CN114910931A - Induced deception detection method based on weighted second-order central moment - Google Patents

Abstract

The invention provides an induced spoofing detection method based on a weighted second-order central moment, which belongs to the technical field of spoofing interference detection. First of all, five pairs of monitoring correlators are symmetrically arranged at equal intervals on the left and right of the real-time correlator of each channel of the receiver, and the symmetrically arranged correlators are divided into two groups: left and right, and are calculated according to the output values of the correlators in each group. Then, the weighted second-order central moments of the left and right peaks are calculated; finally, based on the Neyman-Pearson criterion, the difference is compared with the test threshold to accurately determine whether there is cheating interference. The weighted second-order central moment design of the multi-correlator output value of the present invention can better measure the symmetry between the left peak and the right peak, and not only has higher detection efficiency, short detection and alarm time, but also high detection sensitivity. At low rate, the detection probability is greatly improved, and the effective detection of spoofing signals can be realized.

Description

An Inductive Deception Detection Method Based on Weighted Second-Order Central Moments

technical field

The invention relates to an inductive spoofing detection method based on a weighted second-order central moment, and belongs to the technical field of spoofing interference detection.

Background technique

GNSS spoofing and jamming will cause the victim receiver to obtain the wrong position, time, etc., which may pose a huge threat to navigation security. In order to effectively improve the reliability of the GNSS system, anti-spoofing technology is the current research focus, and spoofing jamming detection is one of the key technologies. one. When the receiver is attacked by spoofing, the existence and influence of spoofing interference can be detected in time through an effective spoofing detection method, and corresponding anti-spoofing measures can be taken to reduce or even eliminate the harm, which is very important for the security of GNSS applications.

Inductive spoofing takes over the tracking loop of the victim receiver by gradually adjusting parameters such as power and code rate, so that the target receiver deviates smoothly from the correct position or time, which makes spoofing detection more difficult. Although induced spoofing jamming does not destroy the target receiver tracking loop lock, the correlation peak symmetry distortion (distortion) caused by the interaction of spoofing and real signals is significant. Monitoring (SQM) for spoofing detection. SQM detects abnormally sharp, flat or asymmetric correlation peaks in the tracking output based on the correlator output value to detect distortions and anomalies in the GNSS signal. Among them, the Delta metric method is designed to detect the asymmetry of the correlation peak, and the Ratio metric method is designed to detect whether there is a "dead zone" at the top of the correlation function; the ELP metric (early-late phase metric) method uses the output of the E and L correlators. The Magnitude Difference Metric method uses tracking and monitoring of the difference between the early and late correlator amplitudes to determine GNSS signal distortion and multipath effects; and Two-dimensional (2D) time-frequency analysis is implemented in the code delay domain and Doppler frequency domain to improve the performance and reliability of spoofing detection, but this method causes additional computational complexity; then the PD detector is used for spoofing detection, A power distortion detector is constructed by combining abnormal received power detection and correlation peak distortion detection, which can distinguish spoofing signals, multipath, etc. In direct comparison with detectors, the PD-ML detector shows higher resolution accuracy, but achieves this improved performance at the cost of additional computational complexity.

The core of the above SQM-based spoofing detection technology is to use the Early, Prompt, Late in-phase or quadrature correlator measurement values to compare with the set threshold, and then effectively monitor the change of the correlation peak caused by the spoofing signal. However, for the induced deception with high control precision, slow deception process and concealment, only using the output results of the three correlators to identify the symmetrical distortion of the correlation peak, its resolution is difficult to meet the requirements. Especially in the early stage of the emergence of spoofing signals, the spoofing detection time is long due to fewer correlators, and the traditional receiver does not consider the correlator interval, resulting in incomplete correlation peak curves obtained. Therefore, when the correlation peak symmetry is distorted, Therefore, it is necessary to construct a more reasonable and accurate test statistic, so as to quantify the symmetry distortion of the correlation peak more accurately, so as to detect the induced deception more effectively.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide an induced spoofing detection method based on the weighted second order central moment, so as to improve the detection accuracy and efficiency of spoofing interference.

The present invention provides an induced deception detection method based on a weighted second-order central moment, the method comprising the following steps:

1) Arrange at least 3 pairs of correlators symmetrically on each channel of the receiver, and obtain the output value of each correlator;

2) The symmetrically arranged correlators are divided into left and right groups, and the weighted second-order central moment of the left peak and the weighted second-order central moment of the right peak are obtained according to the weighted calculation of the output value of each correlator in each group, wherein the weighted calculation The weight of each correlator is determined by the interval of the corresponding correlator relative to the immediate correlator and the noise variance of the output value;

3) Difference between the weighted second-order central moment of the left peak and the weighted second-order central moment of the right peak to obtain the difference between the weighted second-order central moment of the left peak and the right peak, and determine its mean and variance according to the distribution of the difference function ;

4) utilize the NP detector to detect the difference: set a false alarm rate, calculate the inspection threshold according to the false alarm rate set and the mean value, variance, compare the obtained difference with the inspection threshold, and judge whether Deception interference exists; when the absolute value of the difference between the difference and the mean value is greater than the inspection threshold, it is determined that there is deception interference.

The present invention sets up multiple pairs of correlators on the receiver relative to the real-time correlators, divides them into left and right groups, and calculates the second-order central moments of each group by weighting according to the output values of the correlators, taking into account the relationship between the multiple correlators, Optimize the weight of the measured value of the correlator, obtain the left peak weighted second-order central moment and the right peak weighted second-order central moment with higher detection resolution through weighted summation, and use the NP detection method to calculate the weighted second-order central moment of the left and right peaks. The central moment difference is detected. The weighted second-order central moment design of the multi-correlator output value of the present invention can better measure the symmetry between the left peak and the right peak, not only has higher detection efficiency, shorter detection and alarm time, but also high detection sensitivity. The detection rate is greatly improved, and the effective detection of spoofing signals can be realized. In practical application, it is of great value to study GNSS receivers equipped with anti-spoofing function.

Further, adjacent correlators are arranged at equal intervals.

Further, the correlators are set to 5 pairs, and the distance between adjacent correlators is 0.2 chips.

By setting more correlators at equal intervals above, more sufficient time-domain transient response data can be obtained, which can better evaluate the dynamic changes of the receiver's correlation peak, and achieve accurate quantification of the symmetry of the correlation peak. the correlation curve.

Further, the calculation formula of the weighted second-order central moment is:

为第 i个相关器的同相支路(I)和正交支路(Q)的输出量的平方和，每个相关器都 包含I支路和Q支路。In the formula, α _i is the weight of the ith correlator, i=1, 2...n, n is the number of correlators,

is the square sum of the outputs of the in-phase branch (I) and the quadrature branch (Q) of the ith correlator, and each correlator includes an I branch and a Q branch.

Further, the calculation formula of the correlator weight is:

为I和Q通道的噪声 方差，k为离散时间。where d _i is the chip spacing of the ith correlator from the center of symmetry,

is the noise variance of the I and Q channels, and k is the discrete time.

By calculating the weight of each correlator in each group through the above process, more accurate weighted second-order central moments of the left and right peaks can be obtained, which can better reflect the symmetry of the correlation peak curve.

Further, described step 3) when determining mean value and variance, need to determine the characteristic function of left peak and right peak weighted second-order central moment difference value first, and this characteristic function is composed of the characteristic function of left peak weighted second-order central moment and right The peak-weighted second-order central moment is multiplied by the characteristic functions, and the calculation formula is as follows:

为左峰加权二阶中心矩的特征函数，

为右峰加权 二阶中心矩的特征函数，δ为WSCM的非中心参数，n为每组相关器的个数。In the formula,

is the characteristic function of the weighted second-order central moment of the left peak,

is the characteristic function of the weighted second-order central moment of the right peak, δ is the non-centrality parameter of WSCM, and n is the number of correlators in each group.

By establishing the eigenfunction of the weighted second-order central moment of the left peak and the eigenfunction of the weighted second-order central moment of the right peak, the mean and variance of the difference between the weighted second-order central moment of the left peak and the right peak can be obtained more conveniently and quickly.

Further, the calculation formula of the difference variance is:

为左峰加权二阶中心矩的特征函数的二次求导，δ为WSCM的非中 心参数。In the formula, Z=WSCM _EL is the weighted second-order central moment difference between the left peak and the right peak, n is the number of correlators in each group,

is the quadratic derivation of the characteristic function of the weighted second-order central moment of the left peak, and δ is the non-centrality parameter of WSCM.

Further, the calculation formula of the test threshold is as follows:

为设置的虚警率，

为加 权二阶中心矩差值的方差。where γ is the test threshold, erfc ^-1 is the inverse Gaussian function,

is the set false alarm rate,

is the variance of the weighted second-order central moment difference.

Description of drawings

Figure 1(a) is a process diagram of the receiver correlation peak before the spoofing signal invades;

Fig. 1(b) is a process diagram of the correlation peak adjustment code rate of the spoofing signal before the spoofing signal invades gradually approaching the real signal correlation peak;

Figure 1(c) is the code phase synchronization diagram of the spoofed signal and the real signal when the spoofed signal invades;

Figure 1(d) is a process diagram of increasing the power and code rate of the spoofing signal when the spoofing signal invades;

Figure 1(e) is the real signal stripping diagram when the spoofed signal invades;

Figure 1(f) is the result after the intrusion of the spoofing signal;

Fig. 2 is the concrete flow chart of spoofing interference detection of the present invention;

Fig. 3(a) shows the position of the correlator of the tracking loop on the correlation function when the conventional receiver is interfered by spoofing;

Fig. 3 (b) is the position on the correlation function of the correlator of the tracking loop when the multi-correlator receiver of the present invention is interfered with by deception;

Fig. 4 is the multi-correlator receiver DLL design diagram of the present invention;

Figure 5(a) is the WSCM result diagram of the left peak;

Figure 5(b) is a comparison of the histogram statistical results of the left peak and the theoretical probability density function;

Figure 5(c) is the WSCM result of the right peak;

Figure 5(d) is a comparison between the histogram statistics of the right peak and the theoretical probability density function;

Figure 6 is a simulation diagram of WSCM under different degrees of freedom;

Figure 7(a) is a three-dimensional diagram of the output process of the receiver tracking loop in Experiment 1;

Figure 7(b) is a top view of the output process of the receiver tracking loop in Experiment 1;

Figure 8(a) is a graph of the detection results of Ratio Metric in Experiment 1;

Figure 8(b) is a graph of the detection results of Delta Metric in Experiment 1;

Figure 8(c) is a graph of the detection results of ELP Metric in Experiment 1;

Figure 8(d) is a graph of the detection amount of WSCM (E-L) in Experiment 1;

Fig. 9 is the time domain change comparison chart of three kinds of traditional SQM Metric and WSCM Metric detection performance in experiment 1;

Figure 10 is a comparison chart of the ROC curves of three traditional SQM Metrics and WSCM Metrics in Experiment 1;

Figure 11(a) is a three-dimensional diagram of the output process of the receiver tracking loop in Experiment 2;

Figure 11(b) is a top view of the output process of the receiver tracking loop in Experiment 2;

Figure 12(a) is a graph of the detection results of Ratio Metric in Experiment 2;

Figure 12(b) is a graph of the detection results of Delta Metric in Experiment 2;

Figure 12(c) is a graph of the detection results of ELP Metric in Experiment 2;

Figure 12(d) is a graph showing the detection amount of WSCM (E-L) in Experiment 2;

Fig. 13 is the time domain change comparison chart of three kinds of traditional SQM Metric and WSCM Metric detection performance in experiment 2;

Figure 14 is a comparison chart of the ROC curves of three traditional SQM Metrics and WSCM Metrics in Experiment 2.

Detailed ways

The specific embodiments of the present invention will be further described below with reference to the accompanying drawings.

The present invention aims to detect the dynamic distortion of the correlation peak which induces the spoofing process, and the instantaneous change of the satellite correlator output caused by the multi-path can be ignored. Since the code phase and power adjustment to induce spoofing is more subtle, for the receiver, it will not cause the tracking loop to lose lock. 1(a)-1(b), it can be seen from Figure 1(a)-1(b) that the attacker estimates the antenna phase center and velocity information of the target receiver by receiving the real signal, and then estimates the carrier frequency and code phase, and then generate a low-power spoofing signal that initially maintains the same carrier frequency as the real signal, but the code phase initially differs by more than 2 chips, and then gradually approaches the real signal by adjusting the code rate. When the spoofing signal invades, as shown in Figure 1(c), the spoofing signal gradually increases the signal power when it is gradually synchronized with the code phase of the real signal, but is still smaller than the power of the real signal, until the spoofing signal reaches the target receiver antenna phase Center, and align with the code phase of the real signal (error less than 0.5 chips), this step is the signal synchronization process. After that (Figure 1(d)-(e)), increase the power and code rate of the spoofing signal, and use the power advantage of the spoofing signal to make the target receiver strip the real signal tracking loop and successfully track the spoofing signal. This step is the signal stripping process. After the intrusion of the spoofed signal, as shown in Figure 1(f), the spoofed signal continues to adjust the code rate to pull away from the correlation peak of the real signal until the spoofed signal is about two chips ahead of the real signal, and then gradually reduces the power to completely achieve the target. control of the receiver.

It can be seen from the above process of inductive deception interference that the deception signal will cause the correlation peak to be distorted in the process of stripping the correlation peak of the real signal. Therefore, the present invention performs deception detection based on the symmetry of the correlation peak. The specific process is shown in Figure 2 As shown, the present invention firstly arranges at least 3 pairs of correlators symmetrically on each channel of the receiver, obtains the output value of each correlator, and obtains the correlation peak curve of each correlator; and then divides the symmetrically arranged correlators into For the left and right groups, the second-order central moments of each group are weighted according to the correlation peak curves of the correlators in each group, respectively, to obtain the weighted second-order central moments of the left peak and the weighted second-order central moments of the right peaks; The weighted second-order central moment of the left peak and the weighted second-order central moment of the right peak are compared; finally, the difference obtained is compared with the test threshold to determine whether there is cheating interference.

Step 1. Correlator settings and acquisition of correlation peak curves

In the present invention, 5 pairs of correlators are symmetrically arranged on the left and right sides of the immediate correlator of each channel of the receiver, and the distances between the adjacent correlators are equal, which are 0.2 chips, that is, the distances between the symmetrically arranged correlators and the immediate correlators are respectively For ±0.2, ±0.4, ±0.6, ±0.8, ±1.0 chips, obtain the output value of each correlator of the receiver, and generate the corresponding correlation peak curve. As other implementations, the number of correlators can be set according to specific receiver hardware and detection accuracy requirements.

Fig. 3(a) and Fig. 3(b) respectively show the position of the correlator of the tracking loop on the correlation function of the traditional receiver machine and the receiver of the present invention with 5 pairs of correlators when they are interfered by spoofing, compared with Next, the receiver in Figure 3(b) uses more pairs of narrow-band and wide-band correlators, which can more completely and quickly respond to the symmetry distortion of the correlation peak. The design of the multi-pair correlator receiver DLL is shown in Figure 4. The receiver converts the radio frequency (RF) signal received by the single antenna (Antenna) into a digital intermediate frequency (IF) signal through the RF Front End (RF Front End). The signal is input to each channel of the receiver, and after carrier stripping, the multi-correlator is used for incoherent integration to obtain the output value of the correlator; among them, the mixed GNSS digital intermediate frequency signal received in the tracking stage can be modeled as a digitized signal corresponding to different PRNs The combination of , which contains three parts, the real satellite signal, the spoofing signal and the noise respectively, is expressed as:

分别是第m颗真实卫星信号的载波 相位、多普勒频率、功率、码延迟，

分别是第q颗真实卫星信号 的载波相位、多普勒频率、功率、码延迟，

和

分别表示 时刻nT_s处设置的第m颗真实和第q颗欺骗信号相对应的PRN序列，η(nT_s)是均 值为零、方差为σ²的加性高斯白噪声(AWGN)，

和

分 别表示第m颗真实和第q颗欺骗PRN卫星信号的导航数据位，下标m和q分别 对应于第m和第q个接收到的真实和欺骗卫星的PRN信号。where T _s is the sampling interval,

are the carrier phase, Doppler frequency, power, and code delay of the mth real satellite signal, respectively,

are the carrier phase, Doppler frequency, power, and code delay of the qth real satellite signal, respectively,

and

represent the PRN sequences corresponding to the m-th real and q-th spoofed signals set at time nT _s , respectively, η(nT _s ) is the additive white Gaussian noise (AWGN) with zero mean and variance σ ² ,

and

represent the navigation data bits of the mth real and qth spoofed PRN satellite signals, respectively, and the subscripts m and q correspond to the mth and qth received PRN signals of the real and spoofed satellites, respectively.

During receiver despreading during the tracking phase, the GNSS receiver correlates the received signal with the local code replica and then performs low-pass filtering, the correlator output u _l [k] is expressed as:

和

分别表示码延迟和多普勒频率估计。where N is the coherent integration interval, k is the number of coherent integrations, kNT _s represents the update time of the correlator output,

and

are the code delay and Doppler frequency estimates, respectively.

和

)相关联，当处于稳定跟踪状 态时，可以认为本地码和真实信号的载波频率和码延迟几乎相同(Δf_l ^a,l≈0，

)，由于相干积分时间通常为1ms，远小于数据码D的长度(20ms)，因 此可以排除数据码D的影响。因此，相关器输出可大致表示为：Assuming that the receiver receives a satellite PRN of 1, the incoherent tracking receiver compares the received signal with a Doppler and code delay close to a locally generated copy of the true signal (

and

), when in a stable tracking state, it can be considered that the carrier frequency and code delay of the local code and the real signal are almost the same (Δf la ^,l _≈ 0,

), since the coherent integration time is usually 1 ms, which is much smaller than the length of the data code D (20 ms), the influence of the data code D can be excluded. Therefore, the correlator output can be roughly expressed as:

分别表示第l个真实信号与本地信号码相位、载 波频率、初始载波相位之差，

分别表示第l个欺骗信号和真 实信号码相位、载波频率、初始载波相位之差，

表示真实信号或欺骗信号与 本地信号的互相关函数，

表示第l个相关器分支输出的方差为σ²的低通 滤波加性高斯噪声分量，由具有近似零均值高斯同相(I)和正交相位(Q)分量 的噪声和残余互相关项组成。In the formula,

Represent the difference between the lth real signal and the local signal code phase, carrier frequency, and initial carrier phase, respectively,

represent the difference between the code phase, carrier frequency, and initial carrier phase of the lth spoofed signal and the real signal, respectively,

represents the cross-correlation function of the real or spoofed signal and the local signal,

represents the low-pass filtered additive Gaussian noise component of variance ^σ2 at the output of the lth correlator branch, consisting of noise and residual cross-correlation terms with approximately zero-mean Gaussian in-phase (I) and quadrature-phase (Q) components.

For the GPS L1 C/A signal, after coherent integration, the normalized cross-correlation function of the local signal and the real signal ranging code is expressed as:

T _c represents the chip duration. In theory, when the code phase difference between the spoofed signal and the real signal is greater than 2 chips, the correlation peaks of the two ranging codes will not overlap, and the spoofed signal will not affect the real signal. , at this time the output of the code domain correlator (assuming that the frequency offset Δf la ^{, L} _is a constant) is a trigonometric function with a width of 2T _c and symmetric with a code offset of zero. Assuming that the code phase of the spoofed signal initially lags behind the real signal by 2 chips, after coherent integration, the normalized cross-correlation function of the ranging code between the spoofed signal and the real signal can be expressed as:

表示欺骗信号和真实信号之间码速率的差值。为简单起见，假 设欺骗信号和真实信号的多普勒频率相同，此时载波相位偏移近似为0或者一个 常数。然后，相关器输出的同相分量和正交分量可以建模为:In the formula,

Represents the difference in code rate between the spoofed signal and the real signal. For simplicity, it is assumed that the Doppler frequency of the spoofed signal and the real signal are the same, and the carrier phase offset is approximately 0 or a constant at this time. Then, the in-phase and quadrature components of the correlator output can be modeled as:

where η _I [kNT _s ] and η _Q [kNT _s ] are white Gaussian noise for each channel, when the spoofing signal does not exist, the Doppler shift error is ignored, and η _I [kNT _s ] and η _Q [kNT _s ] is irrelevant, I _l and Q _l obey a Gaussian distribution theoretically, which can be expressed as:

μ_Q、

分别表示同相和正交相关器输出的均值和方差， 并且假设I-Q相关器的协方差σ_IQ为零。

是后相关噪声的基本方差，N₀是噪 声功率谱密度，C/N₀是接收信号的载噪比。由式(7)可知，当接收机在非相 干模式下工作，欺骗信号对跟踪环路实施诱导式欺骗时，应同时考虑对同相和正 交分量分支的影响。In the formula, μ _I ,

μ _Q ,

represent the mean and variance of the in-phase and quadrature correlator outputs, respectively, and assume that the covariance σ _IQ of the IQ correlator is zero.

is the basic variance of the post-correlation noise, N ₀ is the noise power spectral density, and C/N ₀ is the carrier-to-noise ratio of the received signal. It can be known from equation (7) that when the receiver works in the non-coherent mode and the spoofing signal implements inductive spoofing on the tracking loop, the influence on the in-phase and quadrature component branches should be considered at the same time.

According to the output value of the correlator, the corresponding correlation peak curve is generated. The shape of the correlation peak curve can directly reflect the influence of signal distortion, multipath effect, band-limited distortion and interference on the satellite navigation signal. The present invention mainly considers the influence caused by deception interference. .

Step 2. Weighted second order central moments of left and right peaks

The invention utilizes the second-order central moment characteristic of the waveform to analyze the variation of the correlation peak. The symmetrically arranged correlators are divided into two groups, left and right, and the weighted calculation is performed according to the correlation peak value of each correlator in each group to obtain the weighted second-order central moment of the left peak and the weighted second-order central moment of the right peak respectively. The specific calculation process is as follows:

It is assumed that the correlation peak function in one cycle after normalization is y=f(x), the horizontal axis sampling point of the correlation peak is x _i , the unit is 1 chip, and the vertical amplitude of the correlation peak is _yi . For the normalized correlation curve, in the ideal state, the maximum value of y _i is 1, and the abscissa of the highest point of the correlation peak is x ₀ =0, then the calculation formula of the second-order central moment is:

的值为For incoherent integration, if the number of incoherent integrations is N _nc , then the detection

value of

In the formula, d _i represents the chip spacing of the correlator from the center of symmetry, so the second-order central moment (SCM Metric) expression is:

In the formula, d ₀ =0, representing the highest point of the correlation peak.

且I-Q相关器的协 方差σ_IQ为零。令

本发明设置5对相关器， 所以i＝1、2…5，则有：According to formula (7), it can be known that

And the covariance σ _IQ of the IQ correlator is zero. make

The present invention sets 5 pairs of correlators, so i=1, 2...5, then there are:

μ≠0且

令Y＝AX+b， 其中b为常数矩阵，系数矩阵A为2n阶可逆方阵，其表达式为：In the formula, V ₀ is the covariance matrix, therefore,

μ≠0 and

Let Y=AX+b, where b is a constant matrix, and the coefficient matrix A is an invertible square matrix of order 2n, and its expression is:

The covariance matrix V is expressed as:

其中非中心参数δ＝(Aμ+b)^T(AVA^T)^-1(Aμ+b)。Then the random variable (can be regarded as the quadratic form of the random variable after linear transformation),

where the non-centrality parameter δ=(Aμ+b) ^T (AVA ^T ) ^-1 (Aμ+b).

所以E(AX+b)＝AEX+b＝Aμ+b， D(AX+b)＝D(AX)＝AD(X)A^T＝AVA^T，故随机向量

因为V>0，由正定矩阵分解可知V＝CC^T(C为可逆方阵)，故The specific calculation process of δ is as follows: because

So E(AX+b)=AEX+b=Aμ+b, D(AX+b)=D(AX)=AD(X)A ^T =AVA ^T , so the random vector

Because V>0, it can be known from the positive definite matrix decomposition that V=CC ^T (C is an invertible square matrix), so

AVA ^T =ACC ^T A ^T =AC(AC) ^T (14)

It can be known that A and C are reversible, AC is reversible, let Y=(AC) ^-1 (AX+b), that is, AX+b=(AC)Y, by

EY=E[(AC) ^-1 (AX+b)]=(AC) ^-1 (Aμ+b) (15)

certified

then there are

By definition, the non-centrality parameter is

Taking the constant vector b=0, the actual expression of the second-order central moment is:

对应于相关器间隔为d_i的同相和正交支路的输出量的平方和，其系数 表示为

为了更科学的构建检验统计指标，需要对其系 数进行加权处理，加权后系数各相关器权值α_i满足公式(21)：

The sum of the squares of the outputs of the in-phase and quadrature branches corresponding to the correlator interval d _i , whose coefficients are expressed as

In order to construct the test statistics more scientifically, the coefficients need to be weighted, and the weights α _i of each correlator of the coefficients satisfy formula (21):

Combining formula (20), the expressions of the weighted second-order central moments of the left and right peaks are obtained as follows:

其非中心参数δ满足：From the above analysis, it can be seen that

Its non-centrality parameter δ satisfies:

The weighted second-order central moment of the correlation peak in formula (22) satisfies the non-central chi-square distribution, as shown in Fig. 5(a)-5(d). It can be seen from the figure that when there is no deception signal, the left and right peaks The WSCMs of all approximately obey the non-central chi-square distribution, and the PDFs of the WSCMs of the left and right peaks are approximately consistent, which is consistent with the above theoretical proof, demonstrating the rationality and correctness of the theoretical analysis.

Step 3. Difference between left and right peak weighted second order central moments

In order to better measure the symmetry of the correlation peak, it is necessary to make the difference between the weighted second-order central moment WSCM _E of the left peak of the receiver correlation function and the weighted second-order central moment WSCM _L of the right peak, and record it as WSCM _EL . It can be seen from the above that when the multi-correlator is symmetrically distributed on the correlation function, WSCM _E and WSCM _L also obey χ(2n, δ), and the distribution of WSCM _EL needs to be further determined.

其特征函数为：From the properties of the characteristic function, it can be seen that when

Its characteristic function is:

WSCM _E and WSCM _L are independent of each other, so the characteristic function of WSCM _EL can be expressed as:

The present invention sets 5 pairs of correlators, then n takes a value of 5. According to the central limit theorem, when n tends to be infinite, the non-central chi-square distribution tends to Gaussian distribution. When n is equal to 5, that is, the degree of freedom is equal to 10, the simulation diagram of the non-central chi-square distribution obtained in this example is shown in Figure 6. It can be seen from Figure 6 that when the degree of freedom is larger, the WSCM more approximately obeys the Gaussian distribution, This is consistent with the Central Limit Theorem.

根据特征函数与k阶原 点矩的关系可知，Therefore, it can be approximated that

According to the relationship between the characteristic function and the k-order origin moment, it can be known that,

because,

So the variance is:

It can be seen from the above that when there is no spoofing interference, the spoofing detection statistic—WSCM Metric can be obtained by calculating the weighted second-order central moments of the left and right peaks, and the difference follows a Gaussian distribution with a mean of 0 and a variance of 8n+8δ. When the deceiver implements deception, since the left and right peaks of the correlation function are no longer symmetrical, it can be considered that the WSCM Metric no longer obeys the Gaussian distribution. Using this property, the deception signal can be effectively detected and threats can be eliminated.

Step 4. Spoofing Detection

因此二元假设检验可以表示为：Inductive spoofing detection is actually a binary hypothesis testing problem. The present invention uses the Neyman-Pearson (NP) detector to consider two hypotheses: the null hypothesis, H ₀ , there is no spoofing signal; the alternative hypothesis, H ₁ , has Spoofing signals exist. According to the derivation of the above formula, it can be seen that the test metric

So the binary hypothesis test can be expressed as:

In the formula, Z _t represents the weighted second-order central moment deviation value of the left peak and the right peak, and μ _EL is the mean value. According to the above formula (26), μ _EL is equal to 0.

To construct an NP detector in the absence of a fully defined distribution of alternative hypotheses, combined with Eq. (29), the likelihood function can be defined as:

L(Z _t )=|Z _t -μ _EL | (30)

Using the likelihood function, the false alarm rate for the test threshold γ can be calculated by the following formula:

是指存在欺骗攻 击的假设被接受但事实上不存在的概率。通常，用于计算的检验阈值是指定

和 热噪声水平的函数。对于指定的热噪声C/N₀，最终

也可视为检验阈值的函数， 即在热噪声为定值时，检验阈值和虚警率

相关，通过虚警率确定检验阈值。In formula (35), γ is a reasonable threshold for detecting the existence of cheating, and the false alarm rate

It refers to the probability that the hypothesis that there is a spoofing attack is accepted but in fact does not exist. Typically, the test threshold used for the calculation is specified

and a function of thermal noise level. For a specified thermal noise C/N ₀ , the final

It can also be regarded as a function of the test threshold, that is, when the thermal noise is a constant value, the test threshold and the false alarm rate are

Correlation, the detection threshold is determined by the false alarm rate.

则可通过概率函数求逆来确定检验阈值γ。由于在没有欺骗 的情况下左右峰加权二阶中心矩之差服从高斯分布，因此检验阈值γ可以从下式 得到：if given

The test threshold γ can then be determined by inverting the probability function. Since the difference between the weighted second-order central moments of the left and right peaks follows a Gaussian distribution without cheating, the test threshold γ can be obtained from:

越小，因此这个检验阈值 越接近平均值μ_E-L。较高的信噪比意味着导航信号受到的干扰较小，跟踪回路 可以更好地工作，并以更高的精度获得测量结果。实时计算的WSCM测试值更 可能聚集在某个常数μ_E-L附近，这意味着这些值的方差较小。除非发生中间欺 骗或其他干扰，否则WSCM测试值离μ_E-L太远的概率会非常低。where erfc ^-1 is the inverse Gaussian function. Combining equations (7), (28) and (32), it can be seen that the test threshold γ is closely related to the carrier-to-noise ratio C/N ₀ . If the C/N ₀ is higher, the variance

The smaller, therefore, the closer this test threshold is to the mean μ _EL . A higher signal-to-noise ratio means that the navigation signal is less disturbed, the tracking loop can work better, and measurements can be obtained with greater accuracy. The WSCM test values computed in real time are more likely to cluster around some constant _μEL , which means that these values have less variance. Unless intermediate spoofing or other interference occurs, the probability that the WSCM test value is too far from _μEL will be very low.

The detection probability (P _d ) or detection rate can be theoretically calculated by the following formula:

P _d =ρ(|Z _t -μ _EL |>γ|H ₁ ) (33)

The detection probability (P _d ) refers to the probability that the hypothesis that there is no spoofing attack is accepted and actually exists. When calculating P _d theoretically, the probability distribution of the detection metric in the spoofing state must be known first. However, since its distribution depends on the mode of the spoofing attack, and the spoofing has time-varying characteristics, the receiver does not know how the power and code phase of the spoofed signal change, and in the frequency-locked mode, the carrier phase difference may also have errors. It is impossible for the target receiver to predict the behavior of the spoofer. These factors make the WSCM distribution very complex in the spoofing environment, and it is impractical to derive its PDF analytic formula. Statistical methods are often used instead of P _d to calculate the detection rate of the proposed method. At this time, the expression of P _d is as follows

处的阈值γ，然后，在每个 检测窗口内执行欺骗检测。At this time, P _d is defined as the ratio of the number of samples exceeding the threshold γ to the total number of samples in the presence of a spoofing signal. To obtain P _d , first use equation (32) to calculate given

Then, spoofing detection is performed within each detection window.

To sum up, the final judgment of deception detection is based on:

The difference Z _t between the weighted second-order central moments of the left peak and the right peak and the mean value of the weighted second-order central moments of the left and right peaks obtained by solving the difference, when the absolute value of the obtained difference is greater than the test threshold, judge Deception jamming exists; otherwise, it is determined that deception jamming does not exist.

In order to further illustrate the reliability and practicability of the method of the present invention in the detection of spoofing interference, the data of two different spoofing modes in the TEXBAT database are detected, one of which is a low-power location spoofing attack; the other is a seamless takeover. The attack, which specifically refers to the carrier phase alignment between the spoofing signal and the carrier signal, is a more sophisticated spoofing attack.

Experiment 1: Low Power Spoofing Attack Detection

In this experiment, in order to fully demonstrate the spoofing implementation process, the instantaneous response of the receiver correlation function under multiple correlators in the channel is obtained by improving the GNSS SDR. Taking the PRN6 satellite as an example, the specific output results are shown in Figure 7(a)-7(b). It can be seen from Figures 7(a) and 7(b) that the spoofing signal invades and strips the real signal in the frequency-locked mode after about 100 seconds, and the tracking loop completely locks the spoofing signal after about 300 seconds, and the distance from the real signal is The correlation peak is larger than about one chip. In this process, the spoofed signal maintains a low power advantage of 0.4dB, while trying to maintain a constant carrier phase offset from the real signal. It should be noted that the rate of change of the code phase and the carrier phase does not maintain a constant ratio, but the relative The phase offset moves relative to a constant carrier phase offset. This interaction distorts the symmetry of the correlation peak, and its top view (Fig. 7(b)) highlights the problem of large fluctuations at critical times during the spoofing process. Such fluctuations are mainly due to the frequency of the spoofed signal versus the true signal. The locking is not precise enough, causing the I and Q branch energies to slowly switch to each other, resulting in power leakage.

Experiment 1 uses traditional SQM Metric (Ratio Metric, Detla Metric, ELP Metric) and WSCM Metric for deception detection, and the results are shown in Figures 8(a)-8(d), and Figures 8(a)-8(d) The time-domain instantaneous responses of traditional SQMMetric and WSCM Metric in the process of deception implementation are shown, and the inspection threshold corresponding to a constant false alarm rate of 10% is given. About 100 seconds ago, when the spoof signal was not implemented, the metric value did not change significantly. After 100 seconds, the interaction of the spoof signal and the real signal caused the correlation function of the mixed signal to be distorted, and the metric value changed significantly. In particular, between 110 seconds and 250 seconds, the metric remains stable after 250 seconds, because the tracking loop is completely locked to the spoofing signal. Therefore, significant metric changes resulting from this interaction phase can be used to detect the presence of spoofing signals. Compared with the traditional SQM Metric, the WSCM Metric changes significantly in about 110 seconds to 150 seconds and after 250 seconds (exceeding the inspection threshold), which means that the WSCM Metric can better sense the inaccurate frequency locking. SQM oscillates slightly. It can be seen that under the same false alarm rate, the method of the present invention can detect some small oscillations well.

Further, Figure 9 shows the time domain changes of the detection performance of the traditional SQM Metric and WSCM Metric under the same false alarm rate, where the detection probability is tested and counted every 10 seconds. It can be seen that there is no spoofing interference from 0 to 100 seconds, and the detection probability of the four metrics is about 10%, which is consistent with the set constant false alarm rate of 10%. In the spoofing attack stage from 100 seconds to 250 seconds, the detection performance based on the WSCM Metric spoofing detection technology is significantly better than the traditional SQMMetric technology, most of which can reach 80% to 100%, while the traditional SQM Metric detection probability is mostly below 80%. , Compared with the traditional SQM Metric, the detection probability of the WSCM Metric indicator reaches 79.8% at 120 seconds, while the detection probability of the traditional SQM Metric can reach more than 40% in about 150 seconds, and the early warning time is about 30 seconds earlier. Finally, after 250 seconds, the traditional SQM Metric is about to drop to 10% to 20% above the stable false alarm rate level, but the detection probability based on WSCM Metric can still reach more than 98%. Therefore, the spoofing detection technology based on WSCM Metric can not only shorten the response time, but also improve the detection probability, which is helpful to issue an alarm more quickly and accurately in the presence of spoofing signals.

In order to better and more comprehensively evaluate the detection performance of the deception detection technology based on WSCM Metric, Figure 10 shows the ROC curves of traditional SQM Metric and WSCM Metric. Compared with the traditional SQM Metric, the spoofing detection technology based on the WSCM Metric has more significant advantages, and the detection probability is significantly higher than that of the traditional SQM Metric under the same false alarm rate, and basically reaches more than 90%. In practice, when the receiver requires a low false alarm rate, such as a 10% false alarm rate, the detection probability based on the WSCM Metric deception detection technology is increased by 40.5% compared with the traditional Ratio Metric with better detection performance. When the alarm rate is 0.1%, the detection probability can still reach 87.5%, which has high application value for the receiver to deceive alarm.

Experiment 2: Seamless Takeover Attack

Figures 11(a)-11(b) are the output results of the receiver tracking loop under the seamless takeover attack. It can be seen that there is no spoofing between 0 and 110 seconds, and the correlation peak does not occur at this time. Symmetry distortion. Between 110 seconds and 150 seconds the spoofed signal penetrates the receiver tracking loop, during which the carrier phase is precisely aligned and the power increases nonlinearly. After 150 seconds to 400 seconds keep the Doppler frequency of the spoofed signal exactly the same as the real signal (frequency lock), while adjusting the code phase of all spoofed signals relative to their real counterparts from 0 to 1.2 per second The rate of meters is increased, gradually stripping away the true signal. After the stripping phase, the target receiver tracking loop locks onto the spoofed signal, and the final code phase difference between the real and spoofed signals is about 2 chips. As can be seen from the top view of Figure 11(b), compared to Experiment 1, although there is no relative carrier phase effect in Experiment 2, when the spoofing signal and the real signal are approximately matched in power, it is difficult for spoofing to avoid some kind of constructive or Destructive interference, but it can be seen from Figure 11(a)-(b) that the correlation peak symmetry distortion caused by the interaction of the correlation peaks of the spoofed signal and the real signal is not obvious enough, obviously in this advanced spoofing attack mode It can better test the performance of deception detection technology.

Using traditional SQM Metric and WSCM Metric for spoofing detection, Figures 12(a)-12(d) show the time domain instantaneous response of traditional SQM Metric and WSCM Metric in the process of spoofing implementation, and give the corresponding and constant false alarm rate 10 % inspection threshold. The responses of the four detection indicators from 0 to 110 seconds are consistent with the responses in the case of no spoofing, indicating that there is no spoofing interference. From 110 to 400 seconds, the spoofing signal invades, resulting in symmetrical distortion of the correlation peak. The overall performance of the traditional SQMMetric response is relatively smooth, while the WSCM Metric response changes significantly, especially in the vicinity of 110 to 300 seconds. 110 to 150 seconds), WSCM Metric shows more obvious changes, indicating that WSCM Metric has better detection performance. Compared with Experiment 1, the responses of the four test metrics are generally smaller, because in Experiment 2, finer carrier phase alignment is used, and the power advantage is smaller, but this has no obvious impact on the detection performance of WSCMMetric.

At the same time, Figure 13 shows the detection performance of traditional SQM Metric and WSCM Metric during the whole deception process. The detection performance changes with time. The detection probability is set at a constant false alarm rate of 10%. The threshold is set, and the total number of tests exceeding the threshold is divided every 10 seconds. Calculated from the total number of tests during this period. It can be seen that the detection probability of the four detection techniques from 0 to 110 seconds is close to 10%, which is consistent with the previously set false alarm rate. After 110 seconds, the detection technology based on WSCM Metric has a larger response at 130 seconds, and the detection probability reaches 74.4%, while the three traditional SQM Metric detection technologies have a larger response when it is close to 200 seconds, and the response time is advanced. About 70 seconds, from this aspect, compared with the traditional SQMMetric detection technology, the detection technology based on WSCM Metric has a great advantage in early warning time. Secondly, in the process of deception implementation, the detection probability based on WSCM Metric detection technology reaches 100% between 140 and 300 seconds, and is always above 80% after 300 seconds. The detection probability is significantly better than SQM Metric detection technology. In addition, compared with Experiment 1, the overall detection performance of the detection technology in Experiment 2 is slightly worse in the initial stage of deception implementation, but the detection performance has been significantly improved in the later detection process. Although the spoofing attack modes of Experiment 1 and Experiment 2 are different, the spoofing detection performance based on WSCM Metric detection technology in both scenarios is better than that of traditional SQM Metric detection technology.

Figure 14 shows the ROC curves of traditional SQM Metric and WSCM Metric. Compared with the three traditional SQM Metrics, the ROC curve of WSCM Metric is closer to the upper left corner, indicating that the overall detection performance is better, and WSCM Metric detection under the same false alarm rate conditions The probabilities are higher than the three traditional SQM Metrics, and are basically above 90%. In addition, under the condition of 10% false alarm rate, the detection probability is increased by 24.15% compared with the better detection performance of Delta Metric, which is consistent with the conclusion in Figure 13. In practice, the detection performance advantage based on the WSCM Metric technology is more obvious under the condition that the false alarm rate of the receiver is required to be small. In addition, compared with Experiment 1, although the detection performance of the three traditional SQM Metrics has changed in Experiment 2, the detection performance based on WSCM Metric technology has not changed significantly, indicating that the reliability of WSCM Metric-based technology is better, which is very important for Effectively dealing with complex deception techniques has greatly improved.

In addition, the traditional SQM Metric is difficult to capture the subtle time-varying effects of the relative carrier phase between the signal and the real signal. It can be seen from the above experiments that the proposed WSCM-based spoofing detection method can accurately capture these effects and obtain statistical higher detection rate. Therefore, the detector based on WSCM Metric has good sensitivity and robustness to spoofing jamming under frequency locking, which has great application value for dealing with higher-level spoofing jamming.

Claims (8)

1. An induced deception detection method based on a weighted second-order central moment is characterized by comprising the following steps of:

1) at least 3 pairs of correlators are symmetrically arranged on the left and right of each channel instant correlator of the receiver to obtain the output value of each correlator;

2) dividing the correlators which are symmetrically arranged into a left group and a right group, and respectively carrying out weighted calculation according to the output values of the correlators in each group to obtain a weighted second-order central moment of a left peak and a weighted second-order central moment of a right peak, wherein the weight of each correlator is determined by the interval of the corresponding correlator relative to the instantaneous correlator and the noise variance of the output values during weighted calculation;

3) the weighted second-order central moment of the left peak and the weighted second-order central moment of the right peak are subtracted to obtain a weighted second-order central moment difference value of the left peak and the right peak, and the mean value and the variance of the difference function are determined according to the distribution condition of the difference function;

4) detecting the difference value by using an NP detector: setting a false alarm rate, calculating a detection threshold value according to the set false alarm rate, the mean value and the variance, comparing the obtained difference value with the detection threshold value, and judging whether deception interference exists or not; and when the absolute value of the difference value between the difference value and the mean value is larger than a detection threshold value, judging that deception jamming exists.

2. The method for induced spoof detection based on weighted second-order central moments as in claim 1, wherein adjacent correlators are equally spaced.

3. The method for induced spoof detection based on weighted second order central moments as in claim 1 or 2, wherein the correlators are arranged in 5 pairs, and the distance between adjacent correlators is 0.2 chips.

4. The method for detecting induced spoofing based on weighted second-order central moments as claimed in claim 1, wherein the calculation formula of the weighted second-order central moments is as follows:

in the formula, alpha _i N is the weight of the ith correlator, i is 1,2.. n, n is the number of correlators,

each correlator comprises an I branch and a Q branch, which are the square sums of the outputs of the in-phase branch (I) and the quadrature branch (Q) of the ith correlator.

5. The method for detecting induced spoofing based on weighted second-order central moment as in claim 4, wherein the correlator weight is calculated by the following formula:

in the formula (d) _i The chip spacing of the ith correlator from the center of symmetry,

is the noise variance of the I and Q channels, and k is the discrete time.

6. The induced spoofing detecting method based on weighted second-order central moments as claimed in claim 1 or 4, wherein in the step 3), when determining the mean value and the variance, a feature function of a difference value between the weighted second-order central moments of the left peak and the weighted right peak is determined, the feature function is obtained by multiplying the feature function of the weighted second-order central moments of the left peak and the feature function of the weighted second-order central moments of the right peak, and the calculation formula is as follows:

in the formula (I), the compound is shown in the specification,

the feature function of the second-order central moment is weighted for the left peak,

and weighting a characteristic function of the second-order central moment for the right peak, wherein delta is a non-central parameter of the WSCM, and n is the number of correlators in each group.

7. The method for induced spoof detection based on weighted second order central moments as in claim 1 or 5, wherein the calculation formula of the difference variance is as follows:

wherein Z is WSCM _E-L The difference value of the second-order central moments is weighted by the left peak and the right peak, n is the number of correlators in each group,

the second derivative of the feature function of the second-order central moment is weighted for the left peak, and δ is the non-central parameter of the WSCM.

8. The method for induced spoof detection based on weighted second-order central moments as recited in claim 1, wherein the test threshold is calculated as follows:

where γ is the check threshold, erfc ^-1 Is a function of the inverse of a gaussian function,

in order to set the false alarm rate,

is the variance of the weighted second-order central moment difference.

Images