content_image/427699.jpg content_image/427700.jpg content_image/427707.jpg
Second, based on the normal mode data, the receiver pre- dicts the value of the parameter in the future. When it suspects it is under attack, it enters what we term alert mode . In this mode, the receiver compares the predicted values with the ones it obtains from the GNSS functional- ity. If the GNSS-obtained values differ, beyond a protocol- selectable threshold, from the predicted ones, the receiver deems it is under attack . In that case, all PVT solutions obtained in alert mode are discarded. Otherwise, the sus- pected PVT solutions are accepted and the receiver reverts to the normal mode. 

In this work, we consider three parameters: location , time , and Doppler Shift , and we present the corresponding detection mechanisms, Location Inertial Test , Clock Offset Test , and Doppler Shift Test . We emphasize again that all three mechanisms rely on the availability of prior informa- tion collected in normal mode. But they are irrelevant if the receiver starts its operation without any such informa- tion (i.e., a cold start ). 

To evaluate the proposed schemes, we use GPS traces collected by an ASHTECH Z-XII3T receiver that out- puts observation and navigation (.obs and .nav) data into RINEX ( Receiver Independent Exchange Format ) [8]. We implement the PVT solution functionality in Matlab, ac- cording to the receiver interface specification [8]. Our im- plementation operates on the RINEX data, which include pseudoranges and Doppler frequency shift and phase mea- surements. We simulate the movement of receivers over a period of T = 300 s , with their position updated at steps of T$_{step}$ = 1 sec . 

## 4.1 Location Inertial Test 

At the transition to alert mode, the node utilizes own lo- cation information obtained from the PVT solution, to predict positions while in attack mode. If those positions match the suspected as fraudulent PVT ones, the receiver returns to normal mode. We consider two approaches for the location prediction: (i) inertial sensors and (ii) Kalman filtering. 

Inertial sensors , i.e., altimeters, speedometers, odome- ters, can calculate the node (receiver) location indepen- dently of the GNSS functionality. 4 However, the accuracy of such (electro-mechanical) sensors degrades with time. One example is the low-cost inertial MEMS Crista IMU-15 sensor (Inertial Measurement Unit). 

Fig. 3 shows the position error as a function of time [4], which is in our context corresponds to the period the re- ceiver is in the alert mode. As the inertial sensor inaccuracy increases, the node has to accept as normal attack-induced locations. Fig. 4 shows a two-dimensional projection of two trajectories, the actual one and the estimated and er- roneously accepted one. We see that over a short period 

<img src='content_image/427699.jpg'>

<img src='content_image/427700.jpg'>

of time, a significant difference is created because of the attack. 

A more effective approach is to rely on Kalman filtering of location information obtained during normal mode. Pre- dicted locations can be obtained by the following system model: 

with S$_{k}$ being the system state, i.e., location ( X$_{k}$, Y$_{k}$, Z$_{k}$ ) and velocity ( V x$_{k}$, V y$_{k}$, V z$_{k}$ ) vectors, Φ$_{k}$ the transition matrix, and W$_{k}$ the noise. Fig. 5 illustrates the location offset for a set of various trajectories. Unlike the case that only inertial sensors are used, with measurements of iner- tial sensors (with the error characteristics of Fig. 3 used as data when GNSS signals are unavailable, filtering pro- vides a linearly increasing error with the period of GNSS unavailability. 

Overall, for short unavailability periods, inertial mech- anisms can be effective. As long as the error (Y axes of Figs. 4, 5) does not grow significantly, the replay attack can be detected. But for sufficiently high errors, the re- play attack impact can remain undetected. We remind the reader that the x-axes in Fig. 2 provide the duration of the spoofing attack - the transmission (replay) of GNSS signals - and they are not to be confused with the duration of the GNSS period of unavailability in the x-axis of Figs. 4, 5. 

<img src='content_image/427707.jpg'>

