Professional Documents
Culture Documents
Participatory Sensing For Localization of A GNSS Jammer
Participatory Sensing For Localization of A GNSS Jammer
Jammer
Glädje Karl Olsson∗ , Erik Axell∗ , Erik G. Larsson† and Panos Papadimitratos‡
∗ Swedish Defence Research Agency (FOI), Linköping, Sweden
{gladje.karl.olsson, erik.axell}@foi.se
† Linköping University, Linköping, Sweden
erik.g.larsson@liu.se
‡ Royal Institute of Technology (KTH), Stockholm, Sweden
papadim@kth.se
arXiv:2204.13974v1 [eess.SP] 29 Apr 2022
Abstract—GNSS receivers are vulnerable to jamming and the sensors are GNSS receivers embedded in a conncected
spoofing attacks, and numerous such incidents have been re- device and measurements refer to the data available in such
ported worldwide in the last decade. It is important to detect GNSS receivers. GNSS receivers offer a rich interface to radio
attacks fast and localize attackers, which can be hard if not
impossible without dedicated sensing infrastructure. The notion measurements that can be valuable in detecting attacks and
of participatory sensing, or crowdsensing, is that a large ensemble localizing attacking devices. This motivated a number of recent
of voluntary contributors provides the measurements, rather publications that deal with detection or localization of GNSS
than relying on dedicated sensing infrastructure. This work interference using a crowdsensing approach (cf. [1]–[5]).
considers embedded GNSS receivers to provide measurements These works are based on some sort of power measurement,
for participatory jamming detection and localization. Specifically,
this work proposes a novel jamming localization algorithm, based usually through carrier-to-noise-density ratio (C/N0 ) estimates
on participatory sensing, that exploits AGC and C/N0 estimates or automatic gain control (AGC) values, but in some cases
from commercial GNSS receivers. The proposed algorithm does through direct power measurements. C/N0 measurements,
not require knowledge of the jamming power nor of the channels, and sometimes AGC, are provided by all grades of GNSS
but automatically estimates all parameters. The algorithm is receivers, from low-cost to professional, which allows jammer
shown to outperform similar state-of-the-art localization algo-
rithms in relevant scenarios. localization using different types of commercial sensors.
Index Terms—GNSS, jamming, participatory sensing, crowd- [1]–[4] utilizes the C/N0 and a simple distance dependent
sensing path loss model, and computes the jammer position based on
a least squares (LS) solution for multiple receivers. The LS
I. I NTRODUCTION localization algorithm of [1] is derived for a single moving
Global Navigation Satellite System (GNSS) receivers are receiver which can be viewed as a synthetic array. An algo-
widely spread in numerous society-critical services today. At rithm for multiple receivers, that takes the average location of
the same time, GNSS receivers are vulnerable to jamming and those receivers that detect the jammer, is also proposed in [1].
spoofing attacks, and numerous GNSS jamming and spoofing This algorithm is further extended in [5] to obtain a weighted
incidents have been reported worldwide in the last decade. average solution, rather than just a plain average.
Detecting, and more importantly, localizing the source of such There are other related papers that deal with power differ-
attacks is therefore of significant importance. ence of arrival (PDOA) algorithms [6]. These are similar to
Considering that any GNSS equipped device could be tar- exploiting AGC or C/N0 measurements, but they are assumed
geted by an attack, measurements available at GNSS receivers to measure, or estimate, the received power directly. Some of
can be the basis for the detection and localization of an these even assume that the power difference is estimated from
attack at each device. Typically, GNSS receivers are embedded the AGC [6], [7].
in a wide gamut of networked devices (e.g., smart-phones, The model assumptions of [1]–[7] are very similar to those
vehicles). This enables each affected device to share data of used in this work. The main differences are that our work
such an event with other devices, typically with the help of a extends the models of [1]–[7] by assuming an unknown
data aggregating service. This is the notion of participatory channel (i.e., the path loss exponent) between the receivers and
sensing, or crowdsensing: rather than relying on dedicated jammer and a random measurement error is included. This is
sensing infrastructure, a large ensemble of voluntary contrib- necessary for practical application. The work of [7] also deals
utors provides the necessary measurements. In our scenario, with an unknown path loss exponent using time difference
This work was supported in part by Security Link
of arrival (TDOA). That approach, however, requires access
to baseband I/Q data which are not available in a standard
©2022 IEEE. Personal use of this material is permitted. Permission from
IEEE must be obtained for all other uses, in any current or future media, embedded GNSS receiver and is therefore not a suitable
including reprinting/republishing this material for advertising or promotional algorithm for a participatory sensing scenario. In addition,
purposes, creating new collective works, for resale or redistribution to servers
or lists, or reuse of any copyrighted component of this work in other works.
our proposed algorithm does not require pre-calibration of the jamming power is valid for most commercial jammers. The
sensing receivers with respect to the jamming power, contrary receiver positions can be assumed known by integration of
to the algorithms of [1]–[3], [5]. GNSS and other sensors, such as an inertial measurement unit
Mobile phone based crowdsourcing for jamming detection (IMU), embedded in the sensor device (e.g. a cell phone). That
and localization is considered in [8], [9]. The basic concept of is, at any point in time the sensing device has a current own
using AGC or C/N0 measurements from mobile phones for position estimate it uses to geostamp the contributed measure-
localization purposes is proposed in [8], and field trials show ment. It should be noted that the proposed algorithm estimates
the usefulness of these metrics. However, no explicit localiza- a jammer position even if these assumptions do not hold
tion algorithm is proposed in [8]. [9] proposes a localization perfectly, but of course the estimation error becomes larger if,
algorithm based on C/N0 measurements in combination with for example, the jammer moves during the observation time.
step detection and step length estimation using an inertial The goal is to estimate the position p0 of the jammer. The
sensor. The algorithm of [9] assumes a sensor that moves along model for AGC measurements is explained first, followed by
a straight line in two perpendicular directions, which is highly an analogous model for C/N0 estimates.
limiting in a participatory sensing system.
A. AGC
The main contribution of this work is a novel jamming
localization algorithm, based on participatory sensing, that Let hi [n] denote the channel (power) gain between
• does not need any pre-calibration or channel knowledge
the attacker and receiver i at time n. The channel gain
but automatically estimates all parameters, pi [n] depends on the distance di [n] , kp0 − pi [n]k =
h
• exploits AGC or C/N0 estimates, or a combination
(x0 − xi [n])2 + (y0 − yi [n])2 + (z0 − zi [n])2 ). Then, the
thereof, from commercial GNSS receivers, received jamming power Ji [n] is
• outperforms existing similar algorithms in relevant sce- Ji [n] = J0 hi [n].
narios.
A path loss model where hi [n] ∝ 1/di [n]αi yields
II. S YSTEM M ODEL
J0 κ
We do not dwell in this paper on the networking specifics or Ji [n] = ,
di [n]αi
the security and privacy of the collected data (e.g., [10], [11]).
Rather, we assume Nr receivers measure AGC and C/N0 where αi is the path loss exponent for receiver i and κ
and submit those to a central server, where the localization is a proportionality constant. The constant κ depends on,
algorithm is run. Measurements are submitted at a specified for example, carrier frequency and antenna gain, which are
common rate, typically in the order of 1 Hz from a standard constant and equal for all receivers as all antennas are assumed
mobile phone. Submitted data are assumed to be either time- to be isotropic. The path loss exponents αi are assumed to
stamped or can be otherwise synchronized at an accuracy be unknown in this work and are estimated as explained in
within the common time epoch of each measurement. Section III.
The proposed algorithm is based on the following assump- The total received power, denoted by Pi [n], can be written
tions: Nm
X
• the receivers have isotropic antennas, Pi [n] = Ji [n] + NG,i + Ci,j [n],
• the jammer has an isotropic antenna, j=1
T
• the jammer position, denoted by p0 = [x0 , y0 , z0 ] , is where NG,i is the background noise power at the input to
fixed during the time of mesurement, the AGC circuit of receiver i, assumed to be constant during
• the jamming power, denoted by J0 , is constant during the the time of measurement, and Ci,j [n] denotes the power of
time of mesurement, the visible satellite signal j = 1, . . . , Nm at receiver i. The
• receiver noise powers are constant during the time of received powers of the satellite signals (before despreading)
mesurement, are small compared to the receiver noise power and can
• the receiver positions, denoted by pi [n] = therefore be neglected, i.e.,
[xi [n], yi [n], zi [n]]T at time n for receiver i = 1, . . . , Nr ,
J0 κ
are known. Pi [n] ≈ Ji [n] + NG,i = + NG,i .
di [n]αi
These assumptions are also made (explicitly or implicitly) in
[1]–[3], [5]. It should be noted that the assumptions should Let gi [n] be the AGC value for receiver i = 1, . . . , Nr at
be valid only within each measurement time frame, which time n. Then, ideally, ( [12], [13])
is a design parameter. The assumption of isotropic antennas p p
gi [n] Pi [n] = P̄i ,
boils down to an assumption of the channel gains being p
constant during the time of measurement, which is required where P̄i is the desired received signal amplitude. The AGC
for estimating the channel. Constant noise powers within each gain in the absence of jamming (J0 = 0), denoted by ḡi , is
measurement time frame is a fair approximation for the rela- assumed to be known and can be written
tively short measurement times that are of interest. Constant p p
ḡi NG,i = P̄i .
In practice, ḡi can easily be estimated at initialization or by measurement itself in absolute numbers, to avoid significant
long-term estimation. It should be noted that the algorithm variations across devices. Then,
uses the difference relative to the non-jammed AGC value, ḡi , 1
and not the absolute measurement. This is important, because si [n] = s̄i · .
1 + JNiS,i
[n]
the absolute AGC estimates may vary significantly across
devices [14]. Then, By switching to logarithmic scale, i.e. using Si [n] and S̄i
to denote si and s̄i , respectively, in decibels, the measurement
p s s
P̄i NG,i NG,i
gi [n] = p = ḡi = ḡi J κ
. model is written as
Pi [n] Pi [n] di [n]αi + NG,i
0
J0 κ −αi
Si [n] = S̄i − 10log10 di [n] + 1 + wSi [n], (2)
Let Gi [n] and Ḡi denote gi [n] and ḡi , respectively, in deci- NS,i
bels. That is, Gi [n] , 20log10 (gi [n]) and Ḡi , 20log10 (ḡi ).
where wSi [n] ∼ N (0, σS2 i ) , which is analogous to (1). From
Then, the measurement model, with additional measurement
here on, only the AGC measurement model will be used, but
noise, can be written as
the CNIR measurement model can be used in the same way
J0 κ −αi since equations (1) and (2) are identical.
Gi [n] = Ḡi − 10log10 di [n] + 1 + wGi [n], (1)
NG,i
III. JAMMER P OSITION E STIMATION
2
where wGi [n] ∼ N (0, σG,i ) denotes measurement noise. We derive an algorithm that estimates the unknown jammer
B. C/N0 position p0 . In addition to p0 , there are several unknown
nuisance parameters that need to be taken into account. To
Let si,j [n] denote the observed carrier-to-noise-and-
simplify notation, the model is parametrized as follows:
interference ratio (CNIR), which is estimated by the GNSS
receivers and commonly, with slight abuse of terminology, J0 κ
ζi , , ζ , [ζ1 , . . . , ζNr ]T ,
referred to as C/N0 . Let N0,i denote the background noise NG,i
power spectral density at receiver i, and J˜i [n] a spectrally-flat- α , [α1 , . . . , αNr ], σ 2G , [σG,1
2 2
, . . . , σG,N ].
r
equivalent interference noise power density [15] at receiver i.
Then, the CNIR can be written as
Ci,j [n] Ci,j [n] 1 A. Joint Estimation
si,j [n] , = · .
˜ N ˜ [n] To perform joint estimation of the position based on all
N0,i + Ji [n] 0,i 1 + JNi0,i
jammed sensors, Nr , the AGC observations for time instances
Multiplying J˜i [n] and N0,i in the denominator with the n = 1, . . . , N are combined in the matrix
receiver bandwidth, thereby cancelling the bandwidth depen-
G1 [1] G2 [1] . . . GNr [1]
dence, and taking the mean CNIR values from all received G1 [2] G2 [2] . . . GNr [2]
satellite signals yields G, . .. ,
.. ..
.. . . .
Nm
1 X C [n] 1 G1 [N ] G2 [N ] ... GNr [N ]
si [n] = i,j · ,
Nm j=1 N0,i 1 + Ji [n]NS,i
and the known AGC levels in the absence of jamming in the
vector
where NS,i is the noise power experienced in CNIR esti-
Ḡ , Ḡ1 Ḡ2 . . . ḠNr .
mation. Note that the noise power at the CNIR estimator,
NS,i , is not in general equal to the AGC input noise, NG,i . The likelihood function for the AGC measurements is then
NS,i includes additional noise from circuits (such as low- p(G|Ḡ, p0 , α, ζ, σ 2G ) =
noise amplifiers) inbetween the AGC and the CNIR estimator. Nr N
Moreover, it is estimated in the post-correlation step, whereas
Y h 1 X
= 2
(2πσG,i )−N/2 exp − 2 (Gi [n]− (3)
the NG,i noise is experienced on the pre-correlation input i=1
2σG,i n=1
signal. i
(Ḡi − 10log10 (ζi d−α
i
i
[n] + 1)))2 .
Let s̄i be the mean CNIR with no jamming (Ji [n] = 0),
which is assumed to be known. In practice, s̄i can easily be The jammer position is found by maximizing the likelihood
estimated at startup (assuming there is no jamming) or by function as
long-term estimation of the measured CNIR. That is
p∗0 = argmax p(G|Ḡ, p0 , α, ζ, σ 2G ). (4)
Nm
1 X Ci,j [n] p0 ,ζ,σ 2G ,α
s̄i = .
Nm j=1 N0,i