of the sliding window and the averaging kernel. The filtered autocorrelation amplitudes are sequence-normalized according to a preset order to obtain an autocorrelation function amplitude sequence corresponding to the multicorrelation array layout, wherein the preset order is the sequential order of the leading correlation group, the instantaneous correlation group, and the lagging correlation group.

[0009] In one embodiment, the step of extracting features by inputting the autocorrelation function magnitude sequence into the LSTM branch and the Transformer branch respectively to obtain the first time-series features and the second time-series features includes: The autocorrelation function amplitude sequence is subjected to time-series segmentation processing, and multiple continuous subsequences are divided according to a preset time interval, wherein each subsequence includes a preset number of autocorrelation amplitude data points; Each subsequence is input into the first layer of the LSTM branch of the Long Short-Term Memory network. The local temporal dependencies within the subsequences are captured through a gating mechanism to obtain local dependency features. The local dependency features are input into the second layer of the LSTM branch of the Long Short-Term Memory network to model temporal associations on a longer time scale and obtain long-term association features. After overfitting is suppressed by the Dropout layer, the long-term correlation features are compressed in dimension and aggregated by the average pooling layer to obtain the first temporal features.

[0010] In one embodiment, the step of extracting features by inputting the autocorrelation function magnitude sequence into the LSTM branch and the Transformer branch respectively to obtain the first time-series features and the second time-series features further includes: The autocorrelation function amplitude sequence is subjected to position encoding processing, and time-series position information is added to each autocorrelation amplitude data point to generate a sequence with position tags; The position-marked sequence is input into the first layer encoder of the Transformer branch. The global temporal correlation between different positions in the sequence is modeled in parallel through a multi-head self-attention layer. After processing by residual connections, layer normalization, and feedforward neural network layers, the initial global features are output. The initial global features are input into the second layer encoder of the Transformer branch to further model global temporal correlations and enhance feature representation capabilities, resulting in deep global features. The deep global features are weighted and aggregated by an attention pooling layer to obtain the second temporal features.

[0011] In one embodiment, the step of fusing the first temporal feature and the second temporal feature through a cross-attention fusion module to obtain the fused feature includes: The first temporal feature and the second temporal feature are subjected to dimensionality unification processing to obtain the standardized first feature and the standardized second feature; The standardized first feature is used as the query vector, and the standardized second feature is used as the key vector and value vector, respectively. The query vector, key vector, and value vector are input into the attention calculation unit of the cross-attention fusion module, and the relevance weights between the query vector and the key vector are calculated through scaling dot product operation. The value vector is weighted and summed based on the correlation weights to obtain the initial fusion features; The initial fused feature is residually connected to the standardized first feature and then subjected to layer normalization to obtain the intermediate fused feature; The intermediate fusion features are dynamically balanced by gating adjustment coefficients to determine the contributions of local temporal dependency features and global temporal correlation features, and then the fusion features are output.

[0012] In one embodiment, the step of detecting the fused features through a deception detection classification module to obtain a deception detection result includes: The fused features are input into the first fully connected layer of the deception detection and classification module, and the features are mapped according to a preset dimension through a learnable weight matrix to obtain an intermediate feature representation for classification and discrimination. The intermediate discriminant features are input into the ReLU activation function layer, and effective feature information is filtered through nonlinear activation operations to obtain the activated features. The activated features are input into the Dropout layer and some neuron nodes are randomly masked according to a preset dropout probability to obtain regularized features. The regularized features are input into the second fully connected layer to obtain the corresponding classification score, and the classification score is mapped to the probability of normal signal category and the probability of deception signal category through the softmax classification function. By comparing the probability of the normal signal category with the probability of the deception signal category, the category with the larger probability value is used as the judgment result, and the corresponding deception detection result is output.

[0013] Furthermore, to achieve the above objectives, this application also proposes a GNSS spoofing detection device based on the LSTM-Transformer model, wherein the GNSS spoofing detection device based on the LSTM-Transformer model includes: The acquisition module is used to construct the multicorrelator structure in the GNSS receiver tracking loop and acquire the correlator output sequences under multiple code phase offsets; The calculation module is used to calculate the autocorrelation function magnitude sequence based on the output sequence of the correlator. The result module is used to input the autocorrelation function amplitude sequence into the LSTM-Transformer dual-branch temporal model for processing to obtain the deception detection result. The LSTM-Transformer dual-branch temporal model includes an LSTM branch, a Transformer branch, a cross-attention fusion module, and a deception detection classification module. The LSTM branch includes two layers of Long Short-Term Memory (LSTM) network, a Dropout layer, and an average pooling layer. The Transformer branch includes two layers of encoder and an attention pooling layer. The encoder sequentially includes a multi-head self-attention layer, a residual connection and layer normalization layer, a feedforward neural network layer, and a residual connection and layer normalization layer. The deception detection classification module sequentially includes a fully connected layer, a ReLU activation function layer, a Dropout layer, and a fully connected layer. The module is also used to extract features from the LSTM branch and Transformer branch respectively, obtaining a first temporal feature and a second temporal feature. The first temporal feature and the second temporal feature are fused through the cross-attention fusion module to obtain a fused feature. The fused feature is then detected by the deception detection classification module to obtain the deception detection result.

[0014] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the GNSS spoofing detection method based on the LSTM-Transformer model described above.

[0015] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the GNSS spoofing detection method based on the LSTM-Transformer model described above.

[0016] This application constructs a multi-correlator structure for the tracking loop of a GNSS receiver, obtains the correlator output sequence under multi-code phase offset, calculates the autocorrelation function amplitude sequence, and inputs it into a dual-branch time-series model containing an LSTM branch, a Transformer branch, a cross-attention fusion module, and a deception detection classification module. After feature extraction, fusion, and classification, the deception detection result is output. By fully capturing the autocorrelation function distortion and time-series features and combining the advantages of the dual models, the generalization and accuracy of GNSS deception detection in complex scenarios are enhanced. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the first embodiment of the GNSS spoofing detection method based on the LSTM-Transformer model of this application. Figure 2 This is a schematic diagram of the confusion matrix result of the LSTM-Transformer model when multiple detection quantities are used as input in the first embodiment of the GNSS spoofing detection method based on the LSTM-Transformer model of this application. Figure 3 This is a schematic diagram of the confusion matrix result of the LSTM-Transformer model when the ACF value of the multiple correlator is used as input in the first embodiment of the GNSS spoofing detection method based on the LSTM-Transformer model of this application. Figure 4 This is a flowchart illustrating the second embodiment of the GNSS spoofing detection method based on the LSTM-Transformer model of this application; Figure 5 This is a schematic diagram of the module structure of the GNSS spoofing detection device based on the LSTM-Transformer model, which is the first embodiment of the GNSS spoofing detection method based on the LSTM-Transformer model of this application. Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the GNSS spoofing detection method based on the LSTM-Transformer model in the embodiments of this application.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] Existing GNSS spoofing detection methods are mainly divided into three categories: The first category constructs detection quantities based on signal power characteristics, ranging consistency, or correlation function shape, and determines the existence of spoofing signals through statistical thresholds; the second category is based on array signal processing technology, using the spatial characteristics of multiple antennas to determine the direction of signal arrival, and comparing differences to identify spoofing; the third category is based on multi-source information fusion technology, combining data from inertial navigation, visual navigation, and other equipment with GNSS positioning results for spatiotemporal consistency verification. With the development of deep learning technology, temporal models such as Long Short-Term Memory (LSTM) networks and Transformers are gradually being applied to this field. Some solutions use a single LSTM or Transformer model, combined with the detection quantities output by a three-correlator structure, to perform spoofing detection, attempting to improve detection performance by mining temporal features. Existing technologies have significant limitations: on the one hand, traditional three-correlator structures do not adequately capture the distortion of the autocorrelation function (ACF) under the influence of deceptive signals, resulting in low utilization of detection information and difficulty in accurately reflecting the differences between genuine and fake signals; on the other hand, existing deep learning solutions mostly rely on a single model and do not fully combine the advantages of different models. While LSTM excels at handling long-sequence local dependencies, it lacks the ability to capture global temporal correlations, and while Transformer can capture global features, it has shortcomings in modeling local temporal dependencies. Therefore, this application proposes a GNSS deception detection method based on the LSTM-Transformer model to improve the accuracy and generalization of GNSS deception detection in complex scenarios.

[0023] Based on the above, this application also provides a GNSS spoofing detection method based on the LSTM-Transformer model, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the GNSS spoofing detection method based on the LSTM-Transformer model of this application.

[0024] In this embodiment, the GNSS spoofing detection method based on the LSTM-Transformer model includes steps S10 to S30: Step S10: Construct the multi-correlator structure in the GNSS receiver tracking loop, and obtain the correlator output sequences under multiple code phase offsets based on the mixed signal containing the real satellite signal, spoof signal and noise.

[0025] It should be noted that a mixed signal refers to a composite signal received by the receiver that includes the real satellite signal, the spoofing signal, and noise. The spoofing signal has a structure similar to the real satellite signal and can interfere with the normal operation of the receiver. When spoofing is present, the signal received by the receiver can be represented as: in, Represents the actual satellite signal. This indicates a deception signal. This represents a noise signal. As can be seen from the principle of deceptive interference, and With similar structures, they can be represented as follows: in, The carrier frequency of the actual satellite signal. This represents the actual power of the satellite signal. The pseudo-random spreading code is the actual satellite signal. Navigation message data based on actual satellite signals. The code delay is the actual signal delay from the satellite. This represents the Doppler frequency shift of the actual satellite signal. The carrier phase of the actual satellite signal; To deceive the power of the signal, The pseudo-random spreading code is used to deceive the signal. Navigation message data used to deceive signals, To delay the code of the deception signal, To deceive the signal through Doppler frequency shift, The carrier phase of the deception signal. Code phase offset refers to the phase difference between the pseudo-random spreading code of the received signal and the pseudo-random spreading code generated locally by the receiver. Different code phase offsets correspond to different delays during signal propagation. In this embodiment, a multi-correlator structure is constructed by setting local codes (leading code, instantaneous code, and lag code) with different code phase offsets, so that the composite signal is correlated with the local codes with different code phase offsets, thereby obtaining discrete sampled values ​​equivalent to the autocorrelation function.

[0026] Further, step S10 includes: First, to accurately characterize the distortion characteristics of the autocorrelation function under deception interference, based on the autocorrelation function characteristics of the GNSS signal, multiple sets of correlators are uniformly set within the range of two chips to the left and right of the instantaneous code, according to a preset step size, to construct a multi-correlator array covering the effective code phase offset range. The multi-correlator array includes an instantaneous correlator, a leading correlator group, and a lagging correlator group. Specifically, based on the chip length characteristics of the C / A code in the GNSS signal (approximately 293m), 41 sets of correlators are uniformly set within the range of two chips to the left and right of the instantaneous code, according to a preset step size (e.g., 0.1 chip), to construct a multi-correlator array covering the chip offset range of [-2, +2]. The center of the array is the instantaneous correlator (P), and the left side is the leading correlator group (P). The right side is the hysteresis correlator group ( ), No. The code phase of the group correlator is , The range is [-20,...,0,...,20]. Indicates the code phase of the instantaneous correlator. For the correlator spacing, This indicates the number of correlators in a C / A code chip. Multiple sets of correlators are set within two chip ranges on the left and right of the code because the autocorrelation function of the GNSS signal varies with code phase shift. The main lobe region is within the range of 1. 1~ 2 is the sidelobe region. Deceptive signals can cause distortion of the autocorrelation function in the main lobe and sidelobe regions, affecting coverage. The range 2 can fully capture this distortion information.

[0027] Next, a control command is sent to the GNSS receiver to instruct the GNSS receiver tracking loop to perform mixing processing on the received mixed signal, decomposing it into in-phase and quadrature branch signals, and then inputting the in-phase and quadrature branch signals into the multiple correlator array. Specifically, a configuration command is sent to the GNSS receiver baseband processing unit to control the tracking loop to process the received mixed signal... After carrier stripping, the signal is decomposed into in-phase branch signals. and orthogonal branch signals The I / Q signals are input in parallel to the 41 correlators in the multicorrelator array.

[0028] Next, each group of correlators in the multi-correlator array correlates the in-phase branch signal and the quadrature branch signal with local codes of different code phase offsets, and completes the coherent integration operation within a preset coherent integration time. This yields the coherent integral outputs of the in-phase correlation result and the quadrature correlation result for each group of correlators, which are then combined to obtain the initial output value for each group of correlators. Specifically, each group of correlators uses locally generated lead / immediate / lag code copies respectively with... , Performing relevant calculations, coherent integration time Set to 1ms (i.e., one C / A code period), to obtain the first... In-phase integral results of the group correlator and orthogonal integral results The specific formula is expressed as follows: in For the first Local code copy of the group correlator; It is a mixed signal. The carrier phase of the actual satellite signal. For the carrier phase of the deception signal, This represents the code phase offset corresponding to the k-th correlator. This represents the actual power of the satellite signal. To deceive the power of the signal, The carrier frequency of the actual satellite signal. , These are the code phase differences between the real satellite signal and the locally generated signal, and between the spoof signal and the locally generated signal, respectively. It is a related function, defined as follows: , For noise and In-phase noise and quadrature noise.

[0029] Then, the in-phase integral results for each group of correlators are analyzed. and orthogonal integral results The synthesis process is performed to obtain the initial output value corresponding to each correlator group. in Represents the imaginary unit. This represents the noise term in the correlator output at the k-th code phase offset. It is typically complex Gaussian noise and can be decomposed into in-phase noise. and orthogonal correlation value Finally, the initial output values ​​of all correlators are sorted according to a preset order to obtain the correlator output sequence corresponding to multiple code phase offsets. The preset order is the sequential order of lead correlator group, instantaneous correlator, and lag correlator group. Specifically, the preset order is based on the code phase offset from smallest to largest, i.e., the lead correlator... to Immediate correlator P, Lag correlator to The initial output values ​​of all correlators are sorted in sequence to obtain a correlator output sequence with dimension 41. .

[0030] Step S20: Calculate the autocorrelation function magnitude sequence based on the correlator output sequence.

[0031] It should be noted that the autocorrelation function is a function that describes the correlation between the values ​​of a signal at different time points, and can reflect the temporal characteristics and morphological changes of the signal itself. The autocorrelation function amplitude sequence is a sequence formed by organizing the amplitudes of the autocorrelation function and arranging them in order of code phase offset, which can intuitively present the law of the signal's autocorrelation characteristics changing with the code phase.

[0032] Further, step S20 includes: firstly, extracting the in-phase branch output component corresponding to each group of correlators from the correlator output sequences under multiple code phase offsets. and the orthogonal branch output components Next, based on the square root algorithm, the output components of the in-phase branch and the quadrature branch corresponding to each code phase offset are incoherently combined to obtain the initial autocorrelation amplitude. The specific formula is as follows: in This represents the initial autocorrelation amplitude, which is used to eliminate the influence of carrier phase and obtain the amplitude that characterizes the autocorrelation properties of the signal.

[0033] Then, a convolutional moving average algorithm is used to filter the initial autocorrelation amplitudes of different samples in the time dimension to suppress noise and reduce local fluctuations, resulting in filtered autocorrelation amplitudes. The filtering operation involves smoothing the time-series autocorrelation function amplitude sequence through a convolution operation between a sliding window and an averaging kernel. Specifically, a length of [missing information] is used. (e.g., 5) moving average convolution kernel The specific formula for performing convolution operations is as follows: in This represents the autocorrelation magnitude after filtering. Indicates the length of the sliding window. Indicates the current data point position being processed. This represents the offset variable in the convolution operation.

[0034] Finally, the filtered autocorrelation amplitudes are sequence-normalized according to a preset order to obtain the autocorrelation function amplitude sequence corresponding to the multi-correlator array layout. The preset order is: lead correlator group, instantaneous correlator, and lag correlator group in that order. Specifically, the preset order is: lead correlator group... to Immediate correlator P, Lag correlator to By sorting the initial output values ​​of all correlators in sequence, a sequence of autocorrelation function magnitudes with dimension 41 is obtained. .

[0035] Step S30: Input the autocorrelation function amplitude sequence into the LSTM-Transformer dual-branch time series model for processing to obtain the deception detection result.

[0036] It should be noted that the LSTM-Transformer dual-branch temporal model is a dual-branch temporal data processing model that integrates a Long Short-Term Memory (LSTM) network and a transformer structure. It captures local and global temporal features of the data through two branches, which are then fused and classified to achieve object detection. The LSTM-Transformer dual-branch temporal model includes an LSTM branch, a Transformer branch, a cross-attention fusion module, and a deception detection classification module. The LSTM branch includes two layers of LSTM network, a Dropout layer, and an average pooling layer. The Transformer branch includes two layers of encoder and an attention pooling layer. The encoder sequentially includes a multi-head self-attention layer, a residual connection and layer normalization layer, a feedforward neural network layer, and another residual connection and layer normalization layer. The deception detection classification module sequentially includes a fully connected layer, a ReLU activation function layer, a Dropout layer, and a fully connected layer.

[0037] Specifically, the preprocessed autocorrelation function amplitude sequence corresponding to the multicorrelator array layout is input into the LSTM-Transformer dual-branch time series model. This is done so that the model can obtain core data containing the distortion features of the spoofed signal, laying the foundation for subsequent feature extraction. Then, the autocorrelation function magnitude sequence is processed in parallel on the LSTM and Transformer branches. The LSTM branch mines local and long-term temporal dependencies through two layers of long short-term memory network, suppresses overfitting through dropout layer, and compresses feature dimensions through average pooling layer. The two encoder layers of the Transformer branch sequentially perform multi-head self-attention to capture global correlation, stabilize feature distribution through residual connections and layer normalization, and enhance feature expression through feedforward neural network. Key features are then filtered through attention pooling layer. This is done because the two branches can complement each other and comprehensively mine temporal features. Next, the features extracted by the two branches are fed into the cross-attention fusion module to achieve deep fusion, allowing local and global features to empower each other and improve feature recognition. Finally, the fused features are input into the deception detection and classification module, which sequentially passes through fully connected layer to transform dimensions, ReLU activation function layer to filter effective features, Dropout layer to further suppress overfitting, and fully connected layer to complete classification mapping, outputting deception detection results, thereby realizing intelligent detection of GNSS deception signals.

[0038] Furthermore, to verify the effectiveness of the LSTM-Transformer dual-branch timing model (hereinafter referred to as the LT model) proposed in this embodiment in GNSS spoofing detection, the TEXBAT dataset publicly available from the Radio Navigation Laboratory at the University of Texas at Austin was used for experimental verification. The TEXBAT dataset contains real sample data from eight spoofing scenarios and two clean scenarios. Considering that spoofing detection is relatively easy for scenarios ds1, ds2, and ds5, and ds6 is a dynamic scenario with multipath effects, five scenarios—cleanStatic, ds3, ds4, ds7, and ds8—were selected for the experiment. The main parameters of each scenario are shown in Table 1, the main parameter table of the TEXBAT dataset.

[0039] Table 1. Main parameters of the TEXBAT dataset In the experimental setup, the multicorrelator array uniformly arranged 41 correlators within two chip ranges to the left and right of the instantaneous code with a step size of 0.1 chip. The coherence integration time was set to 1 ms, and the moving average convolutional kernel length was set to 5. The main parameters of the LT model were configured as follows: 128 neurons in each of the two LSTM layers, a model dimension of 64, 2 Transformer encoder layers, 4 attention heads, a feedforward network dimension of 256, and a training batch size of 256.

[0040] To comprehensively evaluate the detection performance of the LT model, Support Vector Machine (SVM), Random Forest (RF), Convolutional Neural Network (CNN), a single LSTM branch, and a single Transformer branch were selected as comparison models. The ACF amplitude sequence of multiple correlators was used as the unified input feature. Comparative experiments were conducted in four deception scenarios: ds3, ds4, ds7, and ds8. The evaluation metrics are shown in Tables 2 (ds3), 3 (ds4), 4 (ds7), and 5 (ds8).

[0041] Table 2 Evaluation Indicators for Different Algorithms in DS3 Scenarios Table 3ds4 Scene Classification Evaluation Index Table of Different Algorithms Table 4 Evaluation Indicators for Different Algorithms in DS7 Scenarios Table 5: Evaluation Indicators for Different Algorithms in DS8 Scenarios It can be seen that the LT model achieved the highest accuracy, precision, recall, and F1 score in all four scenarios. Specifically, the accuracy reached 99.83% and the recall reached 100% in the ds3 scenario, the precision reached 100% in the ds4 scenario, and the accuracy, precision, and F1 score all exceeded 99% in the ds7 and ds8 scenarios. This is significantly better than the single LSTM branch (accuracy 96.75%-98.08%) and the single Transformer branch (accuracy 96.42%-98.25%), proving the effectiveness of the dual-branch fusion architecture. At the same time, the detection accuracy of deep learning models (CNN, LSTM, Transformer, LT) is better than that of traditional machine learning models (SVM, RF), demonstrating the advantages of deep temporal models in GNSS deception detection.

[0042] To verify the superiority of the ACF amplitude of the multiple correlator as a detection quantity, comparative experiments were conducted using traditional signal quality monitoring (SQM) detection quantities (including ELP, Ratio, Delta, PCS, etc.) as inputs to the LT model. Figure 2 The diagram shown illustrates the confusion matrix results of the LT model when multiple detectors are used as input. Figure 3The diagram shows the confusion matrix results of the LT model when the ACF value of the multiple correlator is used as input. A comparison reveals that when multiple detection quantities are used as input, the number of misclassifications in the four scenarios (ds3, ds4, ds7, and ds8) is relatively high, at 39, 35, 67, and 86 respectively. This indicates that using the information output from the navigation tracking loop and signal layer data as detection quantities results in poor spoofing detection universality and difficulty adapting to different spoofing strategies and power configurations. When the ACF value of the multiple correlator is used as input, the number of misclassifications in the four scenarios drops sharply to 2, 3, 10, and 7, far less than the number of correct classifications. This shows that the ACF value of the multiple correlator can more completely characterize the distortion process of the receiver's autocorrelation function under the influence of spoofing signals, exhibiting stronger scene adaptability and detection robustness.

[0043] This embodiment constructs a multi-correlator structure for the GNSS receiver tracking loop, obtains the correlator output sequence under multi-code phase offset, calculates the autocorrelation function amplitude sequence, and inputs it into a dual-branch time-series model containing an LSTM branch, a Transformer branch, a cross-attention fusion module, and a spoofing detection classification module. After feature extraction, fusion, and classification, the spoofing detection result is output. By fully capturing the autocorrelation function distortion and time-series features and combining the advantages of the dual models, the generalization and accuracy of GNSS detection in complex scenes are enhanced.

[0044] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 The GNSS spoofing detection method based on the LSTM-Transformer model, step S30, further includes steps S201 to S204: Step S201: Based on the autocorrelation function amplitude sequence, input the data into the LSTM branch and the Transformer branch respectively for feature extraction to obtain the first time-series feature and the second time-series feature.

[0045] It should be noted that the first time-series feature is the output feature obtained after the LSTM branch extracts features from the autocorrelation function amplitude sequence. It focuses on characterizing the local time-series dependence and long-term time-series correlation of the autocorrelation function amplitude sequence, and can clearly reflect the continuous law of signal time-series evolution. The second time-series feature is the output feature obtained after the Transformer branch extracts features from the autocorrelation function amplitude sequence. It focuses on the global time-series correlation of each data point in the autocorrelation function amplitude sequence, and includes the correlation information of signal features under different code phase offsets.

[0046] Further, step S201 includes: performing time-series segmentation on the autocorrelation function amplitude sequence, dividing it into multiple continuous subsequences according to a preset time interval, wherein each subsequence includes a preset number of autocorrelation amplitude data points; inputting each subsequence into the first layer of the LSTM branch's Long Short-Term Memory network, capturing local temporal dependencies within the subsequence through a gating mechanism to obtain local dependency features; inputting the local dependency features into the second layer of the LSTM branch's Long Short-Term Memory network, modeling temporal correlation relationships on a longer time scale to obtain long-term correlation features; after suppressing overfitting through a Dropout layer, performing dimensionality compression and information aggregation on the long-term correlation features through an average pooling layer to obtain the first temporal feature.

[0047] It's important to note that time-series segmentation is a segmentation operation performed on continuous autocorrelation function amplitude sequences. It divides a long sequence into multiple short, continuous subsequences at fixed time intervals. The aim is to reduce the amount of data processed per cycle and more accurately capture temporal features within a local range. The preset time interval is the pre-defined length of time used to segment the autocorrelation function amplitude sequence and is the core parameter of time-series segmentation. The preset number is the pre-defined number of autocorrelation amplitude data points contained in each subsequence, ensuring that all subsequences have a consistent data scale to meet the input requirements of the LSTM branch. The gating mechanism is the core mechanism of the Long Short-Term Memory (LSTM) network, consisting of an input gate, a forget gate, and an output gate. It can autonomously control the input, forgetting, and output of information, effectively filtering useful information and discarding redundant information. Local temporal dependencies refer to the temporal associations between adjacent or nearby autocorrelation amplitude data points within the same subsequence. Local dependency features are the output features obtained after the first layer of the LSTM network processes the autocorrelation amplitude subsequences. They focus on characterizing the local temporal dependencies within the subsequences, preserving the core local features of the signal within a short time range. Long-term temporal correlation refers to the temporal correlation between different subsequences, which reflects the overall evolution trend of signal autocorrelation characteristics over a long period of time and can capture the full-process characteristics of deceptive signal distortion.

[0048] Specifically, the autocorrelation function amplitude sequence is segmented temporally, divided into multiple continuous subsequences according to a preset time window length (e.g., 100ms) and sliding step size (e.g., 100ms). Each subsequence contains T time steps of autocorrelation amplitude data points (each time step is a 41-dimensional vector). An input tensor is constructed to organize the continuous ACF observations into a sequence format that the model can process, while preserving the temporal continuity of the deception evolution. Next, each subsequence is input into the first layer of the LSTM branch's Long Short-Term Memory (LSTM) network. The input gate controls the degree of current information reception, the forget gate controls the proportion of historical information retention, and the output gate controls the output content of the hidden state. The unit state and hidden state at the current moment are calculated, and the process is recursively performed step by step to capture the local variation patterns of ACF amplitudes in adjacent time steps within the subsequence (e.g., amplitude rise in the early stage of deception injection, and abnormal fluctuations in the distortion stage), obtaining local dependency features to model the short-term dynamic characteristics of ACF evolution. Then, the local dependency features are input into the second layer of the LSTM branch's Long Short-Term Memory (LSTM) network, using the temporal hidden state output from the first layer as input. This further models the long-term temporal correlations across subsequences (such as the complete evolution from amplitude enhancement in deception stage 1 to waveform distortion in stage 2 and bimodal separation in stage 3), obtaining long-term correlation features to capture the gradual change pattern of ACF throughout the entire deception cycle. Finally, after a Dropout layer randomly discards some neuron outputs with a preset probability to suppress overfitting, an average pooling layer averages the long-term correlation features over time, compressing the variable-length temporal sequence into a fixed-dimensional vector representation. This aggregates the local and long-term temporal information extracted by the LSTM branch to obtain the first temporal feature, which serves as the basis for subsequent dual-branch fusion.

[0049] Furthermore, the autocorrelation function amplitude sequence is positionally encoded, adding temporal position information to each autocorrelation amplitude data point to generate a position-tagged sequence. The position-tagged sequence is input into the first layer encoder of the Transformer branch, where multiple global temporal correlations are captured in parallel through a multi-head self-attention layer. After processing by residual connections, layer normalization, and a feedforward neural network layer, the initial global features are output. The initial global features are input into the second layer encoder of the Transformer branch, and the global correlation capture and feature enhancement process is repeated to obtain deep global features. The deep global features are then weighted and filtered for key temporal segments through an attention pooling layer to obtain the second temporal features.

[0050] Specifically, the autocorrelation function amplitude sequence is position-encoded, adding a position-encoded vector based on sine and cosine functions to the autocorrelation amplitude data points at each time step, generating a sequence with temporal position labels. This allows the model to perceive the temporal order relationship of the ACF amplitude data, compensating for the lack of explicit position information modeling capability in the Transformer self-attention mechanism itself. Secondly, the position-labeled sequence is input into the first encoder layer of the Transformer branch. A multi-head self-attention layer projects the input sequence into three matrices: query, key, and value. A scaled dot product attention score is calculated, capturing global temporal correlations at different scales in multiple subspaces in parallel (e.g., simultaneously focusing on the abrupt changes at the deception initiation time and subtle fluctuations in the stable phase). Then, the attention output is added to the original input via residual connections, the data distribution is stabilized by layer normalization, and a feedforward neural network layer performs nonlinear feature transformation. Finally, residual connections and layer normalization are used to output the initial global features, establishing a direct correlation between any time steps in the ACF sequence, thus mitigating, to some extent, the limitations of LSTM in modeling long-distance temporal dependencies. Then, the initial global features are input into the second layer encoder of the Transformer branch. The process of multi-head self-attention calculation, residual connections, layer normalization, and global relevance capture and feature enhancement via feedforward neural network processing is repeated to obtain deep global features. These features are then used to refine more abstract deception pattern representations layer by layer. Finally, the importance weights of each time step in the deep global features are calculated through attention pooling layers. Higher weights are assigned to key temporal segments (such as the deception injection moment and the peak moment of ACF distortion), while lower weights are assigned to irrelevant segments. Weighted summation and filtering are then performed to obtain the second temporal features. This highlights the temporal information most relevant to deception behavior, achieving adaptive aggregation of global features.

[0051] Step S202: The first temporal feature and the second temporal feature are fused by the cross-attention fusion module to obtain the fused feature.

[0052] It should be noted that the first and second temporal features are subjected to dimensional unification processing to obtain standardized first and standardized second features. The standardized first feature is used as the query vector, and the standardized second feature is used as the key vector and value vector, respectively. The query vector, key vector, and value vector are input into the attention calculation unit of the cross-attention fusion module, and the relevance weight between the query vector and the key vector is calculated by scaling dot product operation. The value vector is weighted and summed based on the relevance weight to obtain the initial fused feature. The initial fused feature is residually connected with the standardized first feature and processed by layer normalization to obtain the intermediate fused feature. The intermediate fused feature is dynamically balanced by gating adjustment coefficients to balance the contributions of local temporal dependent features and global temporal related features, and the fused feature is output.

[0053] It's important to understand that the intermediate fusion features are optimized fusion features obtained after residual connection and layer normalization. These features retain the core information of the original standardized features while possessing preliminary fusion characteristics, resulting in stable data distribution. The gating adjustment coefficient is a learnable coefficient used to dynamically adjust the contribution of different types of features. It can autonomously adjust the proportion of local temporally dependent features and globally temporally correlated features in the fusion result based on the actual situation of the signal features.

[0054] Specifically, the first and second temporal features are subjected to dimensionality unification processing. Linear projection maps the first temporal feature output from the LSTM branch to the same dimensional space as the Transformer branch, resulting in standardized first and second features. This ensures that the features from the two branches have compatible dimensions during subsequent fusion, facilitating matrix operations. Secondly, the standardized first feature is used as the query vector, and the standardized second feature as the key and value vectors, respectively. A cross-attention input based on a query-key-value mechanism is constructed to achieve a directional fusion strategy that uses local LSTM temporal features as the query basis and selectively focuses on global Transformer temporal features. Then, the query vector, key vector, and value vector are input into the attention calculation unit of the cross-attention fusion module. The similarity weight between the query vector and the key vector is calculated through a scaled dot product operation. This weight reflects the overall matching degree between the LSTM local features and the Transformer global features in the feature subspace; a higher similarity indicates that the corresponding global feature is more important to the current local state. The value vector is then weighted and summed based on the similarity weight to obtain the initial fused features. This allows the model to adaptively select the most relevant parts of the global features to the local context according to the characteristics of the input samples. Next, the initial fused features are residually connected with the standardized first feature and the standardized second feature. Layer normalization is then applied to stabilize the data distribution and accelerate convergence, resulting in intermediate fused features. This alleviates the gradient vanishing problem in deep networks and enhances the stability of feature fusion. Finally, the intermediate fused features are input into the adaptive feature calibration layer. The contribution of local temporal dependent features and global temporal related features is dynamically balanced by the gating adjustment coefficient (the weights between 0 and 1 generated by the Sigmoid function). The intermediate fused features are then weighted and adjusted, and the fused features are output. This allows the model to adaptively select the optimal feature combination weights according to the characteristics of the specific deception scenario, thereby improving the detection robustness in complex scenarios.

[0055] Step S203: The fused features are detected by the deception detection classification module to obtain the deception detection result.

[0056] It should be noted that the fused features are input into the first fully connected layer of the deception detection and classification module. Features are mapped according to a preset dimension using a learnable weight matrix to obtain intermediate feature representations for classification. These features are then input into a ReLU activation function layer, where effective feature information is filtered through non-linear activation operations to obtain activated features. These activated features are then input into a Dropout layer, where some neurons are randomly masked according to a preset dropout probability to reduce co-fitting between features and suppress overfitting, resulting in regularized features. These regularized features are then input into the second fully connected layer, which outputs the predicted scores for each category. These scores are then normalized using a softmax function to obtain probabilities for both normal and deception signal categories. The category with the higher probability value is used as the judgment result, and the corresponding deception detection result is output.

[0057] Understandably, the learnable weight matrix is ​​the core parameter matrix used for feature mapping in the first fully connected layer. It can be autonomously updated and optimized during model training. By continuously adjusting the matrix values, it maps the fused features to a discriminative feature space of a preset dimension, improving the discriminative expressive power of the features. The preset dimension refers to the target dimension of the discriminative features output by the fully connected layer. The preset dropout probability is a core parameter in the Dropout layer used to control the masking ratio of neurons, with a fixed probability value set in advance. The softmax classification function is used to normalize the output of the second fully connected layer, transforming the output values ​​of the regularized features into probability values ​​between 0 and 1, with the sum of all class probabilities equal to 1.

[0058] Specifically, the first fully connected layer of the deception detection and classification module is input with fused features. A learnable weight matrix is ​​used for feature mapping to obtain intermediate features for classification, thus reorganizing and transforming the feature space and providing a foundation for subsequent nonlinear discrimination. Next, the intermediate discrimination features are input into a ReLU activation function layer. Nonlinear activation operations set negative values ​​to zero and positive values ​​to remain unchanged, introducing nonlinear mapping capabilities. This allows the model to learn more complex decision boundaries and helps suppress ineffective feature responses, resulting in activated features. Then, the activated features are input into a Dropout layer, randomly masking some neurons with a preset dropout probability (e.g., 0.3). This forces the model to not rely on specific neurons during training, resulting in regularized features. This reduces the risk of neuron co-adaptation, prevents overfitting, and improves the model's generalization ability. Finally, the regularized features are input into a second fully connected layer. A learnable weight matrix maps the feature dimension to the number of categories (2D). The mapping result is then normalized using a softmax classification function to obtain the probability of the normal signal category and the probability of the deception signal category, thus transforming the continuous feature space into a probability distribution. Finally, by comparing the probabilities of normal signal categories and spoofing signal categories, the category with the larger probability value is used as the judgment result, and the corresponding spoofing detection result is output (0 represents normal signal, 1 represents spoofing signal). This achieves end-to-end binary classification decision-making and completes the intelligent detection of GNSS spoofing signals.

[0059] This embodiment synchronously inputs the autocorrelation function amplitude sequence into LSTM and extracts features in parallel using a two-branch Transformer, obtaining a first temporal feature containing local and long-term temporal dependencies and a second temporal feature containing global temporal correlations. The two features are then deeply integrated by a cross-attention fusion module to obtain fused features. The fused features are then fed into a deception detection and classification module, where feature mapping, activation, regularization, and probabilistic classification are performed to output deception detection results. This improves the accuracy and generalization of deception signal identification, accurately distinguishes between normal and deceptive GNSS signals, and provides a reliable basis for receiver anti-deception interference.

[0060] Based on the first embodiment of this application, this application also provides a GNSS spoofing detection device based on the LSTM-Transformer model. Please refer to... Figure 5 The device includes: The acquisition module 10 is used to construct the multi-correlator structure in the GNSS receiver tracking loop and acquire the correlator output sequence under multiple code phase offsets based on the mixed signal.

[0061] The calculation module 20 is used to calculate the autocorrelation function magnitude sequence based on the correlator output sequence.

[0062] The result module 30 is used to input the autocorrelation function amplitude sequence into the LSTM-Transformer dual-branch temporal model for processing to obtain the deception detection result. The LSTM-Transformer dual-branch temporal model includes an LSTM branch, a Transformer branch, a cross-attention fusion module, and a deception detection classification module. The LSTM branch includes two layers of long short-term memory network, a Dropout layer, and an average pooling layer. The Transformer branch includes two layers of encoder and an attention pooling layer. The encoder sequentially includes a multi-head self-attention layer, a residual connection and a layer normalization layer, a feedforward neural network layer, and a residual connection and a layer normalization layer. The deception detection classification module sequentially includes a fully connected layer, a ReLU activation function layer, a Dropout layer, and a fully connected layer. The module is also used to extract features from the autocorrelation function amplitude sequence by inputting it into the LSTM branch and the Transformer branch respectively, to obtain the first temporal feature and the second temporal feature. The first temporal feature and the second temporal feature are fused through the cross-attention fusion module to obtain the fused feature. The fused feature is then detected by the deception detection classification module to obtain the deception detection result.

[0063] The GNSS spoofing detection device based on the LSTM-Transformer model provided in this application employs the GNSS spoofing detection method based on the LSTM-Transformer model in the above embodiments, and can solve the technical problem of how to improve the accuracy and generalization of GNSS spoofing detection in complex scenarios. Compared with the prior art, the beneficial effects of the GNSS spoofing detection device based on the LSTM-Transformer model provided in this application are the same as those of the GNSS spoofing detection method based on the LSTM-Transformer model provided in the above embodiments, and other technical features in the GNSS spoofing detection device based on the LSTM-Transformer model are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0064] This application provides a GNSS spoofing detection device based on the LSTM-Transformer model. The GNSS spoofing detection device based on the LSTM-Transformer model includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the GNSS spoofing detection method based on the LSTM-Transformer model in the above embodiment 1.

[0065] The following is for reference. Figure 6This document illustrates a schematic diagram of a GNSS spoofing detection device based on the LSTM-Transformer model suitable for implementing embodiments of this application. The GNSS spoofing detection device based on the LSTM-Transformer model in this application embodiment may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 6 The GNSS spoofing detection device based on the LSTM-Transformer model shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0066] like Figure 6 As shown, the GNSS spoofing detection device based on the LSTM-Transformer model may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the GNSS spoofing detection device based on the LSTM-Transformer model. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the LSTM-Transformer-based GNSS spoofing detection equipment to wirelessly or wiredly communicate with other devices to exchange data. Although various LSTM-Transformer-based GNSS spoofing detection devices are shown in the figures, it should be understood that implementation or possession of all of them is not required. More or fewer may be implemented alternatively.

[0067] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0068] The GNSS spoofing detection device based on the LSTM-Transformer model provided in this application, employing the GNSS spoofing detection method based on the LSTM-Transformer model in the above embodiments, can solve the technical problem of how to improve the accuracy and generalization of GNSS spoofing detection in complex scenarios. Compared with the prior art, the beneficial effects of the GNSS spoofing detection device based on the LSTM-Transformer model provided in this application are the same as those of the GNSS spoofing detection method based on the LSTM-Transformer model provided in the above embodiments, and other technical features in this GNSS spoofing detection device based on the LSTM-Transformer model are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0069] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0070] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0071] This application provides a computer-readable medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the GNSS spoofing detection method based on the LSTM-Transformer model in the above embodiments.

[0072] The computer-readable medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, or any combination thereof. More specific examples of computer-readable media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable medium may be any tangible medium containing or storing a program that can be executed by instructions, used by a device, or used in conjunction with it. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0073] The aforementioned computer-readable medium may be included in a GNSS spoofing detection device based on the LSTM-Transformer model; or it may exist independently and not be assembled into a GNSS spoofing detection device based on the LSTM-Transformer model.

[0074] The aforementioned computer-readable medium carries one or more programs that, when executed by a GNSS spoofing detection device based on the LSTM-Transformer model, enable the LSTM-Transformer-based GNSS spoofing detection device to write computer program code for performing the operations of this application in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0075] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of this application. In this regard, all blocks in the flowcharts or block diagrams may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that all blocks in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using dedicated hardware-based implementations that perform the specified functions or operations, or using a combination of dedicated hardware and computer instructions.

[0076] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0077] The readable medium provided in this application is a computer-readable medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described GNSS deception detection method based on the LSTM-Transformer model. This addresses the technical problem of improving the accuracy and generalization of GNSS deception detection in complex scenarios. Compared to existing technologies, the beneficial effects of the computer-readable medium provided in this application are the same as those of the GNSS deception detection method based on the LSTM-Transformer model provided in the above embodiments, and will not be elaborated upon here.

[0078] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the GNSS spoofing detection method based on the LSTM-Transformer model described above.

[0079] The computer program product provided in this application can solve the technical problem of how to improve the accuracy and generalization of GNSS spoofing detection in complex scenarios. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the GNSS spoofing detection method based on the LSTM-Transformer model provided in the above embodiments, and will not be repeated here.

[0080] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A GNSS spoofing detection method based on an LSTM-Transformer model, characterized in that, The method comprises: constructing a multi-correlator structure in a GNSS receiver tracking loop, and obtaining a correlator output sequence under multiple code phase offsets based on a mixed signal containing a satellite real signal, a spoofing signal and noise; calculating according to the correlator output sequence to obtain a self-correlation function amplitude sequence; inputting the self-correlation function amplitude sequence into an LSTM-Transformer dual-branch time series model for processing to obtain a spoofing detection result, wherein the LSTM-Transformer dual-branch time series model comprises an LSTM branch, a Transformer branch, a cross-attention fusion module and a spoofing detection classification module; the LSTM branch comprises two layers of long short-term memory networks, a Dropout layer and an average pooling layer; the Transformer branch comprises two layers of encoders and an attention pooling layer, and the encoders sequentially comprise a multi-head self-attention layer, a residual connection and a layer normalization layer, a feedforward neural network layer, and a residual connection and a layer normalization layer; the spoofing detection classification module sequentially comprises a fully connected layer, a ReLU activation function layer, a Dropout layer and a fully connected layer; the step of inputting the self-correlation function amplitude sequence into the LSTM-Transformer dual-branch time series model for processing to obtain a spoofing detection result comprises: inputting the self-correlation function amplitude sequence into the LSTM branch and the Transformer branch respectively for feature extraction to obtain first time series features and second time series features; fusing the first time series features and the second time series features through the cross-attention fusion module to obtain fused features; detecting the fused features through the spoofing detection classification module to obtain a spoofing detection result.

2. The method of claim 1, wherein, the step of constructing a multi-correlator structure in a GNSS receiver tracking loop, and obtaining a correlator output sequence under multiple code phase offsets based on a mixed signal comprises: based on the autocorrelation function characteristics of a GNSS signal, a plurality of groups of correlators are uniformly set in a range of 2 chips left and right of the prompt code according to a preset step length, a multi-correlator array covering the effective code phase offset range is constructed, wherein the multi-correlator array comprises a prompt correlator, a group of early correlators and a group of late correlators; sending a control instruction to a GNSS receiver, so that the GNSS receiver tracking loop decomposes the received mixed signal into in-phase branch signals and quadrature branch signals after frequency mixing processing, and inputs the in-phase branch signals and the quadrature branch signals into the multi-correlator array; the in-phase branch signals and the quadrature branch signals are correlated with local codes of different code phase offsets by each group of correlators in the multi-correlator array, and coherent integration operations are completed in a preset coherent integration time to obtain coherent integration outputs of in-phase correlation results and coherent integration outputs of quadrature correlation results corresponding to each group of correlators, and initial output values corresponding to each group of correlators are combined; The initial output values of all correlators are sorted in a preset order to obtain a correlator output sequence corresponding to multiple code phase offsets, wherein the preset order is the order of a group of early correlators, a correlator at present, and a group of late correlators.

3. The method of claim 1, wherein, The step of calculating according to the correlator output sequence to obtain a sequence of autocorrelation function amplitudes comprises: extracting, from the correlator output sequence under multiple code phase offsets, an in-phase branch output component and a quadrature branch output component corresponding to each group of correlators; performing non-coherent synthesis on the in-phase branch output component and the quadrature branch output component corresponding to each code phase offset based on a square sum square root algorithm to obtain an initial autocorrelation amplitude; performing filtering processing on the initial autocorrelation amplitudes of different samples in the time dimension using a convolution sliding average processing algorithm to suppress noise and reduce local fluctuations to obtain filtered autocorrelation amplitudes, wherein the filtering operation is a convolution operation between a sliding window and an average kernel to smooth the sequence of autocorrelation function amplitudes in time sequence; performing sequence normalization on the filtered autocorrelation amplitudes in a preset order to obtain a sequence of autocorrelation function amplitudes corresponding to the layout of a multiple correlator array, wherein the preset order is the order of a group of early correlators, a correlator at present, and a group of late correlators.

4. The method of claim 1, wherein, The step of inputting the sequence of autocorrelation function amplitudes into LSTM branches and Transformer branches respectively for feature extraction to obtain first and second time sequence features comprises: performing time sequence segmentation processing on the sequence of autocorrelation function amplitudes to divide a plurality of continuous subsequences at a preset time interval, wherein each subsequence includes a preset number of autocorrelation amplitude data points; inputting each subsequence into a first layer of long short-term memory network of the LSTM branch to capture local time sequence dependency within the subsequence through a gating mechanism to obtain a local dependency feature; inputting the local dependency feature into a second layer of long short-term memory network of the LSTM branch to model time sequence association in a longer time scale to obtain a long-time association feature; after suppressing overfitting through a Dropout layer, performing dimension compression and information aggregation on the long-time association feature through an average pooling layer to obtain a first time sequence feature.

5. The method of claim 1, wherein, The step of inputting the sequence of autocorrelation function amplitudes into LSTM branches and Transformer branches respectively for feature extraction to obtain first and second time sequence features further comprises: performing position encoding processing on the sequence of autocorrelation function amplitudes to add time sequence position information to each autocorrelation amplitude data point to generate a sequence with position markers; inputting the sequence with position markers into a first layer of encoder of the Transformer branch to model global time sequence correlation between different positions in the sequence through a multi-head self-attention layer in parallel, and then output an initial global feature after residual connection and layer normalization, feedforward neural network layer processing; inputting the initial global feature into a second layer of encoder of the Transformer branch to further model global time sequence association and enhance feature expression capability to obtain a deep global feature; The deep global feature is weighted and aggregated by an attention pooling layer to obtain a second time sequence feature.

6. The method of claim 1, wherein, The step of fusing the first time sequence feature and the second time sequence feature by the cross-attention fusion module to obtain a fusion feature includes: The first time sequence feature and the second time sequence feature are respectively subjected to dimension unification processing to obtain standardized first features and standardized second features; The standardized first features are taken as query vectors, and the standardized second features are taken as key vectors and value vectors respectively; The query vectors, the key vectors and the value vectors are input into an attention calculation unit of the cross-attention fusion module, and a correlation weight of the query vectors and the key vectors is calculated through a scaling dot product operation; The value vectors are weighted and summed based on the correlation weight to obtain an initial fusion feature; The initial fusion feature is subjected to residual connection with the standardized first features and is subjected to layer normalization processing to obtain an intermediate fusion feature; The intermediate fusion feature is subjected to gate adjustment coefficient to dynamically balance the contribution degrees of the local time sequence dependent feature and the global time sequence correlation feature, and the fusion feature is output.

7. The method of claim 1, wherein, The step of detecting the fusion feature by the fraud detection classification module to obtain a fraud detection result includes: The fusion feature is input into a first full connection layer of the fraud detection classification module, and feature mapping is performed according to a preset dimension through a learnable weight matrix to obtain an intermediate feature for classification and discrimination; The intermediate feature is input into a ReLU activation function layer, and effective feature information is screened through a nonlinear activation operation to obtain an activated feature; The activated feature is input into a Dropout layer, and part of the neuron nodes are randomly shielded according to a preset dropout probability to obtain a regularized feature; The regularized feature is input into a second full connection layer to obtain a corresponding classification score, and the classification score is mapped into a normal signal category probability and a fraud signal category probability through a softmax classification function; The normal signal category probability and the fraud signal category probability are compared, a category with a larger probability value is taken as a judgment result, and a corresponding fraud detection result is output. 8.A GNSS spoofing detection device based on an LSTM-Transformer model, characterized in that, The device includes: An acquisition module configured to construct a multi-correlator structure in a GNSS receiver tracking loop, and acquire correlator output sequences under multiple code phase offsets based on a mixed signal; A calculation module configured to calculate, according to the correlator output sequences, to obtain an autocorrelation function amplitude sequence; The result module is configured to input the autocorrelation function amplitude sequence into an LSTM-Transformer dual-branch time sequence model to obtain a spoofing detection result, wherein the LSTM-Transformer dual-branch time sequence model comprises an LSTM branch, a Transformer branch, a cross-attention fusion module and a spoofing detection classification module, the LSTM branch comprises two layers of long short-term memory networks, a Dropout layer and an average pooling layer, the Transformer branch comprises two layers of encoders and an attention pooling layer, the encoders comprise, in sequence, a multi-head self-attention layer, a residual connection and a layer normalization layer, a feedforward neural network layer and a residual connection and a layer normalization layer, and the spoofing detection classification module comprises, in sequence, a full connection layer, a ReLU activation function layer, a Dropout layer and a full connection layer; the result module is further configured to input the autocorrelation function amplitude sequence into the LSTM branch and the Transformer branch respectively to extract features to obtain first time sequence features and second time sequence features; the result module is further configured to fuse the first time sequence features and the second time sequence features through the cross-attention fusion module to obtain fused features; and the result module is further configured to detect the fused features through the spoofing detection classification module to obtain the spoofing detection result. 9.A GNSS spoofing detection device based on an LSTM-Transformer model, characterized in that, The device comprises a memory, a processor and a GNSS spoofing detection program based on an LSTM-Transformer model stored on the memory and running on the processor, and the GNSS spoofing detection program based on the LSTM-Transformer model is configured to implement the steps of the GNSS spoofing detection method based on the LSTM-Transformer model according to any one of claims 1-7.

10. A storage medium, characterized by The storage medium stores a GNSS spoofing detection program based on an LSTM-Transformer model, and the GNSS spoofing detection program based on the LSTM-Transformer model implements the steps of the GNSS spoofing detection method based on the LSTM-Transformer model according to any one of claims 1-7 when executed by a processor.

Images