A method and system for detecting spoofing attacks / natural electromagnetic interference

Abstract

The application relates to the technical field of fraud detection, and discloses a detection method and system for spoofing attacks / natural electromagnetic interference, which comprises: a first detection quantity based on absolute tracking loop output (ATLO); mobile variance filtering processing (ATLO-MV) is performed on the first detection quantity to construct a second detection quantity; and the detection probability information of the second detection quantity of ATLO-MV of multiple satellites is used to distinguish spoofing attacks, natural electromagnetic interference and no interference. Through construction of the first detection quantity based on absolute tracking loop output, subtle fluctuations in tracking loop output can be accurately captured; the second detection quantity of ATLO-MV obtained through mobile variance enhancement processing effectively improves detection sensitivity and anti-noise performance; finally, a new type of detection algorithm is constructed through multi-satellite joint processing (ATLO-MV-MSC) of ATLO-MV, the distinction between no interference, natural electromagnetic interference and spoofing attacks is realized, and the pain point of fuzzy judgment existing in traditional algorithms is solved.

Description

Technical Field

[0001] This application relates to the field of deception detection technology, specifically a method and system for detecting deception attacks / natural electromagnetic interference. Background Technology

[0002] Traditional deception detection algorithms suffer from unsatisfactory detection performance. Specifically, when performing deception detection in a real-world environment, the decision may fall into three categories: deception attack, natural electromagnetic interference, and no interference. In these cases, the binary assumption fails.

[0003] Therefore, a new technical solution for detecting deception attacks / natural electromagnetic interference is urgently needed. Summary of the Invention

[0004] The purpose of this application is to provide a method and system for detecting deception attacks / natural electromagnetic interference, so as to solve the technical problem in the prior art that it is difficult to distinguish between deception attacks and natural electromagnetic interference in actual deception environments.

[0005] To achieve the above objectives, this application provides a method for detecting deception attacks / natural electromagnetic interference, the method comprising: S10: Construct an ATLO first-level detection quantity based on the absolute tracking loop output using a GNSS receiver. This first-level detection quantity is used to monitor changes in the absolute tracking loop output. S20: Perform moving variance filtering on the ATLO primary detection quantity to construct the ATLO-MV secondary detection quantity; S30: The ATLO-MV-MSC algorithm, constructed by combining the ATLO-MV secondary detection quantities of multiple satellites, distinguishes between spoofing attacks, natural electromagnetic interference, and interference-free attacks.

[0006] Preferably, the expression for the ATLO first-level detection quantity is: in, For the output of the in-phase lead correlator, For the output of the in-phase instantaneous correlator, For the output of the in-phase hysteresis correlator, For the output of the quadrature lead correlator, For the output of the quadrature hysteresis correlator, It is the absolute value symbol.

[0007] Preferably, the expression for the ATLO-MV secondary detection quantity is: in, Indicates the length of the sliding window. L represents the number of sliding windows, and L represents the sliding interval.

[0008] As a preferred embodiment, the steps of the S30 ATLO-MV-MSC detection algorithm include: S31: Set the number of tracking channels to... The decision interval is seconds, number of judgments Tracking each channel seconds, loop parameter and The initial value is 0; S32: Calculation ; S33: Calculate the... The ATLO value of the channel; S34: Calculate the corresponding ATLO-MV, detection threshold, and corresponding detection probability; S35: Store the detection probability of ATLO-MV; S36: Judgment Whether it is true or not, if it is, then it will be M The detection probability combination of ATLO-MV of each satellite is a OK Column matrix Otherwise, return to S32; S37: Calculation Judgment matrix The If the number of elements in the column is greater than 50%, execute S38; otherwise, determine that there is no interference and execute S39. S38: Judgment Matrix The If all elements in the column are greater than 50% of the elements, it is determined to be deceptive interference and S39 is executed; otherwise, it is determined to be natural electromagnetic interference and S39 is executed. S39: Judgment If the condition is true, output the result and end the detection; otherwise, return to S37.

[0009] Preferably, the calculation of the detection threshold includes: The detection threshold is determined by substituting the pre-set false alarm probability into the threshold formula, and the detection probability is calculated based on the obtained detection threshold and the joint detection probability formula.

[0010] As a preferred method, a false alarm probability is set, and its value is substituted into the threshold expression to determine the detection threshold, including: The expression for the false alarm probability is: in, To detect the upper limit of the threshold, To detect the lower limit of the threshold, This is the case where there is no interference.

[0011] Based on a pre-set false alarm probability and the expression for the detection threshold, the detection threshold is calculated; the expression for the detection threshold is: in: This represents the mean of ATLO when there is no interference. This represents the offset relative to the mean at a specific false alarm probability, and , It is an inverse Gaussian function. This represents the standard deviation of ATLO when there is no interference.

[0012] Preferably, the expressions for the false alarm probability and the detection probability of the ATLO-MV secondary detection quantity are as follows: in, This represents the total number of samples in ATLO-MV without interference. The number of samples within the sliding window. The detection threshold for ATLO-MV The number of samples that meet the conditions.

[0013] To achieve the above objectives, this application also provides a detection system for deception attacks / natural electromagnetic interference, applying the detection method for deception attacks / natural electromagnetic interference as described above. The system includes: The first-level detection quantity construction module is used to construct ATLO detection quantities based on the absolute tracking loop output using a GNSS receiver, which is used to monitor changes in the tracking loop output; The secondary detection quantity construction module performs moving variance filtering on the ATLO primary detection quantity to construct the ATLO-MV detection quantity, thereby enhancing detection performance; The ATLO-MV-MSC building block constructs an ATLO-MV-MSC detection algorithm using ATLO-MV information from multiple satellites, which is used to distinguish between spoofing attacks, natural electromagnetic interference, and interference-free environments.

[0014] To achieve the above objectives, this application also provides a computer device for detecting deception attacks / natural electromagnetic interference, including at least one processor, at least one memory, and a data bus; The processor and the memory communicate with each other via the data bus; The memory stores program instructions that can be executed by the processor, which invokes the program instructions to perform the detection method for deception attacks / natural electromagnetic interference as described above.

[0015] To achieve the above objectives, this application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the deception attack / natural electromagnetic interference detection method described above.

[0016] Beneficial effects: The spoofing attack / natural electromagnetic interference detection method and system of this application can accurately capture subtle fluctuations in the tracking ring output by constructing an ATLO primary detection quantity based on the output of the absolute tracking ring; the ATLO-MV secondary detection quantity obtained by moving variance enhancement processing effectively improves detection sensitivity and noise resistance; and the ATLO-MV-MSC detection algorithm constructed by combining ATLO-MV from multiple satellites can distinguish between interference-free, natural electromagnetic interference and spoofing attacks, solving the pain point of ambiguity in decision-making in traditional algorithms. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating the detection method for deception attacks / natural electromagnetic interference provided in this application embodiment; Figure 2 A schematic diagram illustrating the deception process of intermediate GNSS spoofing provided in an embodiment of this application; Figure 3 This is a schematic diagram of the histogram of ATLO output results provided in the embodiments of this application; Figure 4 This is a schematic diagram of ATLO-MV provided for an embodiment of this application; Figure 5 This is a flowchart of the ATLO-MV-MSC detection algorithm provided in this embodiment; Figure 6 The figure shows the change of the output of the relevant function over time during the deception process provided in the embodiments of this application; in the figure: (a) the whole process of the change of the relevant peak (b) a top view of the relevant peak; Figure 7 This document describes the change of the ATLO detection output waveform over time, as provided in the embodiments of this application. Figure 8 This document describes the time-varying waveform of the ATLO-MV detection output provided in the embodiments of this application. Figure 9A schematic diagram comparing the detection probabilities of the original detection algorithms provided in the embodiments of this application; in the figure: (a) for PRN3; (b) for PRN6; (c) for PRN7; (d) for PRN13; Figure 10 A schematic diagram comparing the detection probabilities of four MV algorithms provided in the embodiments of this application; in the figure: (a) for PRN3; (b) for PRN6; (c) for PRN7; (d) for PRN13; Figure 11 A comparison chart of detection probabilities for -MV-MSC provided in the embodiments of this application; in the figure: (a) for ATLO-MV-MSC; (b) for PCS-MV-MSC; (c) for Delta-MV-MSC; (d) for ELP-MV-MSC; Figure 12 A ternary decision comparison diagram for -MV-MSC provided in the embodiments of this application; in the figure: (a) for ATLO-MV-MSC; (b) for PCS-MV-MSC; (c) for Delta-MV-MSC; (d) for ELP-MV-MSC; Figure 13 The diagram shows the structure of the detection system for deception attacks / natural electromagnetic interference provided in this application embodiment; in the diagram: 10, primary detection quantity construction module; 20, secondary detection quantity construction module; 30, ATLO-MV-MSC detection algorithm construction module.

[0019] The implementation, functional features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] The technical solutions in the embodiments of this application will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0021] In this document, the term "comprising" is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0022] This embodiment addresses the issue of unsatisfactory detection performance in traditional deception detection algorithms by proposing a method for detecting deception attacks / natural electromagnetic interference. Specifically, this method is based on a novel detection algorithm that fuses the output of the tracking loop pair with variance.

[0023] Reference Figure 1 , Figure 1 A flowchart illustrating the detection method for deception attacks / natural electromagnetic interference provided in this application embodiment.

[0024] like Figure 1 As shown, this embodiment discloses a method for detecting deception attacks / natural electromagnetic interference, including: S10: Utilize a GNSS receiver to construct a first-level detection quantity based on the Absolute Tracking Loop Output (ATLO) to monitor changes in the absolute tracking loop output.

[0025] In the specific application of this embodiment, firstly, an ATLO detection quantity based on the absolute tracking loop output is constructed using a GNSS receiver to monitor changes in the tracking output; S20: Perform moving variance filtering on the ATLO detection quantity to construct the ATLO-MV detection quantity.

[0026] In the specific application of this embodiment, in order to further improve the detection performance, ATLO is subjected to moving variance enhancement processing to construct the ATLO-MV secondary detection quantity.

[0027] S30: The ATLO-MV-MSC detection algorithm is constructed by combining the ATLO-MV detection data from multiple satellites to distinguish between spoofing attacks, natural electromagnetic interference, and interference-free environments.

[0028] In the specific application of this embodiment, the ATLO-MV-MSC detection algorithm is constructed by combining the detection probability information of multiple satellite ATLO-MV to distinguish between three situations: no interference, natural electromagnetic interference, and deception attack.

[0029] To verify the effectiveness of the proposed spoofing attack / natural electromagnetic interference detection method, experiments were conducted using Data Set 4 (DS4) from the University of Texas's TEXBAT database. The detection performance of the proposed algorithm was analyzed, including detection probability, detection range, detection response time, detection robustness, and the ability to distinguish between spoofing and natural electromagnetic interference. Experimental results show that the proposed algorithm exhibits superior detection performance compared to several other traditional spoofing detection algorithms.

[0030] The detection method for deception attacks / natural electromagnetic interference in this embodiment will now be described in full detail.

[0031] Explanation of the signal model and correlator output in spoofing detection.

[0032] Reference Figure 2 , Figure 2 This is a schematic diagram of the deception process of intermediate GNSS spoofing provided in an embodiment of this application.

[0033] Regarding the received signal, the deception attack process of intermediate-level GNSS deception is divided into four stages: deception injection (stage I), deception alignment (stage II), deception pulling (stage III), and deception separation (stage IV). Stage I: Deception is injected, but the receiver tracks the real signal, and the received signal is the real signal. Stage II: The deception signal aligns with the real signal and gradually increases its power. At this point, the received signal is a superposition of the deception and real signals, showing a rapid increase in correlation peak power. Stage III: The deception signal uses its power advantage to seize control of the receiver, and the receiver tracking loop is pulled to the deception signal. At this point, the correlation peaks show severe distortion. Stage IV: The deception signal slowly deviates from the real signal by adjusting its code rate, and the correlation peaks show a multi-peak phenomenon, indicating that the deception is complete. The deception process of intermediate-level GNSS deception is as follows: Figure 2 As shown.

[0034] When deception interference is present, the received signal consists of the real signal, the deception signal, and noise. The mathematical expression for the received signal is: (1) Among them, superscript and Representing real signals and deceptive signals respectively, subscripts Representing the One satellite, It is zero-mean Gaussian white noise. Based on the generation mechanism of GNSS signals, it is known that deception signals and real signals have similar signal structures. (The last sentence appears to be incomplete and possibly contains errors.) Taking a satellite as an example, its real signal and spoofed signal are represented as follows: (2) (3) in, For signal power, It is a pseudo-random code. For navigation data, For code delay, For the center frequency, For Doppler frequency shift, This refers to the carrier phase.

[0035] This pertains to the output of the receiver correlator. As a core component of the receiver, the tracking loop correlator is used to remove spurious codes. Taking the C / A code of the m-th GPS satellite as an example, its correlation output is: (4) in, The result is the cross-correlation between the real signal and the local signal. To determine the cross-correlation results between the deception signal and the local signal, This represents the cross-correlation result between the noise signal and the local signal. Since pseudo-random noise (PRN) codes can be used to number satellites, their characteristics indicate the corresponding correlation function... Represented as (5) in, For the relevant integration time. Since the deceptive signal and the real signal have similar signal structures and comparable power, then... It can be represented as (6) in, The code delay between the deception signal and the real signal.

[0036] The tracking loop uses three pairs of correlators: one pair each for leading, instantaneous, and lagging correlators, with a 0.5-chip interval between them. Each correlator pair consists of an in-phase branch and a quadrature branch, with in-phase instantaneous output. Orthogonal instant output They are respectively in, The code phase difference between the actual signal and the local code. The code phase difference between the actual signal and the local code. The carrier phase difference between the real signal and the locally replicated signal. To deceive the carrier phase difference between the signal and the local signal, is the autocorrelation function of the spreading code.

[0037] The principles of traditional spoofing detection algorithms will now be explained. This mainly involves the Delta, ELP, and PCS spoofing detection algorithms.

[0038] As one of the classic SQM indicators, Delta utilizes the in-phase branches I E , I P and I L The output combination constructs the detection quantity, which is used to evaluate the sharpness of the relevant peaks, and is represented as follows: (10) According to GNSS signal detection theory, the output of the Delta detection quantity follows a Gaussian distribution.

[0039] Unlike Delta, ELP uses the lead and lag phase difference to construct the detection quantity, used to detect anomalous phase changes caused by spoofing, which can be represented as: (11) When the signal-to-noise ratio is much greater than 1, ELP approximately follows a Gaussian distribution.

[0040] Unlike Delta and ELP, PCS uses the autocorrelation power difference to construct the detection quantity, denoted as... (12) in, E , P and L satisfy (13) Among them, when the signal-to-noise ratio is much greater than 1, E , P and L All approximately follow a Gaussian distribution. Since the PCS detection volume is determined by... E , P and L The PCS is constructed by a linear combination of the given information, and therefore it approximately follows a Gaussian distribution.

[0041] The ATLO, ATLO-MV, and ATLO-MV-MSC spoofing detection algorithms proposed in this embodiment will now be described in detail.

[0042] To address the issue of drastic performance fluctuations in traditional deception detection algorithms, a novel deception detection algorithm is proposed.

[0043] First, an ATLO detection quantity based on the absolute tracking loop output is constructed using a GNSS receiver to monitor changes in the tracking output; To further improve detection performance, ATLO was enhanced with MV to construct the ATLO-MV detection quantity; Finally, the ATLO-MV-MSC detection algorithm is constructed using ATLO-MV from multiple satellites to distinguish between three scenarios: no interference, natural electromagnetic interference, and deception attacks.

[0044] Specifically, the expression for the ATLO detection quantity is as follows: (14) in, For the output of the in-phase lead correlator, For the output of the in-phase instantaneous correlator, For in-phase hysteresis switch output, For the output of the quadrature lead correlator, For the output of the quadrature hysteresis correlator, It is the absolute value symbol.

[0045] In the specific application of this embodiment, ATLO in S10 is expressed as equation (14). According to tracking theory, when there is no interference, the signal is concentrated in the in-phase branch, while the quadrature branch is noise. Based on this, the output of the in-phase branch is much larger than the output of the quadrature branch, and the contribution of the quadrature output to the detection quantity is much less than that of the in-phase branch output. Furthermore, according to signal detection theory, the distribution of the sum of the absolute values ​​of the in-phase branch outputs is Gaussian. Combining the above analysis, the ATLO detection quantity approximately follows a Gaussian distribution, and its mean is... variance is , X =ATLO, then X The probability density function can be expressed as: (15) Reference Figure 3 , Figure 3 The histogram of the ATLO output results provided in this embodiment of the application.

[0046] To further verify the above analysis, 100 seconds of interference-free data were selected for fitting, and its distribution characteristics were observed. Taking DS4's PRN3 as an example, ATLO approximately follows a Gaussian distribution with a mean of 4.505731, and its distribution histogram is as follows: Figure 3 As shown.

[0047] Specifically, the expression for the ATLO-MV detection quantity is as follows: (16) in, Indicates the length of the sliding window. L represents the number of sliding windows, and L represents the sliding interval.

[0048] Reference Figure 4 , Figure 4 This is a schematic diagram of ATLO-MV provided for an embodiment of this application.

[0049] In the specific application of this embodiment, in order to further suppress the influence of tracking loop noise on the detection quantity, S20 performs moving variance (MV) filtering on the ATLO detection quantity to construct the ATLO-MV secondary detection quantity, as shown in equation (16). The detection quantity ATLO-MV is reconstructed again through the above equation (16), and the window is slid from left to right to obtain the following results. Data points. The sliding process of ATLO-MV is as follows: Figure 4 As shown.

[0050] The decision threshold and hypothesis testing will now be explained.

[0051] According to signal detection theory, spoofing detection is usually regarded as a binary hypothesis testing problem, taking... To avoid interference, To be deceitful, to be expressed as Considering the variation in detection volume, detection problems typically employ a dual-threshold method, with a false alarm probability... P fa and detection probability P d They are respectively (18) in, and These are the upper and lower limits of detection, respectively, denoted as: (19) in, It is an inverse Gaussian function. It represents the offset relative to the mean at a given false alarm probability.

[0052] In practice, the parameters of the deception signal are time-varying and unknown, making them impossible to obtain. P d Based on the theoretical results, statistical methods are used to calculate the detection probability, expressed as: (20) in, q This represents the total number of ATLO samples within the window. The number of samples that meet the conditions.

[0053] The detection process is as follows: the false alarm probability is preset and substituted into the detection threshold formula to determine the detection threshold, and then the detection probability is calculated by combining the detection probability expression; finally, the ATLO-MV-MSC algorithm is constructed by combining multiple satellites and the detection is performed.

[0054] Specifically, the calculation of the detection threshold includes: Set the false alarm probability and substitute it into the detection threshold formula to calculate the upper and lower limits of the detection threshold.

[0055] include: Under normal circumstances, the probability of a false alarm P fa The relationship with the detection threshold is expressed as follows: in: The upper limit of the detection threshold; This is the lower limit of the detection threshold; This is under the condition of no interference; Based on the set false alarm probability and the expression for the detection threshold, the detection threshold is calculated; where the expression for the detection threshold is: in: This represents the mean of ATLO when there is no interference. This represents the offset relative to the mean at a specific false alarm probability, and , It is an inverse Gaussian function. This represents the standard deviation of ATLO when there is no interference.

[0056] In this embodiment, to further suppress noise interference, ATLO is processed using the MV method to construct the ATLO-MV detection quantity. Specifically, the expression for the detection probability of the secondary detection quantity ATLO-MV is as follows: in, This represents the total number of samples in ATLO-MV without interference. The number of samples within the sliding window. The detection threshold for ATLO-MV The number of samples that meet the conditions.

[0057] Given a false alarm probability, the detection threshold can be determined according to the detection threshold formula and then substituted into the detection probability formula to calculate the detection probability.

[0058] The ATLO-MV-MSC detection algorithm proposed in this embodiment will now be described in detail.

[0059] Reference Figure 5 , Figure 5 The flowchart of the ATLO-MV-MSC detection algorithm provided in this embodiment is shown.

[0060] In actual deception detection, the decision may involve three scenarios: deception attack, natural electromagnetic interference, and no interference. In these cases, the binary assumption will not fail. Based on this, a multi-classification detection algorithm can be constructed.

[0061] Based on S30, and taking into account the characteristic that spoofing attacks can deceive all satellites, while different satellites are usually not simultaneously affected by natural electromagnetic interference due to their different spatial distribution, an ATLO-MV-MSC detection algorithm based on the joint use of multiple satellites' ATLO-MV is proposed to distinguish between spoofing attacks and natural electromagnetic interference.

[0062] Specifically, the steps of the S30, ATLO-MV-MSC algorithm include: S31: Set the number of tracking channels to... The decision interval is seconds, number of judgments Tracking each channel seconds, loop parameter and The initial value is 0.

[0063] S32: Calculation .

[0064] S33: Calculate the... The primary detection quantity of the channel, i.e., the first-level detection quantity. k The ATLO value of the channel.

[0065] S34: Calculate the corresponding secondary detection quantity, detection threshold, and corresponding detection probability, i.e., the corresponding ATLO-MV, detection threshold, and... P d .

[0066] S35: Store the detection probability of ATLO-MV .

[0067] S36: Judgment Whether it is true or not, if it is, then it will be The detection probability combination of ATLO-MV of each satellite is a OK Column matrix Otherwise, return to S32.

[0068] S37: Calculation Judgment matrix The If the number of elements in the column is greater than 50%, execute S38; otherwise, determine that there is no interference and execute S39.

[0069] S38: Judgment Matrix The If all elements in the column are greater than 50% of the elements, it is determined to be deceptive interference and S39 is executed; otherwise, it is determined to be natural electromagnetic interference and S39 is executed.

[0070] S39: Judgment If the condition is true, output the result and end the detection; otherwise, return to S37.

[0071] by , For example, the ATLO-MV-MSC detection algorithm process is as follows: Figure 5 As shown.

[0072] Experiments and performance analysis are now being conducted.

[0073] In the induced deception process and detection output, for the induced deception process, the experiment uses DS4 from the TEXBAT dataset of the University of Texas, USA, for deception detection experiments. DS4 is a low-power GNSS navigation deception dataset with deception signal power close to the real signal power. It has a sampling frequency of 25MHz, a code rate of 1.023MHz, a low-power matching traction strategy, a data length of 420s, and a data type of I / Q. For DS4, the deception signal is injected at 100-110s. Based on the above reasons, DS4 is used as the dataset for deception detection experiments to analyze the detection performance of the proposed algorithm, including detection probability, detection immediacy, detection range, and detection accuracy.

[0074] Reference Figure 6 , Figure 6 The figure shows the change of the output of the relevant function over time during the deception process provided in the embodiments of this application; in the figure: (a) the whole process of the change of the relevant peak (b) top view of the relevant peak.

[0075] To verify the effectiveness of the proposed algorithm, taking DS4's PRN13 as an example, we analyze the changes in the output of relevant functions over time during the deception process. Figure 6 As shown. By Figure 6 (a) The entire process of correlation peak changes can be observed, including when there is no deception interference, when a deception signal is injected, and when the tracking loop is locked to the deception signal. Figure 6 (b) is a top view of the correlation peak. Due to the unstable frequency locking of the deception signal to the real signal, the power leakage is manifested as the power jump in the figure.

[0076] Reference Figure 7 , Figure 7 The waveform of the ATLO detection output changes over time as shown in the embodiments of this application.

[0077] The output of the detection quantity is explained below. To address the issue of unsatisfactory detection performance in traditional spoofing detection algorithms, a spoofing detection algorithm based on ATLO-MV is proposed. The ATLO-MV construction process first utilizes the Absolute Tracking Loop Output (ATLO) to construct a primary detection quantity to monitor abnormal changes in the tracking loop output. Further, the ATLO is processed with Moving Average (MV) to obtain the ATLO-MV secondary detection quantity, which suppresses noise and reduces the dynamic range. Taking DS4's PRN6 as an example, a false alarm probability of 10% is preset. The upper and lower limits of the ATLO detection quantity are calculated according to the detection threshold formula. The output waveform changes over time as follows: Figure 7 As shown.

[0078] Reference Figure 8 , Figure 8 The waveform of the ATLO-MV detection output changes over time as shown in the embodiments of this application.

[0079] Depend on Figure 7 The results show that the output waveform of the ATLO detection quantity undergoes a significant jump at 114s and remains higher than the output waveform corresponding to the non-deception stage throughout the second stage. In stages III and IV, although the ATLO output waveform is clearly different from the waveform of the non-deception stage, its fluctuations are very drastic. To reduce the fluctuation range and improve detection performance, a moving window of 100ms is used for MV processing to construct the ATLO-MV detection quantity, and the upper and lower thresholds are calculated according to its detection threshold formula. The output waveform of the ATLO-MV detection quantity is shown below. Figure 8 As shown.

[0080] according to Figure 8 The results analysis shows that the waveform output of ATLO-MV is stable and distortion-free in the first 110s; the waveform of ATLO-MV jumps around 120s; and the waveforms corresponding to stages II to IV all exceed the detection threshold.

[0081] comprehensive Figure 7 and Figure 8 The results show that, compared to the ATLO detection rate, the output waveform of the ATLO-MV detection rate exhibits a clearer trend over time, and after distortion occurs around 110 seconds, it remains distinct from the output waveform under the non-spoofing condition (first 100 seconds). Based on the above analysis, the ATLO-MV detection rate is more advantageous for subsequent spoofing detection compared to ATLO.

[0082] The comparison of detection probabilities will now be explained. (Refer to...) Figure 9 , Figure 9 A schematic diagram comparing the detection probabilities of the original detection algorithms provided in the embodiments of this application; in the figure: (a) for PRN3; (b) for PRN6; (c) for PRN7; (d) for PRN13.

[0083] A false alarm probability of 10% is preset. The upper and lower limits of the detection quantity are calculated based on the detection threshold formula, and then the detection probability is further calculated using the corresponding detection probability formula. To clearly reflect the change of the detection probability over time, a sliding window method is used to calculate the detection probability. Taking PRN3, PRN6, PRN7, and PRN13 as examples, the detection probability results of four algorithms—Delta, PCS, ELP, and ATLO—are as follows: Figure 9 As shown.

[0084] The experimental results show that ATLO's detection probability increases rapidly around 110 seconds and remains higher than that of the other detection methods for most of the time. PCS also experiences a sudden increase in detection probability around 110 seconds, but the increase is less pronounced than that of ATLO. Unlike ATLO and PCS, Delta and ELP's detection probabilities only begin to increase around 200 seconds, exhibiting extremely volatile fluctuations. Compared to Delta, PCS, and ELP algorithms, the ATLO algorithm has a shorter detection response time and a wider detection range.

[0085] Reference Figure 10 , Figure 10 A schematic diagram comparing the detection probabilities of the four MV algorithms provided in the embodiments of this application; in the figure: (a) for PRN3; (b) for PRN6; (c) for PRN7; (d) for PRN13.

[0086] To further analyze the detection performance of each algorithm after MV processing, MV processing was applied to PCS, Delta, ELP, and ATLO respectively. With a fixed window length (ω=100ms), the variance of the original detections within the window was calculated as the new detections, and their corresponding detection probabilities were calculated. Taking PRN3, PRN6, PRN7, and PRN13 as examples, the detection probability curves of PCS-MV, Delta-MV, ELP-MV, and ATLO-MV are shown below. Figure 10 As shown.

[0087] Comparative analysis shows that within the range of (110-300) seconds, the detection probability of ATLO-MV increases rapidly from around 110 seconds and remains above 50% for the vast majority of the time. Besides ATLO-MV, PCS-MV has the highest detection probability exceeding 50%. Unlike ATLO-MV and PCS-MV, ELP-MV and Delta-MV require a longer time and fluctuate more drastically to reach a detection probability exceeding 50%, with Delta-MV taking the longest. Compared to PCS-MV, Delta-MV, and PCS-MV, ATLO-MV has a shorter detection response time, higher detection probability, better robustness, and a wider detection range.

[0088] In summary, compared to Delta, PCS, and ELP, ATLO has a shorter detection response time and a wider detection range. Furthermore, ATLO-MV, enhanced by MV processing, exhibits a higher detection probability and superior robustness compared to ATLO. In conclusion, ATLO-MV boasts higher detection probability, wider detection range, shorter detection response time, and better robustness compared to Delta-MV, PCS-MV, and ELP-MV algorithms.

[0089] The following is an explanation of multi-satellite joint detection.

[0090] In deception environments with natural electromagnetic interference, the detection performance of traditional single-satellite SQM deception detection methods is unsatisfactory or even prone to misjudgment due to the simultaneous presence of deception attacks and natural electromagnetic interference. Based on this, an ATLO-MV-MSC detection algorithm is constructed by combining ATLO-MV information from multiple satellite tracking loops, and its detection performance is analyzed.

[0091] Reference Figure 11 , Figure 11 A schematic diagram comparing the detection probabilities of -MV-MSC provided in the embodiments of this application; in the figure: (a) for ATLO-MV-MSC; (b) for PCS-MV-MSC; (c) for Delta-MV-MSC; (d) for ELP-MV-MSC.

[0092] Detection experiments were conducted based on the tracking loop output information from multiple satellites to evaluate the performance in distinguishing between natural electromagnetic interference and spoofing signals. Taking PRN3, PRN6, PRN7, PRN13, and PRN19 as examples, the detection probabilities of the four MV-MSC algorithms were compared. Figure 11 As shown.

[0093] exist Figure 11 In (a), the detection probability of PRN13 during the (0-110) s time period is... Except for a small range where it exceeds 50%, the rest All are less than 50%, and the detection probability is less than 110 seconds. For those that are relatively stable and all greater than 100%; in Figure 11 In (b), the detection probability during the 0-110s period is mostly less than 50%, while the detection probability during the 110-250s period is consistently greater than 50% and relatively stable. However, the detection probability at 250s varies drastically over time, even falling below 50% in some cases. Figure 11 In (c), the detection probability in the first 190 seconds All were less than 50%, while the detection probability fluctuated drastically after 190 seconds; Figure 11 In (d), the detection probability during the 0-150s time period is... Less than 50%, but after 150 seconds, the fluctuations become more pronounced.

[0094] Combination Figure 11 Based on the data characteristics of the experiment, there is reason to combine the detection probabilities of multiple satellites. Figure 10 Based on the data characteristics of the experiment, there is reason to combine the detection probabilities of multiple satellites. Value-based three-class classification decision rules: Pre-set a decision threshold (For example, take) =50%), at any given time, if the detection probability of 5 satellites is... All less than If the detection probability of 5 satellites is not high, it is considered a scenario without deception or natural electromagnetic interference, and the decision output is recorded as 0; All greater than If the detection probability is 2, then it is determined that a deception scenario exists, and the output of the decision is recorded as 2; For all other cases, the scenario is classified as natural electromagnetic interference, and the decision output is recorded as 1. Based on this decision rule, the detection probabilities of four algorithms—ATLO-MV-MSC, PCS-MV-MSC, Delta-MV-MSC, and ELP-MV-MSC—are used respectively. Scenario-based judgment is performed, and the result is as follows: Figure 12 As shown.

[0095] The three-class classification decision rule is constructed as follows: A decision threshold Pg is pre-set (e.g., Pg = 50%). At any given time, if the detection probabilities Pd of all 5 satellites are less than Pg, the scenario is classified as no deception and no natural electromagnetic interference, and the decision output is recorded as 0; .... P d If the detection probability Pd is greater than Pg, it is judged as a deception scenario, and the decision output is recorded as 2; if the detection probability Pd is any other case, it is judged as a natural electromagnetic interference scenario, and the decision output is recorded as 1. Based on this decision rule, the detection probability Pd of four algorithms—ATLO-MV-MSC, PCS-MV-MSC, Delta-MV-MSC, and ELP-MV-MSC—is used for scenario judgment, and the results are as follows. Figure 12 As shown. (Refer to...) Figure 12 , Figure 12 A schematic diagram of the ternary decision comparison of -MV-MSC provided in the embodiments of this application; in the figure: (a) for ATLO-MV-MSC; (b) for PCS-MV-MSC; (c) for Delta-MV-MSC; (d) for ELP-MV-MSC.

[0096] exist Figure 12 In (a), the decision is 0 in the 0-20s and 30-110s periods, 1 in the 20-30s period, and 2 after 110s, which is basically consistent with the actual situation in the DS4 dataset. Figure 12 In (b), the decision and... Figure 12 (a) The decision is suppressed in the first 270 seconds, but serious misjudgments occur after 270 seconds; Figure 12 (c) and Figure 12The judgments in (d) all deviate significantly from the actual situation. Therefore, it can be concluded that, compared with the PCS-MV-MSC, Delta-MV-MSC, and ELP-MV-MSC algorithms, the ATLO-MV-MSC algorithm can instantly and accurately distinguish between natural electromagnetic interference and deception attacks.

[0097] Based on the above technical description and experimental analysis, to address the problems of large performance fluctuations and the inability to effectively distinguish between spoofing attacks and natural electromagnetic interference in traditional spoofing detection algorithms, a novel detection algorithm based on tracking loop paired output and variance fusion is proposed. The algorithm construction process is as follows: First, a primary detection quantity based on the absolute tracking loop output (ATLO) is constructed using a GNSS receiver to monitor changes in the tracking output; to further improve detection performance, ATLO is enhanced with moving variance (ATLO-MV) to construct a secondary detection quantity; finally, the ATLO-MV-MSC detection algorithm is constructed using the detection probability information of multi-satellite ATLO-MV to distinguish between interference-free conditions, natural electromagnetic interference, and spoofing attacks. Detection experiments are conducted using TEXBAT Scenario 4 (DS4) to analyze the detection performance of the proposed algorithm. The experiments show that: (1) After injection of deception, ATLO has a shorter detection response time and a wider detection range than Delta, ELP and PCS.

[0098] (2) Compared with the other three MV algorithms, ATLO-MV has a higher detection probability and robustness.

[0099] (3) Compared with the PCS-MV-MSC, Delta-MV-MSC and ELP-MV-MSC algorithms, the ATLO-MV-MSC algorithm can distinguish between natural electromagnetic interference, spoofing attacks and no interference in real time and accurately.

[0100] Reference Figure 13 , Figure 13 The diagram shows the structure of the detection system for deception attacks / natural electromagnetic interference provided in this application embodiment; in the diagram: 10, primary detection quantity construction module; 20, secondary detection quantity construction module; 30, ATLO-MV-MSC algorithm construction module.

[0101] like Figure 13 As shown, this embodiment also discloses a detection system for deception attacks / natural electromagnetic interference, applying the detection method for deception attacks / natural electromagnetic interference as described above. The system includes: The first-level detection quantity construction module is used to construct a first-level detection quantity based on the absolute tracking loop output using a GNSS receiver. This first-level detection quantity is used to monitor changes in the absolute tracking loop output. The secondary detection quantity construction module is used to perform moving variance filtering on the primary detection quantity to construct the secondary detection quantity; The ATLO-MV-MSC algorithm building module is used to distinguish between spoofing attacks, natural electromagnetic interference, and interference-free environments by using the detection probability information of secondary detection quantities from multiple satellites.

[0102] This embodiment also discloses a computer device for detecting deception attacks / natural electromagnetic interference, including at least one processor, at least one memory, and a data bus; The processor and the memory communicate with each other via the data bus; The memory stores program instructions that can be executed by the processor, which invokes the program instructions to perform the detection method for deception attacks / natural electromagnetic interference as described above.

[0103] This embodiment also discloses a storage medium on which a computer program is stored, which, when executed by a processor, implements the detection method for deception attacks / natural electromagnetic interference as described above.

[0104] It should be noted that the deception attack / natural electromagnetic interference detection system, computer equipment, and storage medium of this embodiment correspond to the aforementioned deception attack / natural electromagnetic interference detection method. Therefore, any content not specifically described in the deception attack / natural electromagnetic interference detection system, computer equipment, and storage medium of this embodiment, including but not limited to functional definitions, working principles, and technical effects, can be referred to the description in the aforementioned deception attack / natural electromagnetic interference detection method, and will not be repeated here.

[0105] In the embodiments provided in this application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any suitable combination thereof. For hardware implementation, the processor may be implemented in one or more of the following: application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, other electronic units designed to implement the functions described herein, or combinations thereof. For software implementation, some or all of the processes of the embodiments may be performed by a computer program instructing the associated hardware. During implementation, the program may be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media may be any available medium accessible to a computer. Computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code having the form of instructions or data structures and accessible to a computer.

[0106] Finally, it should be noted that the above description is only a preferred embodiment of this application and is not intended to limit this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for detecting deception attacks / natural electromagnetic interference, characterized in that, The method includes: S10: Construct an ATLO first-level detection quantity based on the absolute tracking loop output using a GNSS receiver. This first-level detection quantity is used to monitor changes in the absolute tracking loop output. S20: Perform moving variance filtering on the ATLO primary detection quantity to construct the ATLO-MV secondary detection quantity; S30: The ATLO-MV-MSC algorithm, constructed by combining the ATLO-MV secondary detection quantities of multiple satellites, distinguishes between spoofing attacks, natural electromagnetic interference, and interference-free attacks.

2. The detection method for deception attacks / natural electromagnetic interference according to claim 1, characterized in that, The expression for the ATLO level 1 detection quantity is: in, For the output of the in-phase lead correlator, For the output of the in-phase instantaneous correlator, For the output of the in-phase hysteresis correlator, For the output of the quadrature lead correlator, For the output of the quadrature hysteresis correlator, It is the absolute value symbol.

3. The detection method for deception attacks / natural electromagnetic interference according to claim 1, characterized in that, The expression for the ATLO-MV secondary detection quantity is: in, Indicates the length of the sliding window. L represents the number of sliding windows, and L represents the sliding interval.

4. The detection method for deception attacks / natural electromagnetic interference according to claim 1, characterized in that, The steps of the S30, ATLO-MV-MSC detection algorithm include: S31: Set the number of tracking channels to... The decision interval is seconds, number of judgments Tracking each channel seconds, loop parameter and The initial value is 0; S32: Calculation ; S33: Calculate the... The ATLO value of the channel; S34: Calculate the corresponding ATLO-MV, detection threshold, and corresponding detection probability; S35: Store the detection probability of ATLO-MV; S36: Judgment Whether it is true or not, if it is, then it will be M The detection probability combination of ATLO-MV of each satellite is a OK Column matrix Otherwise, return to S32; S37: Calculation Judgment matrix The If the number of elements in the column is greater than 50%, execute S38; otherwise, determine that there is no interference and execute S39. S38: Judgment Matrix The If all elements in the column are greater than 50% of the elements, it is determined to be deceptive interference and S39 is executed; otherwise, it is determined to be natural electromagnetic interference and S39 is executed. S39: Judgment If the condition is true, output the result and end the detection; otherwise, return to S37.

5. The method for detecting deception attacks / natural electromagnetic interference according to claim 4, characterized in that, The calculation of the detection threshold includes: The detection threshold is determined by substituting the pre-set false alarm probability into the threshold formula, and the detection probability is calculated based on the obtained detection threshold and the joint detection probability formula.

6. The method for detecting deception attacks / natural electromagnetic interference according to claim 5, characterized in that, Define the false alarm probability and substitute it into the threshold expression to determine the detection threshold. include: The expression for the false alarm probability is: in, To detect the upper limit of the threshold, To detect the lower limit of the threshold, This is the case where there is no interference. Based on a pre-set false alarm probability and the expression for the detection threshold, the detection threshold is calculated; the expression for the detection threshold is: in: This represents the mean of ATLO when there is no interference. This represents the offset relative to the mean at a specific false alarm probability, and , It is an inverse Gaussian function. This represents the standard deviation of ATLO when there is no interference.

7. The method for detecting deception attacks / natural electromagnetic interference according to claim 6, characterized in that, The expressions for the false alarm probability and detection probability of the ATLO-MV secondary detection quantity are as follows: in, This represents the total number of samples in ATLO-MV without interference. The number of samples within the sliding window. The detection threshold for ATLO-MV The number of samples that meet the conditions.

8. A detection system for deception attacks / natural electromagnetic interference, employing the detection method for deception attacks / natural electromagnetic interference as described in any one of claims 1 to 7, characterized in that, The system includes: The first-level detection quantity construction module is used to construct ATLO detection quantities based on the absolute tracking loop output using a GNSS receiver, which is used to monitor changes in the tracking loop output; The secondary detection quantity construction module performs moving variance filtering on the ATLO primary detection quantity to construct the ATLO-MV detection quantity, thereby enhancing detection performance; The ATLO-MV-MSC building block constructs an ATLO-MV-MSC detection algorithm using ATLO-MV information from multiple satellites, which is used to distinguish between spoofing attacks, natural electromagnetic interference, and interference-free environments.

9. A computer device for detecting deception attacks / natural electromagnetic interference, characterized in that, Includes at least one processor, at least one memory, and a data bus; The processor and the memory communicate with each other via the data bus; The memory stores program instructions that can be executed by the processor, which invokes the program instructions to perform the detection method for deception attacks / natural electromagnetic interference as described in any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the detection method for deception attacks / natural electromagnetic interference as described in any one of claims 1 to 7.

Images