Sage Journals: Discover world-class research

Abstract

Covert Global Navigation Satellite System spoofer, called position deceptive tracking controller for unmanned aerial vehicle, is studied via analyzing the error characteristics in this article. Specifically, the following topics are discussed: (1) design the position deceptive tracking controller to make unmanned aerial vehicle deviate from the original path and follow up the spoofed new path point by point, and (2) analyze the related parameters by exploring the characteristics of the initial estimated state errors. Simulation results show the designed controller can realize the position offset of unmanned aerial vehicle unknowingly. What’s more, it can eliminate the initial state errors by selecting appropriate parameters.

Keywords

Position deceptive tracking controller UAV error characteristics initial state errors related parameters

Introduction

On December 4, 2011, there was a big sensational military incident. An unmanned reconnaissance aircraft RQ-170 from the Central Intelligence Agency was captured by Iranian air forces in the eastern border area.¹ An Iranian engineer involved in cracking RQ-170 publicly explained the whole process. Their team first blocked the communication lines and cut off their contact with the ground control center. And then they interrupted the safety connection between RQ-170 and the satellites of Global Navigation Satellite System (GNSS) to force RQ-170 into the automatic navigation state. After these steps, they used unmanned aerial vehicle (UAV) spoofing technology to wrap the error message into seemingly reliably GNSS information, and eventually made UAV land to the designated location. The engineer insisted that the entire deception process had no need to crack the remote control and communication signal between UAV and the accusation center.²

Likewise, similar event occurred again 1 year later. It is said that the Iranian Revolutionary Guard captured “Scan Eagle” in 2012, when this unmanned reconnaissance aircraft was patrolling the Persian Gulf waters, conducting reconnaissance and gathering intelligence. Afterward, Iranian military demonstrated the picture of capturing the drone. This event proved the feasibility of the interference method used in Iran once again.^3,4

Two vessels from the United States sailed into Iranian waters just few hours before US president Barack Obama delivered his final State of the Union speech in January 2016.⁵ The Iranian military intercepted these vessels and captured 10 US sailors. No military official could explain why these vessels had strayed from their intended path. Without a clear explanation, it is speculated that Iran had sent deceptive GNSS signals to deviate the sailors into a scheduled path.⁶

These events, that Iran captured American drones or vessels, are successful applications of deceptive spoofing technology in military affairs, which also had set off an upsurge of research on this field internationally.^7,8 As the navigation satellites are off the ground about 20,000–36,000 km, the power of their signals is very weak, which is usually lower than the noise 20 dB. Hence, GNSS signals are susceptible to malicious interference. GNSS spoofing attack has been taken regard as one of the most imminent threats to almost all cyber-physical system incorporated with the civilian GNSS signal.^9
–11

Regarding the civilian GNSS signals as the breakthrough point, many researchers have proposed a series of unmanned system deceptive schemes. Scholars at Cornell University began to conduct deception interference research for the purpose of trying to “deceive” GNSS receiver.¹² They firstly described how these researchers to place “fake” receivers near the targeted receiving device. And then they analyzed how the “fake” receivers to tamper and transmit the signals from the GNSS satellites. Eventually, they illustrated how the targeted receiving device to use the transmitted false signals.¹³ A paper that described these results was presented at the American Association meeting held in Savannah, Georgia, on September 19, 2008.¹³ Turin Polytechnic University built a simple deception test platform called “Limpet Spoofer.” It proved that the deception jamming technique could draw the receiver from the real signal to the false signal, with an anomaly of the receiver carrier ring and code loop in the total spoofing process.^14,15 The localization navigation team of University of Calgary published several papers on deceptive spoofing technology for GNSS systems. They mainly analyzed the types of deceptive jamming and established the model of the deceptive signals.^16,17

The compression assisted mode, that put the GNSS civil C/A code deceptive signals into the acquisition and tracking loop receiver, was applied in O’Hanlon et al.¹⁸ The experimental results showed that the GNSS receiver could be successfully located at the scheduled position by reasonably controlling the frequency of the deceptive signal. The problem of the delay time about the GNSS deceptive signals was analyzed in Baziar et al.¹⁹ It drew the conclusion that when the sum of the distance from the forwarded satellite to the transponder and the distance from the transponder to the real point is less than the distance from the forwarded satellite to the virtual point, no interference took effect on the receiver clock. Some scholars investigated the influence of the different factors on the performance of the receiver, such as the signal noise ratio, the carrier phase difference, and the code phase difference.²⁰ Furthermore, the capture probability of the forwarding spoofing interference toward GNSS receiver is studied in Ioannides et al.²¹ Simulation results showed that the GNSS receiver spoofing had a higher acquisition probability if the forwarding spoofing only had a small forwarding gain.

The researches in the literature^{12

–21} are mainly in the signal level which is aimed at putting the generated GNSS signals into the unmanned system. There is no theoretical discussion about generating which kind of GNSS signals to achieve targeted covert deception. Todd Humphreys,^{8,22

–29} and his team in the University of Texas had done a lot of work. In their GNSS attack experiment, they set the UAV’s plant as double-integrator dynamics model. Besides, UAV typically employed Kalman filter to estimate their states, and proportional-derivative (PD) algorithm to generate the control commands. They further built the interconnection between the controller, plant, and estimator of the UAV and GNSS spoofer, so as to calculate the required counterfeit GNSS signals. After receiving the counterfeit GNSS signals, the positions, velocities, and times of GNSS receiver were influenced, and then the precise navigation was interfered. The computer processed these signals containing false geographic information and led to wrong navigation.^22
–24 In Shepard et al.,²⁵ the US Department of Homeland Security tested the feasibility of the Todd Humphreys’ deceptive spoofers toward the civilian UAV at the White Sand Missile Range. This experiment achieved the same as the Iranian’s result. Todd Humphreys also succeeded in making a super yacht, named White Rose of Drachs (63 m long, worth 80 million dollar), deviate from its route without the captain’s consciousness.^26
–28,29 It proved that deceptive spoofing technology posed a threat to civilian and military GNSS location devices.

The researches on GNSS spoofing technology are highly confidential for any country. The public, authoritative, and theoretically valuable researches at present are provided by Todd Humphreys. However, it can be found that (1) many parameters are set with no rules in Todd Humphreys’ experiment, and (2) the deceptive tracking controller is too idealistic with no zero error, and there is no way to achieve in reality. In view of the above analysis, this article intends to focus on the design of the deceptive tracking controller and the select of the related spoofed parameters via analyzing the error characteristics.

The article is divided into five sections. The “Unmanned aircraft capture and control via GNSS spoofing” section presents a kind of covert GNSS spoofer, called position deceptive tracking controller. The “Analysis of spoofed parameters via error characteristics” section analyzes the characteristics of the initial state estimated errors that come from GNSS spoofer. Specifically, it deduces the convergence property of these initial errors by analyzing the exponential function of the system matrix. It also makes discussions about the related spoofed parameters. In the “Simulation and analysis” section, experimental results are presented in order to verify the correctness and effectiveness of the proposed theory. The “Conclusions” section concludes the work.

Unmanned aircraft capture and control via GNSS spoofing

The theory and practice of UAV capture and control via GNSS signal spoofing are analyzed and demonstrated by Todd Humphreys and his team. Their designed GNSS spoofer, called the position deceptive tracking controller, has two purposes. One is to force the UAV to far away from a prescribed original path $\bar{x} = {[\bar{r}, \bar{v}]}^{T}$ . The other is to make UAV to track a new spoofed path ${\bar{x}}^{s} = {[{\bar{r}}^{s}, {\bar{v}}^{s}]}^{T}$ . All trajectories are governed by double-integrator dynamics so that given matrices

A = [\begin{matrix} 0 & I \\ 0 & 0 \end{matrix}], B = [\begin{matrix} 0 \\ I \end{matrix}]

that state vector $x = {[r, v]}^{T}$ and the acceleration a, the plant dynamics model is

\dot{x} = A x + B a

The specific process of GNSS spoofing for UAV is given as follow:

1. GNSS spoofer observes the UAV’s position ${\hat{r}}^{s}$ , velocity ${\hat{v}}^{s}$ , and acceleration ${\hat{a}}^{s}$ from low-rate noisy position and velocity measurements. The spoofer’s estimator is modeled as a steady-state linear quadratic estimator

[\begin{matrix} {\dot{\hat{x}}}^{s} \\ {\dot{\hat{a}}}^{s} \end{matrix}] = [\begin{matrix} A & B \\ 0 & 0 \end{matrix}] [\begin{matrix} {\hat{x}}^{s} \\ {\hat{a}}^{s} \end{matrix}] + L^{s} (x - {\hat{x}}^{s})

where $L^{s} = {[{(L_{x}^{s})}^{T} {(L_{b}^{s})}^{T}]}^{T}$ is the spoofer Kalman gain matrix.

2. The controller of GNSS spoofer builds a modified PD compensator

a^{*} = {\hat{a}}^{s} + K^{s} ({\hat{x}}^{s} - {\bar{x}}^{s})

to generate $a^{*}$ , where $K^{s} > 0$ is the control parameters. Further, the counterfeit GNSS signals $x^{*} = {[r^{*}, v^{*}]}^{T}$ are generated by dynamics model ${\dot{x}}^{*} = A x^{*} + B a^{*}$ .

3. The UAV state estimator is Kalman filter that ingests GNSS counterfeit measurements $x^{*}$ and biased accelerometer measurements $a_{m} = a - b$ with the measurement bias b, namely

[\begin{matrix} \dot{\hat{x}} \\ \dot{\hat{b}} \end{matrix}] = [\begin{matrix} A & B \\ 0 & 0 \end{matrix}] [\begin{matrix} \hat{x} \\ \hat{b} \end{matrix}] + L (x^{*} - \hat{x}) + [\begin{matrix} B \\ 0 \end{matrix}] a_{m}

where $L^{T} = [L_{x} ^{T} L_{b} ^{T}]$ is the Kalman gain matrix.

Due to the GNSS counterfeit measurements $x^{*}$ , it causes an erroneous estimate of $\hat{x}$ .

4. The controller of UAV also produces a PD compensator

a = - K (\hat{x} - \bar{x})

where $K > 0$ is the control parameters.

As a result, this control commands make UAV mistake itself for tracking its prescribed original path $\bar{x} = {[\bar{r}, \bar{v}]}^{T}$ . But in fact, UAV is moving slowly toward the new spoofed path ${\bar{x}}^{s} = {[{\bar{r}}^{s}, {\bar{v}}^{s}]}^{T}$ .

As a word, the interconnections between the controller, model, and estimator of the UAV and GNSS spoofer can be represented as a block diagram in Figure 1.

Figure 1.

Block diagram of the coupled UAV and spoofer system showing the interconnections between the controller, plant, and estimator. UAV: unmanned aerial vehicle.

According to Figure 1, the dynamics of the position deceptive tracking controller can be given by

[\begin{matrix} \dot{x} \\ \dot{\hat{x}} \\ \dot{\tilde{b}} \\ \dot{\bar{x}} \\ {\dot{x}}^{*} \\ {\dot{\hat{x}}}^{s} \\ {\dot{\hat{a}}}^{s} \\ {\dot{\bar{x}}}^{s} \end{matrix}] = [\begin{matrix} A & - B K & 0_{6 \times 3} & B K & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} \\ 0_{6 \times 6} & A - L_{x} - B K & B & B K & L_{x} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} \\ 0_{3 \times 6} & - L_{b} & 0_{3 \times 3} & 0_{3 \times 6} & L_{b} & 0_{3 \times 6} & 0_{3 \times 3} & 0_{3 \times 6} \\ 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & A & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} \\ 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} & A & B K^{s} & B & - B K^{s} \\ L_{x}^{s} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} & 0_{6 \times 6} & A - L_{x}^{s} & B & 0_{4 \times 4} \\ L_{b}^{s} & 0_{3 \times 6} & 0_{3 \times 3} & 0_{3 \times 6} & 0_{3 \times 6} & - L_{b}^{s} & 0_{3 \times 3} & 0_{3 \times 6} \\ 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & A \end{matrix}] [\begin{matrix} x \\ \hat{x} \\ \tilde{b} \\ \bar{x} \\ x^{*} \\ {\hat{x}}^{s} \\ {\hat{a}}^{s} \\ {\bar{x}}^{s} \end{matrix}] + [\begin{matrix} 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{3 \times 3} & 0_{3 \times 3} \\ B & 0_{6 \times 3} \\ 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{3 \times 3} & 0_{3 \times 3} \\ 0_{6 \times 3} & B \end{matrix}] [\begin{matrix} \bar{a} \\ {\bar{a}}^{s} \end{matrix}]

where x is the real state vector, $\hat{x}$ is the estimated state vector driven by UAV, $\bar{x}$ is the prescribed reference state vector, $x^{*}$ is potentially spoofed GNSS state vector, ${\hat{x}}^{s}$ is the estimated state vector driven by GNSS spoofer, ${\bar{x}}^{s}$ is the deceptive reference state vector, $\bar{a}$ is the prescribed reference acceleration, ${\bar{a}}^{s}$ is the deceptive reference acceleration, ${\hat{a}}^{s}$ is the estimated acceleration driven by GNSS spoofer, and $\tilde{b}$ is the measurement bias estimated error.

Analysis of spoofed parameters via error characteristics

Obtaining the UAV’s position ${\hat{r}}^{s}$ , velocity ${\hat{v}}^{s}$ , and acceleration ${\hat{a}}^{s}$ in real time is the foundation and premise of the UAV capture and control via GNSS spoofing. According to equation (6), the state estimators of UAV driven by GNSS spoofer are

{\hat{x}}^{s} = A {\hat{x}}^{s} + B {\hat{a}}^{s} + L_{x}^{s} (x - {\hat{x}}^{s})

where x is the observable measurement without error in GNSS spoofer system. But in reality, the error always exists, and there is no doubt that these errors have a certain influence on the effect of UAV fixed-point capture and control via GNSS spoofing. This part is to analyze the characteristics of system errors according to the system movement rule for determining the parameters of GNSS spoofer. This article tries to make discussions about the spoofed parameters via these error characteristics.

Influence mechanism analysis

Suppose that at the beginning of GNSS spoofing attack, there is an initial state error ξ in observing the UAV state by GNSS spoofer

{\hat{χ}}^{s} (0) = {\hat{x}}^{s} (0) + ξ

where $χ$ is the state vector of the position deceptive tracking controller system after the impact of ξ.

Substitute equation (8) into equation (6), then

\frac{d}{d t} {[\begin{matrix} χ \\ \hat{χ} \\ \tilde{δ} \\ \bar{χ} \\ χ^{*} \\ {\hat{χ}}^{s} \\ {\hat{α}}^{s} \\ {\bar{χ}}^{s} \end{matrix}]}_{t = 0} = [\begin{matrix} A & - B K & 0_{6 \times 3} & B K & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} \\ 0_{6 \times 6} & A - L_{x} - B K & B & B K & L_{x} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} \\ 0_{3 \times 6} & - L_{b} & 0_{3 \times 3} & 0_{3 \times 6} & L_{b} & 0_{3 \times 6} & 0_{3 \times 3} & 0_{3 \times 6} \\ 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & A & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} \\ 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} & A & B K^{s} & B & - B K^{s} \\ L_{x}^{s} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} & 0_{6 \times 6} & A - L_{x}^{s} & B & 0_{4 \times 4} \\ L_{b}^{s} & 0_{3 \times 6} & 0_{3 \times 3} & 0_{3 \times 6} & 0_{3 \times 6} & - L_{b}^{s} & 0_{3 \times 3} & 0_{3 \times 6} \\ 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 6} & 0_{6 \times 3} & A \end{matrix}] ({[\begin{matrix} x \\ \hat{x} \\ \tilde{b} \\ \bar{x} \\ x^{*} \\ {\hat{x}}^{s} \\ {\hat{a}}^{s} \\ {\bar{x}}^{s} \end{matrix}]}_{t = 0} + [\begin{matrix} 0 \\ 0 \\ 0 \\ 0 \\ 0 \\ ξ \\ 0 \\ 0 \end{matrix}]) + [\begin{matrix} 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{3 \times 3} & 0_{3 \times 3} \\ B & 0_{6 \times 3} \\ 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{6 \times 3} & 0_{6 \times 3} \\ 0_{3 \times 3} & 0_{3 \times 3} \\ 0_{6 \times 3} & B \end{matrix}] {[\begin{matrix} \bar{a} \\ {\bar{a}}^{s} \end{matrix}]}_{t = 0}

where $\tilde{δ}$ and ${\hat{α}}^{s}$ is the measurement bias estimated error and the estimated acceleration driven by GNSS spoofer after the impact of ξ, respectively.

Subtract equation (6), then

\frac{d}{d t} {[\begin{matrix} χ \\ \hat{χ} \\ \tilde{δ} \\ \bar{χ} \\ χ^{*} \\ {\hat{χ}}^{s} \\ {\hat{α}}^{s} \\ {\bar{χ}}^{s} \end{matrix}]}_{t = 0} - \frac{d}{d t} {[\begin{matrix} x \\ \hat{x} \\ \tilde{b} \\ \bar{x} \\ x^{*} \\ {\hat{x}}^{s} \\ {\hat{a}}^{s} \\ {\bar{x}}^{s} \end{matrix}]}_{t = 0} = [\begin{matrix} 0 \\ 0 \\ 0 \\ 0 \\ B K^{s} ξ \\ (A - L_{x}^{s}) ξ \\ - L_{a}^{s} ξ \\ 0 \end{matrix}]

which means that ξ, not only makes ${\hat{χ}}^{s}$ has an initial error perturbation $(A - L_{x}^{s}) ξ$ but also generates corresponding bias for $x^{*}$ and ${\hat{a}}^{s}$ under the system matrix.

Due to

\dot{\hat{x}} = (A - L_{x} - B K) \hat{x} + B \tilde{b} + B K \bar{x} + L_{x} x^{*}

the bias of $x^{*}$ is superimposed on $\hat{x}$ to enhance the error migration effect.

Meanwhile, the state estimator driven by UAV is

\dot{\hat{x}} = A x - B K \hat{x} + B K \bar{x}

and the changes of $\hat{x}$ from equation (10) lead to the changes of x .

However, it is known from equation (6) that $\bar{x}$ and ${\bar{x}}^{s}$ are only related to its own state

{\begin{matrix} \dot{\bar{x}} = A \bar{x} + B \bar{a} \\ {\dot{\bar{x}}}^{s} = A {\bar{x}}^{s} + B {\bar{a}}^{s} \end{matrix}

Meaning that no matter how ${\hat{χ}}^{s} (0)$ changes, it will not affect those two state variables.

Based on the above analysis, three conclusions can be drawn as follow:

the existence of ξ makes the GNSS spoofing estimator directly generate the initial error disturbance of $(A - L_{x}^{s}) ξ$ ;

the existence of ξ causes bias to other state vectors of the position deceptive tracking controller system, such as $x^{*}$ , $\hat{x}$ , $x$ ; and

the existence of ξ not affects the prescribed reference state vector $\bar{x}$ and the deceptive reference state vector ${\bar{x}}^{s}$ .

Error convergence of GNSS spoofing estimator

According to the kinematic analysis of the linear time-invariant system,³⁰ the solution of the state estimator of UAV driven by GNSS spoofer are obtained

{\hat{x}}^{s} (t) = e^{(A - L_{x}^{s}) t} {\hat{x}}_{0} + \int_{0}^{t} e^{(A - L_{x}^{s}) (t - τ)} (B {\hat{a}}^{s} (τ) + L_{x}^{s} x (τ)) d τ

then

{\hat{χ}}^{s} (t) = e^{(A - L_{x}^{s}) t} (\hat{x} (0) + ξ) + \int_{0}^{t} e^{(A - L_{x}^{s}) (t - τ)} (B {\hat{a}}^{s} (τ) + L_{x}^{s} x (τ)) d τ

Comparing equation (12) with equation (13), then

Δ {\hat{x}}^{s} (t) = {\hat{χ}}^{s} (t) - {\hat{x}}^{s} (t) = e^{(A - L_{x}^{s}) t} ξ

According to the multiplicity of the $A - L_{x}^{s}$ eigenvalues, the discussion is divided into two situations.

For the first case, the eigenvalues of the matrix $A - L_{x}^{s}$ are different, namely

λ_{1} \neq λ_{2} \neq λ_{3} \neq λ_{4} \neq λ_{5} \neq λ_{6} \leq 0

And then it determines the transformation matrix $P$ and its invertible matrix that prompts $A - L_{x}^{s}$ to be diagonal matrix. Further calculation for the arithmetic expression of $e^{(A - L_{x}^{s}) t}$ are

e^{(A - L_{x}^{s}) t} = P [\begin{matrix} e^{λ_{1} t} & 0 & 0 & 0 & 0 & 0 \\ 0 & e^{λ_{2} t} & 0 & 0 & 0 & 0 \\ 0 & 0 & e^{λ_{3} t} & 0 & 0 & 0 \\ 0 & 0 & 0 & e^{λ_{4} t} & 0 & 0 \\ 0 & 0 & 0 & 0 & e^{λ_{5} t} & 0 \\ 0 & 0 & 0 & 0 & 0 & e^{λ_{6} t} \end{matrix}] P^{- 1}

Substitute $P$ and its invertible matrix $P^{- 1}$ into the above equation, then

e^{(A - L_{x}^{s}) t} = [\begin{matrix} c_{11} & c_{12} & c_{13} & c_{14} & c_{15} & c_{16} \\ c_{21} & c_{22} & c_{23} & c_{24} & c_{25} & c_{26} \\ c_{31} & c_{32} & c_{33} & c_{34} & c_{35} & c_{36} \\ c_{41} & c_{42} & c_{43} & c_{44} & c_{45} & c_{46} \\ c_{51} & c_{52} & c_{53} & c_{54} & c_{55} & c_{56} \\ c_{61} & c_{62} & c_{63} & c_{64} & c_{65} & c_{66} \end{matrix}]

where, $c_{n m} = a e^{λ_{1} t} + b e^{λ_{2} t} + c e^{λ_{3} t} + d e^{λ_{4} t} + f e^{λ_{5} t} + g e^{λ_{6} t} (n, m = 1, 2, 3, 4, 5, 6)$

If $A - L_{x}^{s}$ is a nonsingular matrix, all of its eigenvalues have nonpositive real numbers, namely

λ_{i} (i = 1, 2, 3, 4, 5, 6) \leq 0

then

lim_{t \to \infty} e^{λ_{i} t} = 0 (i = 1, 2, 3, 4, 5, 6)

The limit value of each element in $e^{(A - L_{x}^{s}) t}$ is solved

lim_{t \to \infty} c_{n m} = a lim_{t \to \infty} e^{λ_{1} t} + b lim_{t \to \infty} e^{λ_{2} t} + c lim_{t \to \infty} e^{λ_{3} t} + d lim_{t \to \infty} e^{λ_{4} t} + f lim_{t \to \infty} e^{λ_{5} t} + lim_{t \to \infty} g e^{λ_{6} t} = 0 (n, m = 1, 2, 3, 4, 5, 6)

Finally, the limit value of $Δ \hat{x}$ is studied as

\begin{matrix} Δ {\hat{x}}_{\infty} = lim_{t \to \infty} Δ \hat{x} (t) = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} Δ {\hat{x}}_{0} \\ = lim_{t \to \infty} [\begin{matrix} c_{11} & c_{12} & c_{13} & c_{14} & c_{15} & c_{16} \\ c_{21} & c_{22} & c_{23} & c_{24} & c_{25} & c_{26} \\ c_{31} & c_{32} & c_{33} & c_{34} & c_{35} & c_{36} \\ c_{41} & c_{42} & c_{43} & c_{44} & c_{45} & c_{46} \\ c_{51} & c_{52} & c_{53} & c_{54} & c_{55} & c_{56} \\ c_{61} & c_{62} & c_{63} & c_{64} & c_{65} & c_{66} \end{matrix}] Δ {\hat{x}}_{0} = [\begin{matrix} lim_{t \to \infty} c_{11} & lim_{t \to \infty} c_{12} & lim_{t \to \infty} c_{13} & lim_{t \to \infty} c_{14} & lim_{t \to \infty} c_{15} & lim_{t \to \infty} c_{16} \\ lim_{t \to \infty} c_{21} & lim_{t \to \infty} c_{22} & lim_{t \to \infty} c_{23} & lim_{t \to \infty} c_{24} & lim_{t \to \infty} c_{25} & lim_{t \to \infty} c_{26} \\ lim_{t \to \infty} c_{31} & lim_{t \to \infty} c_{32} & lim_{t \to \infty} c_{33} & lim_{t \to \infty} c_{34} & lim_{t \to \infty} c_{35} & lim_{t \to \infty} c_{36} \\ lim_{t \to \infty} c_{41} & lim_{t \to \infty} c_{42} & lim_{t \to \infty} c_{43} & lim_{t \to \infty} c_{44} & lim_{t \to \infty} c_{45} & lim_{t \to \infty} c_{46} \\ lim_{t \to \infty} c_{51} & lim_{t \to \infty} c_{52} & lim_{t \to \infty} c_{53} & lim_{t \to \infty} c_{54} & lim_{t \to \infty} c_{55} & lim_{t \to \infty} c_{56} \\ lim_{t \to \infty} c_{61} & lim_{t \to \infty} c_{62} & lim_{t \to \infty} c_{63} & lim_{t \to \infty} c_{64} & lim_{t \to \infty} c_{65} & lim_{t \to \infty} c_{66} \end{matrix}] Δ {\hat{x}}_{0} = 0 \end{matrix}

named as

Δ {\hat{x}}^{s} ​_{\infty} = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} ξ = 0

For the second case, the eigenvalues of $A - L_{x}^{s}$ belong to the multiplicity condition. Set the eigenvalues of $A - L_{x}^{s}$ as

λ_{1} (σ_{1}, δ_{1}), \dots, λ_{i} (σ_{i}, δ_{i}), \dots, λ_{l} (σ_{l}, δ_{l})

where $σ_{i}$ and $δ_{i}$ are the eigenvalue $λ_{i}$ of the algebraic multiplicity and geometric multiplicity, $i = 1, 2, \dots, l$ $σ_{1} + σ_{2} + \dots + σ_{l} = 6$ . $P$ is the transformation matrix that makes $A - L_{x}^{s}$ to be covenant matrix, and $A - L_{x}^{s}$ can be reduced to the following expression

A - L_{x}^{s} = P [\begin{matrix} J_{1} & ​ & ​ & ​ & ​ \\ ​ & ⋱ & ​ & ​ & ​ \\ ​ & ​ & J_{i} & ​ & ​ \\ ​ & ​ & ​ & ⋱ & ​ \\ ​ & ​ & ​ & ​ & J_{l} \end{matrix}] P^{- 1}, where J_{i} = {[\begin{matrix} λ_{i} & 1 & ​ & ​ & ​ \\ ​ & λ_{i} & 1 & ​ & ​ \\ ​ & ​ & ⋱ & ⋱ & ​ \\ ​ & ​ & ​ & λ_{i} & 1 \\ ​ & ​ & ​ & ​ & λ_{i} \end{matrix}]}_{σ_{i} \times σ_{i}}

Then the arithmetic expression of $e^{(A - L_{x}^{s}) t}$ is counted by

\begin{matrix} e^{(A - L_{x}^{s}) t} = P [\begin{matrix} e^{λ_{1} t} & t e^{λ_{1} t} & \dots & \frac{1}{σ_{1}} t^{σ_{1}} e^{λ_{1} t} & ​ & ​ & ​ & ​ & ​ & ​ \\ 0 & e^{λ_{1} t} & \dots & \frac{1}{σ_{1} - 1} t^{σ_{1} - 1} e^{λ_{1} t} & ​ & ​ & ​ & ​ & ​ & ​ \\ 0 & 0 & ⋱ & ⋮ & ​ & ​ & ​ & ​ & ​ & ​ \\ 0 & \dots & 0 & e^{λ_{1} t} & ​ & ​ & ​ & ​ & ​ & ​ \\ ​ & ​ & ​ & ​ & ⋱ & ​ & ​ & ​ & ​ & ​ \\ ​ & ​ & ​ & ​ & ​ & e^{λ_{i} t} & t e^{λ_{i} t} & \dots & \frac{1}{σ_{i}} t^{σ_{i}} e^{λ_{i} t} & ​ \\ ​ & ​ & ​ & ​ & ​ & ​ & e^{λ_{i} t} & \dots & \frac{1}{σ_{i} - 1} t^{σ_{i} - 1} e^{λ_{i} t} & ​ \\ ​ & ​ & ​ & ​ & ​ & ​ & ​ & ⋱ & ⋮ & ​ \\ ​ & ​ & ​ & ​ & ​ & ​ & ​ & ​ & e^{λ_{i} t} & ​ \\ ​ & ​ & ​ & ​ & ​ & ​ & ​ & ​ & ​ & ⋱ \end{matrix}] P^{- 1} = [\begin{matrix} c_{11} & c_{12} & c_{13} & c_{14} & c_{15} & c_{16} \\ c_{21} & c_{22} & c_{23} & c_{24} & c_{25} & c_{26} \\ c_{31} & c_{32} & c_{33} & c_{34} & c_{35} & c_{36} \\ c_{41} & c_{42} & c_{43} & c_{44} & c_{45} & c_{46} \\ c_{51} & c_{52} & c_{53} & c_{54} & c_{55} & c_{56} \\ c_{61} & c_{62} & c_{63} & c_{64} & c_{65} & c_{66} \end{matrix}] \end{matrix}

where

c_{m n} = \sum_{p = 0}^{σ_{1}} a_{p} \frac{1}{p} e^{λ_{1} t} + \dots + \sum_{q = 0}^{σ_{i}} b_{q} \frac{1}{q} e^{λ_{i} t} + \dots + \sum_{r = 0}^{σ_{l}} c_{r} \frac{1}{r} e^{λ_{l} t} (m, n = 1, 2, 3, 4, 5, 6)

Due to

lim_{t \to \infty} \sum_{n = 0}^{σ_{i}} \frac{1}{n} e^{λ_{i} t} = 0

the limit value of $Δ {\hat{x}}^{s}$ can be computed as

\begin{matrix} Δ {\hat{x}}^{s} ​_{\infty} = lim_{t \to \infty} Δ {\hat{x}}^{s} (t) = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} ξ \\ = lim_{t \to \infty} [\begin{matrix} c_{11} & c_{12} & c_{13} & c_{14} & c_{15} & c_{16} \\ c_{21} & c_{22} & c_{23} & c_{24} & c_{25} & c_{26} \\ c_{31} & c_{32} & c_{33} & c_{34} & c_{35} & c_{36} \\ c_{41} & c_{42} & c_{43} & c_{44} & c_{45} & c_{46} \\ c_{51} & c_{52} & c_{53} & c_{54} & c_{55} & c_{56} \\ c_{61} & c_{62} & c_{63} & c_{64} & c_{65} & c_{66} \end{matrix}] ξ = [\begin{matrix} lim_{t \to \infty} c_{11} & lim_{t \to \infty} c_{12} & lim_{t \to \infty} c_{13} & lim_{t \to \infty} c_{14} & lim_{t \to \infty} c_{15} & lim_{t \to \infty} c_{16} \\ lim_{t \to \infty} c_{21} & lim_{t \to \infty} c_{22} & lim_{t \to \infty} c_{23} & lim_{t \to \infty} c_{24} & lim_{t \to \infty} c_{25} & lim_{t \to \infty} c_{26} \\ lim_{t \to \infty} c_{31} & lim_{t \to \infty} c_{32} & lim_{t \to \infty} c_{33} & lim_{t \to \infty} c_{34} & lim_{t \to \infty} c_{35} & lim_{t \to \infty} c_{36} \\ lim_{t \to \infty} c_{41} & lim_{t \to \infty} c_{42} & lim_{t \to \infty} c_{43} & lim_{t \to \infty} c_{44} & lim_{t \to \infty} c_{45} & lim_{t \to \infty} c_{46} \\ lim_{t \to \infty} c_{51} & lim_{t \to \infty} c_{52} & lim_{t \to \infty} c_{53} & lim_{t \to \infty} c_{54} & lim_{t \to \infty} c_{55} & lim_{t \to \infty} c_{56} \\ lim_{t \to \infty} c_{61} & lim_{t \to \infty} c_{62} & lim_{t \to \infty} c_{63} & lim_{t \to \infty} c_{64} & lim_{t \to \infty} c_{65} & lim_{t \to \infty} c_{66} \end{matrix}] ξ = 0 \end{matrix}

namely

Δ {\hat{x}}^{s} ​_{\infty} = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} ξ = 0

Discussion on spoofer parameters

As a third part device independent of UAV, the position deceptive tracking controller estimates the UAV’s state with the initial state error ξ. It is not expected that the existence of this error affects the position deceptive offset on the UAV. In other word, the free trajectory of the initial state error ξ needs to end up at zero.

According to equations (15) and (16), the shape of the free trajectory of the initial state error ξ is uniquely determined by the matrix exponential function of $A - L_{x}^{s}$ . Different $A - L_{x}^{s}$ leads to different forms of $e^{(A - L_{x}^{s}) t}$ , resulting in different forms of the free trajectory of $Δ {\hat{x}}^{s} _{\infty}$ . What’s more, only when the eigenvalues of $A - L_{x}^{s}$ are placed anywhere in the left half-plane, its matrix exponential function $e^{(A - L_{x}^{s}) t}$ eventually converges to zero, that is, $Δ {\hat{x}}^{s} _{\infty} = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} ξ = 0$ .

The matrix $A$ in the UAV model is fixed, and the position deceptive tracking controller has no way to manually modify it. In addition, the Kalman gain matrix $L^{s} = {[{(L_{x}^{s})}^{T} {(L_{b}^{s})}^{T}]}^{T}$ is obtained by

L^{s} = P^{s} C^{T} {\bar{R}}^{- 1}

where $C = [\begin{matrix} I & 0 \end{matrix}]$ is the measurement matrix; $P^{s}$ is the steady-state spoofer estimation error covariance, and its solution to the continuous algebraic Riccati equation (CARE)

A_{e} P^{s} + P^{s} A_{e}^{T} + \bar{Q} - P^{s} C^{T} {\bar{R}}^{- 1} C P^{s} = 0

$\bar{R}$ and $\bar{Q}$ are the measurement and process matrices for the spoofer estimator, respectively, and

\bar{R} = [\begin{matrix} {\bar{σ}}_{x}^{2} & {\bar{σ}}_{x v}^{2} \\ {\bar{σ}}_{x v}^{2} & {\bar{σ}}_{v}^{2} \end{matrix}], \bar{Q} = [\begin{matrix} 0 & 0 & 0 \\ 0 & 0 & 0 \\ 0 & 0 & {\bar{σ}}_{a}^{2} \end{matrix}]

where ${\bar{σ}}_{x}^{2}$ and ${\bar{σ}}_{v}^{2}$ are the position and velocity measurement noise variance, respectively; ${\bar{σ}}_{x v}^{2}$ is the position velocity measurement; ${\bar{σ}}_{a}^{2}$ is the acceleration process noise variance.

In a word, the position deceptive tracking controller sets the reasonable parameters of $\bar{Q}$ and $\bar{R}$ to calculate the Kalman gain matrix $L^{s} = {[{(L_{x}^{s})}^{T} {(L_{b}^{s})}^{T}]}^{T}$ by equation (17). Then the eigenvalues of matrix $A - L_{x}^{s}$ have negative real parts. It makes further effort to force the matrix exponential function $e^{(A - L_{x}^{s}) t}$ eventually converge to zero, and thereby eliminating the influence of the initial state error on the position deceptive controller due to $Δ {\hat{x}}^{s} _{\infty} = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} ξ = 0$ .

Meanwhile, the choice of $K_{s} > 0$ is equally important for the GNSS spoofer. It needs to ensure the stability of the GNSS spoofer system, that is, the eigenvalues of $A - B K_{s}$ also had to be placed anywhere in the left-half plane.

Simulation and analysis

In order to verify the correctness of the position deceptive tracking controller, and then analyze the influence of parameters setting on this designed controller, three simulation experiments are carried out in this paper. In the first experiment, Table 1 gives the relevant parameters of the position deceptive controller about calculating Ls.

Table 1.

Relevant parameters of the position deceptive tracking controller in the first experiment.

Symbol	${\bar{σ}}_{x}^{2}$	${\bar{σ}}_{v}^{2}$	${\bar{σ}}_{x v}^{2}$	${\bar{σ}}_{a}^{2}$
Unit	m	m/s	m/s	m/s
Value	2	0.3	0	0.5

GNSS: Global Navigation Satellite System.

Then $L^{s} = {[{(L_{x}^{s})}^{T} {(L_{b}^{s})}^{T}]}^{T}$ can be obtained by equation (17)

L_{x}^{s} = [\begin{matrix} 0.1500 & 0 & 0 & 0.9885 & 0 & 0 \\ 0 & 0.1500 & 0 & 0 & 0.9885 & 0 \\ 0 & 0 & 0.1500 & 0 & 0 & 0.9885 \\ 0.0222 & 0 & 0 & 1.8197 & 0 & 0 \\ 0 & 0.0222 & 0 & 0 & 1.8197 & 0 \\ 0 & 0 & 0.0222 & 0 & 0 & 1.8197 \end{matrix}], {(L_{b}^{s})}^{T} = [\begin{matrix} 0.0029 & 0 & 0 \\ 0 & 0.0029 & 0 \\ 0 & 0 & 0.0029 \\ 1.6666 & 0 & 0 \\ 0 & 1.6666 & 0 \\ 0 & 0 & 1.6666 \end{matrix}]

which can make

det (A - L_{x}^{s}) = 0.0746 \neq 0

and

λ_{1} = λ_{2} = λ_{3} = - 0.1501, λ_{4} = λ_{5} = λ_{6} = - 1.8195

It shows that the parameters set in Table 1 are reasonable. The selection of $K^{s} > 0$ meets the requirement that the eigenvalues of $A - B K_{s}$ can be placed anywhere in the left-half plane according to the “Discussion on spoofer parameters” section. Then the spoofer control parameter $K^{s}$ is set as

K^{s} = [\begin{matrix} 0.01 & 0 & 0 & 0.1 & 0 & 0 \\ 0 & 0.01 & 0 & 0 & 0.1 & 0 \\ 0 & 0 & 0.01 & 0 & 0 & 0.01 \end{matrix}]

Set the prescribed acceleration and the reference spoofed acceleration as

\bar{a} = [\begin{matrix} 0.01 sin (0.01 t) \\ 0.01 cos (0.01 t) \\ 0.0001 \end{matrix}], {\bar{a}}^{s} = \bar{a} + [\begin{matrix} 0.0001 \\ - 0.0001 \\ 0.00006 \end{matrix}]

where their corresponding trajectory is obtained by the second integral of the acceleration, like equation (1).

Figure 2 shows the results of the deceptive tracking controller for three-dimensional UAV, consisting of the real state path (red line), the new spoofed path (black line), the estimated state path (green line), and the original path (blue line). Although UAV deviates from the original path and tracks the new path, the estimated state that comes from UAV combined navigation filter output still follows the original path. The results show that utilizing the designed deceptive tracking controller can unconsciously make UAV deviate from the normal path with potentially spoofed GNSS signals, thus achieving UAV spoofing.

Figure 2.

Results of the trajectory tracking control for three-dimensional UAV. UAV: unmanned aerial vehicle.

It is assumed that the initial estimated state errors driven by GNSS spoofer have constant errors, namely, position errors are 10 m and velocity errors are 1 m/s. Figure 3 shows the results of the deceptive tracking controller with initial estimated state errors that driven by GNSS spoofer, and Figure 4 gives the deviation curves of each state vectors. Comparing with Figure 2, the addition of initial state errors from GNSS spoofer do not affect the deceptive tracking controller. Meanwhile, due to the addition of smaller errors, the real path (red line) produces small amplitude oscillation at the beginning of GNSS spoofing on UAV. However, the selection of appropriate parameters, including L ^s and K ^s, makes the whole position deceptive controller stable. More importantly, it can ultimately eliminate the impact of the initial estimated state errors.

Figure 3.

Results of the deceptive tracking control with initial estimated state errors by GNSS spoofer. GNSS: Global Navigation Satellite System.

Figure 4.

Deviation curves of each state vectors in UAV deceptive tracking control system with initial state errors by GNSS spoofer, where (1) x1∼x3-bias represent the real position bias in the direction of X, Y, Z; (2) x7∼x9-bias represent the estimated position bias by UAV in the direction of X, Y, Z; (3) x16∼x18-bias represent the original reference position bias in the direction of X, Y, Z; (4) x22∼x24-bias represent the spoofed GNSS position bias in the direction of X, Y, Z; (5) x28∼x30-bias represent the estimated position bias by GNSS spoofer in the direction of X, Y, Z; (6) x37∼x39-bias represent the spoofed reference position bias in the direction of X, Y, Z. Note that in Figure 4, it seems that not all the states will converge to 0. According to the conclusion analysis in the “Error convergence of GNSS spoofing estimator” section, it can be seen that the addition of the initial estimated state errors have no influence on the original path and the new spoofed path. It means that, the x16∼x18-bias and x37∼x39-bias are theoretically stable at zero. The curves of x16∼x18-bias and x37∼x39-bias in this figure fluctuate because the vertical coordinate is over amplified, that is, the order of magnitude of 10⁻¹³. UAV: unmanned aerial vehicle; GNSS: Global Navigation Satellite System.

The influence of improper parameters on the position deceptive controller is further analyzed. Firstly, the spoofer Kalman gain matrix L ^s is considered. Table 2 shows the relevant parameters of the position deceptive controller about calculating Ls.

Table 2.

Relevant parameters of the position deceptive tracking controller in the second experiment.

Symbol	${\bar{σ}}_{x}^{2}$	${\bar{σ}}_{v}^{2}$	${\bar{σ}}_{x v}^{2}$	${\bar{σ}}_{a}^{2}$
Unit	m	m/s	m/s	m/s
Value	20	3	0	0.5

GNSS: Global Navigation Satellite System.

Then $L^{s} = {[{(L_{x}^{s})}^{T} {(L_{b}^{s})}^{T}]}^{T}$ can be obtained by equation (17)

L_{x}^{s} = [\begin{matrix} 0.1495 & 0 & 0 & 0.9197 & 0 & 0 \\ 0 & 0.1495 & 0 & 0 & 0.9197 & 0 \\ 0 & 0 & 0.1495 & 0 & 0 & 0.9197 \\ 0.0207 & 0 & 0 & 0.5597 & 0 & 0 \\ 0 & 0.0207 & 0 & 0 & 0.5597 & 0 \\ 0 & 0 & 0.0207 & 0 & 0 & 0.5597 \end{matrix}], {(L_{b}^{s})}^{T} = [\begin{matrix} 0.0021 & 0 & 0 \\ 0 & 0.0021 & 0 \\ 0 & 0 & 0.0021 \\ 1.661 & 0 & 0 \\ 0 & 1.661 & 0 \\ 0 & 0 & 1.661 \end{matrix}]

which can make $det (A - L_{x}^{s}) = 0$ . At this point, it can be known from equation (17) that

Δ {\hat{x}}^{s} ​_{\infty} = lim_{t \to \infty} e^{(A - L_{x}^{s}) t} ξ \to \infty

It shows that the parameters set in Table 2 are unreasonable. It means that the effect of the initial state estimated errors not disappear but diverge with time. The following simulation results in Figure 5 verify this theory.

Figure 5.

Deviation curves of each state vectors in UAV deceptive tracking control system with initial state errors by GNSS spoofer, when the spoofer Kaman gain matrix is improper. The expression meanings of the horizontal and vertical coordinates are the same as those of Figure 4. UAV: unmanned aerial vehicle; GNSS: Global Navigation Satellite System.

Secondly, the spoofer control parameter $K^{s}$ is changed as

K^{s} = [\begin{matrix} 0.01 & 0 & 0 & 0.1 & 0.1 & 0.1 \\ 0.1 & 0.01 & 0 & 0 & 0.1 & 0 \\ 0 & 0 & 0.01 & 0 & 0 & 0.01 \end{matrix}]

which can make the eigenvalues of $A - B K_{s}$ are respectively

λ_{1} = - 0.1618 + 0.2058 i, λ_{2} = - 0.1618 - 0.2058 i, λ_{3} = 0.1104, λ_{4} = 0.0132, λ_{5} = - 0.0050 + 0.099 i, λ_{6} = - 0.0050 - 0.099 i

It can be seen that there are two eigenvalues of $A - B K_{s}$ in the right-half plane, which means the spoofer control parameter is not improper. Then the GNSS spoofer system is no longer stable, and Figure 6 shows that the simulation results.

Figure 6.

Deviation curves of each state vectors in UAV deceptive tracking control system with initial state errors by GNSS spoofer, when the spoofer control parameters are improper. The expression meanings of the horizontal and vertical coordinates are the same as those of Figure 4. UAV: unmanned aerial vehicle; GNSS: Global Navigation Satellite System.

Conclusions

The focus of this article is to study the deceptive tracking controller and analyze the characteristics of the initial state errors to help GNSS spoofer select the spoofer parameters. Simulation results show that setting reasonable spoofer parameters can make the designed deceptive tracking controller achieve good spoof effect, meaning UAV deviate from its original path and follow up a new path. What is more, the existence of the initial state errors inevitably affected the deceptive tracking controller, but this effect will gradually weaken under the influence of the system matrix, thus eventually be eliminated. The performance of the initial state errors is reflected in the spoofing that UAV tracked the new spoofed path with deviations in the beginning and then almost matched the spoofed path over time, and ultimately be spoofed into a preset position and be captured. Conclusions are drawn that a small amount of the initial state errors by GNSS spoofer can be allowed in the practical application of this designed deceptive tracking controller.

Footnotes

Acknowledgement

The authors would like to thank all the editors and anonymous reviewers for improving this article.

Declaration of conflicting interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: This work was co-funded by the Hunan project on Science and Technology in China (no. 2017R3045) and the National Hey R&D Program of China (no. 2017YFC0601701).

ORCID iD

Yan Guo

References

Hartmann

Gilles

. UAV exploitation: a new domain for cyber power. In: International conference on cyber conflict IEEE, Tallinn, Estonia, June 2016, pp. 205–221.

Lina

Wang

. Spoofing mitigation in Global Positioning System based on C/A code self-coherence with array signal processing. J Commutat Technol Elect 2017; 1(62): 66–73.

Psiaki

Powell

O’Hanlon

. GNSS spoofing detection using high-frequency antenna motion and carrier-phase data. In: Proceedings of international technical meeting of the Satellite Division of the Institute of Navigation, Nashville, Tennessee, United States, September 2013, pp. 2949–2991.

Fassihi

Julian

. Iran says it captured American drone, to U.S. denials. Wall Street J East Ed 2012; 260(135): 10.

Mark

Humphreys

Stauffer

. Attackers can spoof navigation signals without our knowledge. Here’s how to fight back GNSS lies. IEEE Spect 2016; 53(8): 26–53.

Goward

. Now hear this—“misnavigation” or spoofing? US Naval Institut Proc 2016; 142(4): 10.

Chan

Guizani

. Communication security of unmanned aerial vehicles. IEEE Wirel Commun 2016; PP(99): 2–7.

Psiaki

O’Hanlon

Bhatti

. GNSS spoofing detection via dual-receiver correlation of military signals. Aeros Elect Syst IEEE Trans 2013; 49(4): 2250–2267.

Mpsavi

Nasrpooya

Moazedi

. Advanced anti-spoofing methods in tracking loop. J Navigation 2016; 69(4): 883–904.

10.

Xiaoyuan

Duan

. Synchrophasor data correction under GNSS spoofing attack: a state estimation based approach. IEEE Trans Smart Grid 2017; 9(5): 4538–4546.

11.

Micaela

Truong

Motella

. Hypothesis testing methods to detect spoofing attack: a test against the TEXBAT datasets. J GNSS Solut 2017; 2(21): 577–589.

12.

Cornell University. Researchers raise uncomfortable questions by showing how GNSS navigation devices can be duped. Manassas: Institute of Navigation Meeting, 2008.

13.

Rutkin

. “Spoofers” use fake GNSS signals to knock at yacht off course. Commun Acm 2013; 17(3): 383–391.

14.

Cavaleri

Motella

Pini

. Detection of spoofed GNSS signals at code and carrier tracking level. In: Satellite navigation technologies and European workshop on GNSS signals and signal processing, Noordwijk, Nethelands, February 2011, pp. 1–6. IEEE.

15.

Huang

Presti

Motella

. GNSS spoofing detection: theoretical analysis and performance of the ratio test metric in open sky. ICT Exp 2016; 2(1): 37–40.

16.

Ali

Jafarnia-Jahromi

Lachapelle

. Spoofing detection, classification and cancelation (SDCC) receiver architecture for a moving GNSS receiver. GNSS Solut 2015; 19(3): 475–487.

17.

Ali

Brounandan

Nielsen

. GNSS spoofer countermeasure effectiveness based on signal strength, noise power, and C/N₀ measurements. Int J Satell Comm N 2012; 30(4): 181–191.

18.

O’ Hanlon

Psiaki

Bhatti

. Real-time GNSS spoofing detection via correlation of encrypted signals. Navigation 2013; 60(4): 267–278.

19.

Baziar

Moazedi

Mosavi

. Analysis of single frequency GNSS receiver under delay and combining spoofing algorithm. Wireless Pers Commun 2015; 83(3): 1955–1970.

20.

Tim

. Testing susceptibility to spoofing. GNSS World 2016; 27(11): 31–32.

21.

Ioannides

Pany

Gibbons

. Known vulnerabilities of global satellite systems, status, and potential mitigation techniques. Proc IEEE 2016; 104(6): 1174–1194.

22.

Shepard

Humphreys

. Characterization of receiver response to a spoofing attack. Proc Int Tech Meet Satel Div Instit Navigat 2011; 10(1): 2608–2618.

23.

Montgomery

Humphreys

Ledvina

. Receiver-autonomous spoofing detection: experimental results of a multi-antenna receiver defense against a portable civil GNSS Spoofer. Proc Int Tech Meet Instit Navigat Item 2009; 1(1): 124–130.

24.

Kerns

Shepard

Bhatti

. Unmanned aircraft capture and control via GNSS Spoofing. J Field Robot 2014; 31(4): 617–636.

25.

Shepard

Bhatti

Humphreys

. Evaluation of smart grid and civilian UAV vulnerability to GNSS spoofing attacks. In: ION GNSS Conference, Nashville, Tennessee, United States, September 2012, pp. 3591–3605.

26.

Jahshan

. Sensor deception detection and radio-frequency emitter localization. Austin: the University of Texas, 2015, pp. 45–49.

27.

Psiaki

Humphreys

. GNSS spoofing and detection. Proc IEEE 2016; 104(6): 1258–1270.

28.

Jahshan

Humphreys

. Hostile control of ships via false GNSS signals: demonstration and detection. J Navigation 2017; 64(1): 1–13.

29.

Humphreys

Ledvina

Psiaki

. Assessing the spoofing threat: development of a portable GNSS civilian spoofer. In: International technical meeting of the Satellite Division of the Institute of Navigation, Savanna, Georgia, September 2008, pp. 2314–2325.

30.

Zheng

. Linear system theory. 2nd ed. Beijing: Tsinghua University Press, 2002, pp. 88–98.

Position deceptive tracking controller and parameters analysis via error characteristics for unmanned aerial vehicle

Abstract

Keywords

Introduction

Unmanned aircraft capture and control via GNSS spoofing

Analysis of spoofed parameters via error characteristics

Influence mechanism analysis

Error convergence of GNSS spoofing estimator

Discussion on spoofer parameters

Simulation and analysis

Conclusions

Footnotes

Acknowledgement

Declaration of conflicting interests

Funding

ORCID iD

References