GNSS Jammer Localization in Urban Areas Based on Carrier-to-Noise Ratio and Classification Methods

Abstract

Global Navigation Satellite Systems (GNSS) are the primary sources of accurate Position, Navigation, and Time (PNT) information to critical infrastructures. As a result, the localization of an intentional jamming source is an important step in securing GNSS resilience as it provides the authorities with technical tools to prevent the jamming action. However, conventional jammer localization methods are all in a way limited in urban areas, and the non-line-of-sight and multipath receptions that are frequently encountered are not well addressed. So in this work, a ray-tracing method is used to simulate the jamming propagation in a real urban environment, and a receiver characterization method is provided to obtain the efective carrier-to-noise ratio measurement. Besides, diferent support-vector-machine-based methods are used to determine the jammer location as a classification problem. A preliminary result with a validation accuracy of 96.2% is provided and proves the feasibility of this method. In the end, the drawbacks and future work plan are summarized.

Keywords

• eol>GNSS
• jammer localization
• urban areas
• classification
• machine learning

1. Introduction

Localization of an intentional jamming source is an important step in securing GNSS resilience as it provides the authorities with tools to prevent the continuation of a detected jamming action. However, the complex signal propagation in dense urban areas makes localization a challenging problem for conventional techniques. Generally, the measurements for jammer localization can be categorized as Received Signal Strength (RSS)/Diferential Received Signal Strength (DRSS), Angle of Arrival (AOA)/Direction of Arrival (DOA), Time of Arrival (TOA)/Time Diference of Arrival (TDOA), and Frequency Diference of Arrival (FDOA) [ 5, 6 ]. The possibility of using automatic gain control (AGC) for jammer localization has been studied in [ 7 ], where the 2D-position of an interference source can be solved by the AGC values from at least three monitoring stations. However, the AGC may saturate [ 7 ] and the localization accuracy declines rapidly for long-distance interference source [ 8 ]. Use of DRSS can solve the problem of unknown transmitter power [ 5 ], [ 9 ] and [ 10 ]. However, for dense urban environments, the none-line-of-sight (NLOS) reception and multipath [11] efect may deteriorate the positioning accuracy significantly, because even simple ground reflections can severely afect the RSS-based methods [12]. AOA is not as popular as other methods because it has the highest implementation complexity. To obtain the AOA measurements, antenna arrays or the antenna that can be precisely rotated or moved are needed [ 4, 13 ]. AOA performance is also poor in the presence of NLOS and multipath signals [ 5 ]. TDOA has been widely used and well developed in radio-network-based navigation systems, but it requires accurate synchronization of the receiver clock among all the monitors to acquire range information, which brings dififculties to implementation. The main disadvantage of TDOA is that it is only suitable for wide-band interference localization [14]. One way to improve this is to use TDOA in combination with some other localization techniques, for example, [15] combines it with AGC, and [14] with AOA, while [16] suggests the jointly estimation of TDOA and FDOA. Another problem is that GNSS signals themselves, as the in-band signals for the jamming, will cause additional peaks in the cross-correlation for TDOA systems [17]. in order to localize moving emitters. Mainly working well for narrow-band interference, FDOA requires the relative movement between the jammer and monitor nodes as well as precise timing and frequency synchronization, and is usually used together with TDOA [18, 19].

Carrier-to-noise ratio (C/N0) is commonly used as an indicator for jamming detection [20], and is receiving increasing attention to be used as the measurement for jammer localization. Because (C/N0) requires no complex equipment, and methods using it can be easily implemented using of-the-shelf receivers. By constructing a model that describes the variation of C/N0 as a function of the distance between the target receiver and interference source, the localization performance is validated without considering the NLOS and multipath reception [ 4, 21 ]. LOS, NLOS and difraction loss models are used to simulate the jamming signals, and a linear formula is fitted to obtain the corresponding efective C/N0 in [ 8 ], but the simulation details are not given.

As a result, though using C/N0 as the measurement for jammer localization is a promising and attractive method, the limitation in urban area remains a significant problem. The effective C/N0 impacted by reflected and difracted jamming signals is dificult to be modeled. Fortunately, the well-explored ray-tracing technologies in mobile-communication community and the use of machine learning models provide good tools to solve this problem. So in this work, ray-tracing technology is used to simulate the jamming propagation in a real-life urban area. And the efective C/N0 outputs of a commercial GNSS receiver under jamming are modeled. Then, the obtained efective C/N0 is used as the measurement, and the jammer localization is described as a classification problem.

Ci/N0|eff =

Ci N0 + kJ =

1 Ci N0 · 1 + k NJ0 , where Ci is the received signal power of the ith satellite, N0 is the noise power spectral density, and J is the received jamming power. k is the Spectral Separation Coeficient (SSC) which models the filtering efect of the receiver on the jamming signal. (1) is converted to log scale as

The rest of this article is organized as follows: the efective carrier-to-noise ratio model is given in section 2. Then, the ray-tracing propagation model is introduced in section 3. Section 4 describes the receiver characterization and modeling. Next, in section 5, a preliminary result is provided which demonstrates the efectiveness of this method in urban jammer localization.

At last, the work plan for the future is given.

2. Efective Carrier-to-noise ratio

Supposing C/N0 is the carrier-to-noise ratio without jamming, the efective

C/N0 output of

the receiver under jamming can be modeled by where the jamming power J is expressed in dBW.

Using the jamming resistance quality factor Q, another expression of (1) given by [ 8 ] is Ci/N0|eff,dB - Hz = Ci/N0|dB - Hz − 10log10 1 + k J )︃ N0 .

After this conversion to logarithmic scale, we can obtain the commonly used C/N0 that is expressed in dB-Hz. Assuming that the jamming power J is considered significantly larger than noise N0, namely k NJ0 ≫

1, we can obtain [4]

Ci/N0|eff,dB - Hz ≈

Ci/N0|dB - Hz − 10log10

− J |dBW, C/N0|eff =

1 1 C/N0

J + SQRC where S is the satellite signal power and RC is the spreading code rate. (4) is converted to log C/N0|eff,dB - Hz = C/N0|dB - Hz − 10log10 1 + C/N0 J )︃ .

SQRC

scale as obtain where SQRC actually functions in the same way with k.

Assuming that the jamming signal power is much greater than the satellite signal, we can C/N0|eff,dB - Hz ≈

C/N0|dB - Hz − 10log10 ︃( C/N0 )︃

SQRC

− J |dBW, ︃( ︃( k )︃

N0 ︃( (1) (2) (3) (4) (5) (6)

3. Ray-tracing propagation model

We have experimented the method using simulated signals. A ray-tracing technique based on real-life city model is developed to guarantee the high dfielity of signal propagation in urban environments. Diferent from the theoretical and empirical models which provide simple formulas for the path-loss calculation, such as, [ 4 ], [ 8 ], and the standards recommended by the International Telecommunication Union-Radiocommunication Sector (ITU-R), ray-tracing is a general propagation modeling tool that provides estimates of path loss, angle of arrival/departure, and time delays by numerically solving Maxwell’s equations [22].

Herein, the Shooting and Bouncing Ray (SBR) [23] provided by MATLAB and the city model from OpenStreetMap are used to simulate the jamming signal propagation loss in Sello shopping center area of Espoo, Finland. The layout of this area can be seen in Figure 1.

By the ray-tracing method introduced in this section, the received jamming power J at each monitor can be obtained. 4. Receiver characterization and modeling Apart from the J obtained from section 3, the spectral separation coeficient k or the jamming resistance quality factor Q needs to be modeled to obtain the efective C/N0 measurement, according to (3) or (6). Though these two values can be learned automatically in the training, we need to determine k first to simulate a jamming scenario. To keep the high fidelity with the future practical real-life validation, a popular and low-cost Ublox F9P GNSS receiver is chosen for the efective C/N0 modeling. Generally, most of the jamming devices transmit a swept tone waveform (chirp) which can be generated from inexpensive devices and is quite efective in rendering GNSS inoperable [ 2, 10 ]. Here, the chirp signal transmit powers ranging from -130 ˜-35 dBm by step 5 dBm, in a 10 MHz band centered at L1 1575.42 MHz, and with a sweep time of 10 µ s were simulated. The chirp signal can be modeled as the combination of (7) (8) multiple saw-tooth functions according to the following expressions[ 10 ]

︄( x (t) = a sin 2π ∑+∞︂ (︃ ∫︂ t h=0 0 f1 (︁ t′ − h · Tsw,1)︁ · dt′ + · · ·

fn (︁ t′ − h · Tsw,n)︁ · dt′ + ∫︂ t

0 fn (t) = ︃{ f0,n + ku,nt, f0,n + (ku,n − kd,n) Tu,n + kd,nt, Tu,n ≤ t < Tsw,n 0 ≤ t < Tu,n where fn(t) represents the nth saw-tooth function with the starting frequency of f0,n. ku,n and kd,n are the positive and negative slope of the saw-tooth function respectively, and Tu,n and Td,n the increasing and decreasing time duration of the saw-tooth function respectively. Tsw,n is the sweep time.

The GPS L1 C/A signal jammed by the chirp signals from an Orolia GSG-8 constellation simulator, shown in Figure 2, was input into the F9P receiver, and the C/N0 outputs under diferent jamming power were logged. The efective C/N0 of GPS SVN 05, SVN 23, and SVN 29 are drawn in Figure 3.

A linear formula was used in [ 8 ] to fitting the linear part below -95 dBm . In this work, to simulate the multipath impacted jamming scenario, the whole range in Figure 3 was fitted using Fourier series. To keep the balance between the accuracy and avoiding over-fitting, 3-4 components are recommended. It is also important to make the lower-frequency component the main part. The fitting results are shown in Figure 4.

The efective

C/N0 model provided here is established according to Ublox F9P, to obtain the C/N0 output of the F9P given a jamming power value from the ray-tracing introduced previously in section 3.

SVN 05 SVN 23

SVN 29 0 -130 -120 -110 -100 -90 -80 -70

Interference Power/dBm -60 -50 -40 -30 5. Simulation and localization experiments 5.1. Simulation settings In our ray-tracing simulation, an urban area about 0.5 km2 around the Sello shopping center of Espoo, Finland was chosen. 7 monitoring nodes were placed 2 m above the building roofs, and 60 jamming emitters were randomly generated on each street out of the 4 streets around the block. So totally 240 jammer samples and 240× 7× 3 C/N0 measurements from 7 nodes and 3 satellites were obtained. One of the ray-tracing examples can be seen in Figure 5. The maximum reflections for each path were set to 5, and the reflections with a relative path loss greater than 40 dB were discarded. The materials of the building and terrain were both set as concrete.

It needs to be noted that the multipath efect in a GNSS receiver is totally diferent from the multipath efect that the jammer encounters. For the fixed GNSS monitors on building roofs in this simulation, multipath changed slowly (for hours) and could be modeled as static. So it was unnecessary to keep GNSS multipath environment exactly the same with the one of jammer multipath. In a more complex scenario, multipath modelling details need to be considered. 5.2. Localization using classification methods By modelling the variation of C/N0 as a function of the distance between the target receiver and jamming source, the jammer may be localized by optimizing a cost function which combines all the C/N0s of the monitoring nodes [ 4, 21 ]. However, the NLOS and multipath signals make the relation between C/N0 and the distance ambiguous and thereby dificult to be modeled. A possible solution is to do the modelling using machine learning, namely as a multi-class

C/N0 from F9P Fourier fitting

C/N0 from F9P

Fourier fitting -5130 -120 -110 -100 -90 -80 -70 -60 -50 -40 -30

Interference Power/dBm -5130 -120 -110 -100 -90 -80 -70 -60 -50 -40 -30

Interference Power/dBm

SVN 29 classification task.

Support vector machines (SVMs) are supervised learning models used for classification and regression problems. SVMs have already been used for jammer localization in [ 8 ]. Herein, SVMs using diferent kernel functions are tested to determine which street the jammer is on. The models include linear, quadratic, and cubic SVMs, and fine, medium, and coarse Gaussian SVMs. The last three methods make finely detailed, medium, and coarse distinctions between classes with kernel scale set to sqrt(P)/4, sqrt(P), and sqrt(P)*4 respectively, where P is the number of predictors. In the validation, a 5-fold cross-validation method is used, and the results can be seen in Figure 6 and Table 1.

According to our experimental results, Cubic SVM achieves the best performance with 96.2% validation accuracy, while Quadratic SVM performs similarly with an accuracy of 95.8%. This demonstrates the potential of using the C/N0 measurements and classification to localize jammers in an urban area with NLOS and multipath propagation. According to the results presented with confusion matrices, the classification mistakes mainly appear between the adjacent streets. Except for fine Gaussian SVM, rare confusions appear between the street 1 and 3, and the street 1 and 4, as seen in Figure 5. This can be partly attributed to the 4 monitors on the street corners because they are usually totally blocked and have no jamming reception. This leads to a conclusion that the placement of the monitors, to a certain extent, is important for jammer localization.

6. Conclusion and future work

Conventional jammer localization methods are all in a way limited in urban areas where the NLOS and multipath receptions are frequent, and the models between the measurements and the ranges between the jammer and monitors become ambiguous. Machine learning-based methods are powerful in solving the ambiguity problem and have not been well explored yet. In this work, SVMs and the easily available C/N0 measurements were used for jammer localization. A preliminary result was provided, and the potential of this method was verified. Also, a detailed jamming multipath simulation method based on receiver characterization was provided and will serve as basis for more realistic further research.

1 2 1.7% 1 98.3% 1.7%

This paper described the very first phase of our ongoing research. In our future research, we will divide the simulated area in finer blocks to get more precise location solution. Secondly, since the C/N0 is not reliable when the jamming is extremely strong, more measurements should be utilized, such as AGC and AOA. Thirdly, we have previously developed an LSTMbased anomaly detection method and based on the good results we will also use LSTM models for jammer localization. At last, real-life data from our ARFIDAAS2 project will be used for experiment validation.

Acknowledgments

This work was funded by the Academy of Finland project 338043 Resilience and security of geospatial data for critical infrastructures (REASON), and the Department of Computer Science, University of Helsinki. International Conference on Localization and GNSS (ICL-GNSS), Turin, Italy, 2013, pp. 1–6. [11] Z. Yan, L. Ruotsalainen, X. Chen, X. Tang, An INS-assisted vector tracking receiver with multipath error estimation for dense urban canyons, GPS Solutions 27 (2023) 1–16. [12] R. J. R. Thompson, E. Cetin, A. G. Dempster, Unknown source localization using rss in open areas in the presence of ground reflections, in: Proceedings of the 2012 IEEE/ION Position, Location and Navigation Symposium, Myrtle Beach, USA, 2012, pp. 1018–1027. [13] E. M. Lloyd, R. J. Watson, Using a bio-inspired algorithm for eficient angle-of-arrival estimation of GNSS jammers, in: 2019 13th European Conference on Antennas and Propagation (EuCAP), Krakow, Poland, 2019, pp. 1–5. [14] E. Cetin, R. J. R. Thompson, A. G. Dempster, Passive interference localization within the GNSS environmental monitoring system (GEMS): TDOA aspects, GPS Solutions 18 (2014) 483–495. [15] J.-H. Lee, H.-P. Kim, J.-H. Won, GNSS cloud-data processing technique for jamming detection and localization, in: ITSNT 2018, International Technical Symposium on Navigation and Timing, Toulouse, France, 2018. URL: https://hal-enac.archives-ouvertes.fr/ hal-01942259. [16] J. A. Bhatti, T. E. Humphreys, B. M. Ledvina, Development and demonstration of a TDOA-based GNSS interference signal localization system, in: Proceedings of the 2012 IEEE/ION Position, Location and Navigation Symposium, Myrtle Beach, USA, 2012, pp. 455–469. [17] E. Cetin, M. Trinkle, A. Bours, G. Gabelli, R. J. Thompson, A. G. Dempster, G. E.

Corazza, Overview of weak interference detection and localization techniques for the GNSS environmental monitoring system (GEMS), in: Proceedings of the 27th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2014), Tampa, USA, 2014, pp. 2250–2259. [18] G. Pojani, Y. Abdoush, M. Bartolucci, J. A. Garcia-Molina, G. E. Corazza, Multiple jammer localization and characterization based on time-frequency analysis, in: 2018 9th ESA Workshop on Satellite NavigationTechnologies and European Workshop on GNSS Signals and Signal Processing (NAVITEC), Noordwijk, Netherlands, 2018, pp. 1–8. [19] J. Garcia-Molina, M. Crisci, Snapshot localisation of multiple jammers based on receivers of opportunity, in: 2016 8th ESA Workshop on Satellite Navigation Technologies and European Workshop on GNSS Signals and Signal Processing (NAVITEC), Noordwijk, Netherlands, 2016, pp. 1–6. [20] D. Borio, C. O’Driscoll, J. Fortuny, GNSS jammers: Efects and countermeasures, in: 2012 6th ESA Workshop on Satellite Navigation Technologies (Navitec 2012) European Workshop on GNSS Signals and Signal Processing, Noordwijk, Netherlands, 2012, pp. 1–7. [21] N. Ahmed, N. Sokolova, RFI localization in a collaborative navigation environment, in: 2020 International Conference on Localization and GNSS (ICL-GNSS), Tampere, Finland, 2020, pp. 1–13. [22] Z. Yun, M. F. Iskander, Ray tracing for radio propagation modeling: Principles and applications, IEEE Access 3 (2015) 1089–1100. [23] H. Ling, R.-C. Chou, S.-W. Lee, Shooting and bouncing rays: calculating the rcs of an arbitrarily shaped cavity, IEEE Transactions on Antennas and Propagation 37 (1989) 194–205.

References

[1] V. Vitan , G. Berz , L. Saini , J.-P. Arethens , B. Belabbas , P. Hotmar, Research on alternative positioning navigation and timing in Europe, in: 2018 Integrated Communications , Navigation, Surveillance Conference (ICNS), Herndon, USA, 2018 , pp. 4D2 - 1 -4D2-17.

[2] T. Humphreys , Interference, in: P. J. Teunissen , O. Montenbruck (Eds.) , Springer Handbook of Global Navigation Satellite Systems , 1st ed., Springer Nature, Gewerbestrasse, Switzerland, 2017 , pp. 469 - 503 .

[3] Z. Yan , X. Chen , X. Tang , L. Ruotsalainen , A novel carrier loop based on adaptive LMQN method in GNSS receivers , IEEE Transactions on Vehicular Technology 71 ( 2022 ) 5259 - 5271 .

[4] D. Borio , C. Gioia , A. Sˇtern , F. Dimc , G. Baldini, Jammer localization: From crowdsourcing to synthetic detection, in: Proceedings of the 29th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2016 ), Portland, Oregon, 2016 , pp. 3107 - 3116 .

[5] A. G. Dempster , E. Cetin, Interference localization for satellite navigation systems , Proceedings of the IEEE 104 ( 2016 ) 1318 - 1326 .

[6] F. Sˇture , T. Morong, P. Kovra,ˇ´ P. Purcieˇr, High performance sdr for monitoring system for gnss jamming localization , in: 2019 International Conference on Wireless Networks and Mobile Communications (WINCOM) , Fez, Morocco, 2019 , pp. 1 - 5 .

[7] J. Lindstrom , D. M. Akos , O. Isoz , M. Junered, GNSS interference detection and localization using a network of low cost front-end modules , in: Proceedings of the 20th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2007 ), Fort Worth, USA, 2007 , pp. 1165 - 1172 .

[8] D. Lyu , X. Chen , F. Wen , L. Pei , D. He , Urban area GNSS in-car-jammer localization based on pattern recognition , Navigation 66 ( 2019 ) 325 - 340 .

[9] S. Bartl , P. Berglez , B. Hofmann-Wellenhof , GNSS interference detection, classification and localization using software-defined radio , in: 2017 European Navigation Conference (ENC) , Lausanne, Switzerland, 2017 , pp. 159 - 169 .

[10] M. Bartolucci , R. Casile , G. E. Corazza , A. Durante , G. Gabelli , A. Guidotti , Cooperative/distributed localization and characterization of gnss jamming interference , in: 2013