KR102350194B1 - Method for GPS Spoofing Detection with GPS Receivers Leveraging Inaccuracies of GPS Spoofing Devices and Apparatus Therefore - Google Patents

Abstract

Disclosed are a method for detecting a GPS spoof attack using a difference in output values of a GPS receiver caused by inaccuracy of a GPS spoofing signal generating apparatus, and an apparatus therefor. A GPS deception attack detection method according to an embodiment of the present invention comprises the steps of: receiving a GPS signal; and determining the received GPS signal as a GPS satellite signal or a GPS spoof signal using a learning model learned based on the difference in the output values of the GPS receiver, including the position, speed and time output from the GPS receiver Collecting the scattering degree data by labeling the GPS satellite signal and the GPS deceptive signal; and learning the learning model by using the collected data.

Description

Method for GPS Spoofing Detection with GPS Receivers Leveraging Inaccuracies of GPS Spoofing Devices and Apparatus Therefore

The present invention relates to a technique for detecting a GPS spoof attack using a difference in output values of a GPS receiver, and more particularly, to a method and apparatus for detecting a GPS spoof attack using a difference in output values of a GPS receiver.

Because of its high accuracy, low cost, and ubiquitous accessibility, GPS, a wireless navigation system using satellites, is widely used in many consumer devices such as smartphones and car navigation systems, as well as safety-critical systems such as airplanes, ships, trains, and power grids. The highly accurate location and timing information obtainable from GPS enables many advanced features, including location-based smartphone services, autonomous vehicle navigation, and wide-area grid monitoring. However, this excessive reliance on GPS also increases concerns about the security of GPS. In particular, research results have shown that a GPS deceptive attack in which the location and time of a target GPS receiver is manipulated by an enemy can threaten human life and the safety of critical infrastructure. For example, GPS spoofing attacks can hijack ships and drones. It has also been demonstrated that an adversary can use a GPS spoofing attack to brake a Tesla Model 3 and veer off its lane, and a GPS spoofing attack on the power grid's phasor-measuring device could potentially cause a power outage. It has been argued that there may be.

In this regard, several GPS deception detection methods have been proposed, such as spatial processing methods, signal power monitoring methods, arrival time discrimination methods, and signal quality monitoring methods. Therefore, it has not yet been applied to commercial GPS receivers and GPS-dependent systems. Accordingly, most existing GPS-dependent systems are vulnerable to GPS deception attacks.

Embodiments of the present invention provide a method and an apparatus for detecting a GPS spoofing attack using a difference in output values of a GPS receiver.

A GPS deception attack detection method according to an embodiment of the present invention comprises the steps of: receiving a GPS signal; and determining the received GPS signal as a GPS satellite signal or a GPS spoof signal using a learning model learned based on a difference in output values of the GPS receiver.

Furthermore, a method for detecting a GPS spoof attack according to an embodiment of the present invention includes: collecting scattering degree data output from the GPS receiver, including location, speed, and time, by labeling whether a GPS satellite signal or a GPS spoofing signal; and learning the learning model by using the collected data.

In the collecting step, with respect to the GPS satellite signal and the GPS spoof signal, the scattering degree data of the position output of the GPS receiver is calculated, the accuracy estimate of the GPS receiver is collected using the calculated scattering degree data, and the learning The step of learning the learning model by using the collected accuracy estimate.

The learning model is a multi-layer perceptron model in which the output layer is a softmax layer, a support vector machine (SVM) model, a decision tree model, and a convolutional neural network (CNN) model of any one machine learning model. Models can be included.

In the determining step, when the output value of the learning model with respect to the received GPS signal exceeds a preset threshold value, it may be detected as a GPS deception attack.

A GPS deception attack detection method according to another embodiment of the present invention comprises the steps of: receiving a GPS signal; and discriminating the received GPS signal as a GPS satellite signal or a GPS spoofing signal using a learning model learned based on a difference in signals generated due to the characteristics of the signal generating principle of the GPS spoofing signal generating apparatus.

Furthermore, a method for detecting a GPS fraud attack according to another embodiment of the present invention includes: collecting scattering degree data output from a GPS receiver by labeling a GPS satellite signal and a GPS fraud signal; and learning the learning model by using the collected data.

A GPS deception attack detection apparatus according to an embodiment of the present invention includes a receiver for receiving a GPS signal; and a determining unit for discriminating the received GPS signal as a GPS satellite signal or a GPS deceptive signal using a learning model learned based on a difference in output values of the GPS receiver.

Furthermore, the GPS deception attack detection apparatus according to an embodiment of the present invention collects scattering degree data including the position, speed and time output from the GPS receiver by labeling whether the GPS satellite signal and the GPS deception signal are present, and the collection It may further include a learning unit for learning the learning model by using the data.

The learning unit calculates dispersion degree data of the position output of the GPS receiver with respect to the GPS satellite signal and the GPS spoof signal, collects an accuracy estimate of the GPS receiver using the calculated dispersion degree data, and the collected accuracy An estimate can be used to train the learning model.

The learning model is a multi-layer perceptron model in which the output layer is a softmax layer, a support vector machine (SVM) model, a decision tree model, and a convolutional neural network (CNN) model of any one machine learning model. Models can be included.

The determination unit may detect a GPS deception attack when the output value of the learning model for the received GPS signal exceeds a preset threshold value.

According to an embodiment of the present invention, a GPS deception attack may be detected using a difference in the output value of the GPS receiver.

According to the embodiment of the present invention, since it can be sufficiently applied to an existing system by updating software of a very simple logic without additional hardware installation or hardware change, it is relatively highly practical.

According to the embodiment of the present invention, since it is based on the signal difference generated due to the characteristics of the signal generating principle of the deceptive signal generating device, the possibility of bypass is also relatively low compared to other technologies. Therefore, it is possible to safely protect GPS-dependent systems from GPS spoofing attacks through the application of the technology of the present invention.

The present invention can be applied to intelligent mobile and unmanned mobile devices, intelligent power grids and communication networks, and GPS receivers. Since accurate navigation is required for driving assistance and autonomous driving of intelligent and unmanned vehicles, they have no choice but to rely heavily on GPS. However, if they are vulnerable to a GPS deception attack, system malfunction and control takeover may occur, which may lead to economic loss and personal injury. In order to make them safe from GPS spoofing attacks, it is essential to have a technology capable of detecting GPS spoofing attacks. Smart grids and communications networks require time synchronization for widely spread substations and base stations. For this, many systems already rely on GPS because it is economical to synchronize time through accurate time information obtained through the GPS clock. However, if they are vulnerable to GPS deception attacks, power outages and system failures can occur, which can lead to huge economic losses. Therefore, in order to be safe from GPS spoofing attacks, it is necessary to have a technology capable of detecting GPS spoofing attacks. By adding a simple logic to the GPS receiver, it provides a function that can detect whether a GPS deceptive attack has been performed on its own, so that it can be sufficiently applied to the existing system.

1 shows an exemplary diagram for explaining the GPS principle.
2 is a diagram illustrating an example for explaining a GPS range measurement error and uncertainty region.
3 shows exemplary views of the structure of a GPS deception signal generating apparatus.
4 is a diagram illustrating an example for explaining a method for measuring GPS location accuracy.
5 shows an example diagram of a cumulative distribution function of a position accuracy estimate and a velocity accuracy estimate for various signal sources.
6 is a diagram illustrating an example for explaining a method for detecting a GPS deception attack according to an embodiment of the present invention.
7 is a flowchart showing an exemplary embodiment of the learning step in the present invention.
Fig. 8 shows an operation flowchart of an embodiment for operation steps in the present invention.
9 shows the configuration of a GPS deception attack detection apparatus according to an embodiment of the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be embodied in various different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of describing the embodiments, and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, "comprises" and/or "comprising" refers to the presence of one or more other components, steps, operations and/or elements mentioned. or addition is not excluded.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless specifically defined explicitly.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. The same reference numerals are used for the same components in the drawings, and repeated descriptions of the same components are omitted.

GPS, a radio navigation system that uses satellites, currently has 31 GPS satellites orbiting the Earth while continuously transmitting signals containing navigation messages. These satellites are equipped with highly accurate atomic clocks and are continuously calibrated by the ground station, so they have very accurate system time. In order to calculate the position, the GPS receiver extracts a navigation message containing the orbit information of the satellite and a timestamp indicating the time the signal was generated from the GPS signals received from several satellites. The GPS receiver finds out the position of the satellite through the orbit information of the satellite, finds the delay time until the signal arrives using the timestamp, multiplies it by the speed of light, and calculates its location by measuring the distance. If this is expressed as an expression, it is as in <Equation 1> below.

[Equation 1]

Here, R _i means the measurement distance from the i-th satellite including the time error, (x _i , y _i , z _i ) means the geographical location coordinates of the i-th satellite, and b _u is the receiver as clock deflection. may mean the time error between the system time and GPS time, c may mean the speed of light, and (x, y, z) may mean the position of the receiver.

Since the measured distance includes an error between the GPS time and the system time of the GPS receiver, signals from at least four satellites are received, a system of equations is established using Equation 1 above, and the position (x, y, z) and time error (b _u ) are calculated.

As shown in FIG. 1, which describes the equation system in a two-dimensional expression, Equation 1 represents a sphere whose center is the position of the satellite, and the radius is the range corrected for the clock deflection error (Ribu·c). Represents a sphere, and solving a system of equations is equivalent to finding the intersection of multiple spheres.

Theoretically, only one location is determined by solving a system of equations in a GPS receiver, but there are many factors that cause distance measurement errors. Accordingly, the solution of the equation is determined within the area of intersection of the spheres as shown in FIG. In detail, the distance between the receiver and each satellite is indicated by the radius of the sphere, and the error range of the measured distance is indicated by the inner circle. The expected location will be within the shaded area, which is called the area of uncertainty. The size of this region may vary depending on factors such as atmospheric influences, ephemeris error and satellite geometry.

First, the Earth's atmosphere delays the propagation of GPS signals, and this delay causes distance measurement errors. There are two main layers in the atmosphere, the ionosphere and the troposphere, and these layers cause ionospheric retardation and tropospheric retardation, respectively. There are several mathematical ionospheric and tropospheric models available to correct for these errors, and the GPS receiver applies these models to estimate and compensate for these errors. However, the error cannot be completely corrected, and a distance error of up to ±3.9m may occur after correction. This distance error increases the position uncertainty, as shown in Fig. 2b.

Second, the GPS control segment monitors the orbits of GPS satellites and updates their orbit information (Ephemeris) every two hours, but their actual orbits may differ from the satellite orbit information due to uncertainties in the solar radiation pressure model and the gravitational field model. This error can lead to a distance error of up to ±2.0 m, which increases the position uncertainty, as shown in Fig. 2b.

The GPS spoofer is generating a signal that mimics the real signal as much as possible so that the GPS receiver can miscalculate the location and time as intended by the attacker. However, if you look closely at the signal generation mechanism, there are two major parts that are subtly different from the actual signal. First, the GPS spoof signal generating device deliberately delays the signal to simulate the actual GPS signal coming from a satellite about 20000 km away. At this time, the amount of delay is decided based on the distance between the position of the mimicking satellite and the fake position to be deceived. The actual GPS satellite signal arrives through ionosphere and tropospheric refracted several times before reaching the ground, but most of it arrives. The GPS spoof signal generating device gives a delay (delay time) without considering such refraction. Some GPS deception signal generators support various signal transmission models, for example, Klobuchar model, Saastamoinen model, etc. in consideration of the refraction effect, but it is known that these models also have inaccuracies. Therefore, due to such a difference, the delay time recognized by the GPS receiver is inevitably changed, which inevitably affects the distance measurement with the satellite, and finally, the GPS positioning accuracy is inevitably affected. Second, most GPS spoofing signal generators generate a spoof signal by generating a signal in the form of a digital baseband signal and then converting the frequency to the 1575.42MHz band using an ADC, mixer, etc. Because it is discretized according to the sampling period, an error occurs in the delay time, which affects the GPS positioning accuracy.

Specifically, the GPS spoof attack is a type of physical layer attack that uses a GPS spoof signal generating device to transmit a GPS spoof signal to the victim's GPS receiver, causing the victim to estimate an incorrect geographic location or incorrect clock deflection. The GPS spoofing signal generator creates a GPS signal model to simulate a real GPS signal, and then modulates the intermediate frequency (IF) spoofing signal according to the model. However, none of the previous studies investigated the inaccuracy of the signal model of the GPS spoofing signal generator. The present invention is based on the results of 1) a method of modeling and simulating a GPS signal by a GPS spoofing signal generating device and 2) a search for factors causing inaccuracy.

There are two types of GPS spoofing generators: conventional GPS simulators and software-defined GPS spoofing generators. 3a and 3b are described with respect to the most general architectures of traditional simulators and software-defined deceptive signal generating devices. Basically their process consists of digital IF spoofing signal modulation and modulation to a radio frequency signal. The big difference is that the software-defined spoofing signal generator uses a general processor such as a central processing unit (CPU) and graphic processing unit (GPU), while the existing simulator modulates the IF spoofing signal using dedicated FPGA (Field Programmable Gate Array) hardware. to be. The process of the modulation module calculates signal model parameters based on the navigation message of the real GPS signal and the deception scenario including the fake GPS time and location of the modulation module's control module as the target, as shown in Fig. 3c. The GPS signal of the i-th simulation satellite may be modeled as in Equation 2 below.

[Equation 2]

where A _i means the amplitude of the signal, d _i (t) means the navigation message bit, C _i (t) means the C/A code chip value, and θ _c,i is the instantaneous bit carrier phase , where τ _i is the modeled propagation delay, and the spoof channel _{simulates the signal by deliberately delaying τ i} as if transmitted from the satellite to the target location. In particular, in order to accurately model a GPS signal, it is necessary to model _{τ i taking into account the sources of intrinsic GPS errors.} More precisely, τ _i can be expressed as in Equation 3 below.

[Equation 3]

where R _i means the theoretical distance between the simulated satellite and the target position, Δb _i means the satellite clock error, E _i means the satellite power error, T _i means the tropospheric delay, I _i may mean ionospheric delay. Since E _i , T _i and I _i are not deterministic parameters, they must also be modeled to produce a spoof signal close to the true GPS signal. However, most GPS spoofing devices do not consider satellite error and atmospheric effects when constructing the _{τ i model.} Therefore, there must be a difference in the pseudoranges measured when the GPS receiver receives these spoofing signals. Some GPS deceptive signal generators apply existing atmospheric effect models, such as the Klobuchar ionosphere model and the Saastamoinen tropospheric model, to the τ _i model, but these models have some inaccuracies.

Also, there is an inaccurate model of the GPS spoof signal generating device due to the discontinuity of _{I i .} In the modulation module, a combiner samples the modeled signal and combines the samples to generate a digital IF spoofing signal. The digital deception signal can be expressed as in Equation 4 below.

[Equation 4]

Here, x(nT) may mean the nth sample of the modeled signal. However, if τi is discontinuous after sampling, this may introduce additional distance errors. For example, if the sampling period is 200 ns (sampling rate of 5 MHz), a delay error of up to 200 ns can occur, which means a distance error of up to 60 m between the spoofed GPS satellite and the receiver (i.e. speed of light Х maximum discretization error). ) can lead to The ionospheric error, the largest error limiting the performance of satellite-based navigation, is generally known to be less than 19.6 m. Therefore, this error can be more severe than the distance error caused by the ionospheric effect, and the resulting positional uncertainty will increase when the receiver receives a spoofing signal.

In summary, there are inaccuracies in the signal model of the GPS spoof signal generating device due to inaccurately _{modeled propagation delay I i and discontinuity.} Since this inaccuracy affects the distance measurement error of the GPS receiver, as shown in FIG. 2 , the size of the uncertainty region varies depending on whether the GPS receiver receives a real signal or a spoof signal.

As described above, when a spoofing signal is received, the size of the uncertainty region changes. Therefore, while the uncertainty region size can be used to detect GPS spoofing attacks, it is difficult to measure directly. Instead, since these accuracy estimates are calculated by measuring the degree of scatter in the GPS position output, they can be inferred using the accuracy estimation output of a general GPS receiver. That is, the GPS position accuracy is defined as the degree of dispersion of a plurality of GPS position measurements measured over a short period of time. There are several numerical values indicating the degree of dispersion. For example, Circular Error Probable (CEP) represents the size of the radius of a circle that can contain half of the measured values, and R95 represents the size of the radius of a circle that can contain 95% of the measured values, which express the degree of scatter. the number that The latest GPS receivers measure the GPS positioning accuracy by measuring a numerical value such as CEP or R95, and even a receiver that does not provide GPS positioning accuracy measurement can measure the accuracy in the above method. In addition, the GPS receiver can measure not only the position but also the speed and time, and the accuracy of these values can be measured in the above-mentioned manner.

4 shows an example diagram of how CEP and R95 are measured, and a modern GPS receiver calculates the same type of indicators as measured CEP and R95 to estimate the accuracy of the output, and the receiver uses the calculated values for accuracy output as an estimate. Although FIG. 4 only shows an estimate of the location accuracy, the GPS receiver can estimate the time accuracy and the speed accuracy by measuring the degree of dispersion of the time and speed measurements.

The present invention uses a commercial GPS receiver and a GPS spoof signal generator to determine how much an inaccurate signal model affects the accuracy estimate, and collects the accuracy estimate when the GPS receiver receives a genuine signal and receives a spoof signal. experiments can be performed to That is, the present invention can collect an accuracy estimate for a spoofing signal by collecting an accuracy estimate for a genuine GPS signal, and configuring a GPS spoofing signal generating device to simulate a genuine GPS signal of the same navigation message, time, and location.

Fig. 5a plots the cumulative distribution function (CDF) of the estimate of the positional accuracy of each spoofing signal generator setting so that the estimate of accuracy for each signal source can be clearly compared and read, as can be seen from Fig. 5a; It shows that the distribution of position accuracy estimates for the signal can be sufficiently distinguished from the actual GPS signal. LabSat 3's accuracy estimates are lower because the device does not simulate both atmospheric effects and satellite force errors, and because the distance error is very low due to its high sampling rate (16.368 MHz). Accuracy estimates of other GPS spoofing devices are generally higher, and it is clear that they do not accurately model spoofs from real GPS signals. Although the distribution of the estimate of the position accuracy for the actual GPS signal somewhat overlaps the distribution of the USRP as shown in Fig. 5A, the distribution of the estimate of the velocity accuracy can be distinguished as shown in Fig. 5B. Therefore, it should be possible to distinguish between true GPS signals and spoof GPS signals by taking into account all accuracy estimates collectively.

There are several advantages to using the accuracy estimation output of a typical GPS receiver as a function to distinguish between a spoof and a true signal. First, the latest GPS receivers, such as u-blox EVK-M8T, Swift Piksi multi GNSS module, and Qualcomm Snapdragon's GPS module, provide accuracy estimation output. Android's Location API and iOS's CLLocation API also provide horizontal and vertical accuracy estimates. Second, even if the GPS receiver of an existing GPS-dependent system does not provide such an output, the system can collect multiple position measurements over a short period of time and calculate the degree of scattering of these measurements to yield an estimate of accuracy as shown in FIG. have.

attacker model

The present invention contemplates a powerful attacker capable of reliably transmitting deceptive signals to a target system and accurately manipulating the target's GPS position, speed, and time output. The present invention assumes that an attacker wants to simulate a spoof signal as close as possible to a real GPS signal with physical features. The present invention assumes that attackers can use an existing GPS simulator or an SDR-based GPS spoof signal generating device and generate a synchronized spoof signal so that the receiver can receive the spoofing signal without signal loss.

Problem overview

Under the attacker model, it is an object of the present invention to provide a novel GPS spoofing device that can be adapted for use with systems using GPS receivers with only a software update without additional hardware installation or modification. To this end, the present invention is a binary classification problem of finding out whether several accuracy estimates (position, speed, time accuracy estimates, etc.) output by a GPS receiver belong to a true signal class or a spoofed signal class. convert

data set collection

GPS Receiver Setup: Using a u-blox EVK-M8T as a GPS receiver, using a laptop and RTKLIB to make 6 accuracy estimates (accuracy estimates of time, frequency, horizontal, vertical, position, and speed). Configure the receiver to collect an accuracy estimate every 0.2 seconds and ignore GNSS signals other than GPS signals.

Signal Source Setup: An antenna is installed on the roof to collect an accuracy estimate for the genuine GPS signal and the signal is relayed to the receiver. An existing simulator (eg, Spectracom GSG-6) and three software-defined spoofing generators (eg, bladeRF x40, USRP 2944 and LabSat 3, etc.) are used to collect accuracy estimates for the spoofing signal. The present invention can be configured with a sampling rate of 2.5 MHz for blades and 5 MHz for USRP, respectively, and can be used with open source GPS simulation software. For the Spectracom GSG-6, the ionosphere model and the Saastamoinen convective model can be applied, and accuracy estimates can be collected with three propagation environment models: open, rural and small town. The GPS spoof signal generating apparatus may be set to deal with as many and various attackers as possible by generating spoof signals with various sampling rates, radio wave environment models, atmospheric models, and the like. In order to train the model only for the imprecise effect of the signal model, the present invention can be configured such that the simulated time and location of the GPS spoof signal generating device is the same as that of the real GPS signal from which the accuracy estimate was collected.

Dataset overview: Create data sets ds1, ds2, ds3, ds4, ds5 of 5 different dates. Each data set contains 7 subsets, each subset is a set of accuracy estimates for one of the signal sources (GPS satellite, bladeRF, USRP, Labsat 3, open, rural, and small-to-medium-city Spectracom GSG-6 propagation models) . All subsets of each data set can be gathered from signals that share the same navigation message. At this point, accuracy estimates can be collected from each signal source for a minimum of 9 hours to reduce the effects of satellite geometry.

system design

6 shows an exemplary diagram for explaining a GPS deception attack detection method according to an embodiment of the present invention. As shown in FIG. 6, the method of the present invention includes a training phase and an operation phase ( Operating Phase).

As shown in FIG. 7, the training phase is the output value of the GPS receiver when the GPS satellite signal is input and the output value of the GPS receiver when various deceptive signals generated from various GPS deception devices are input, for example, GPS accuracy (position accuracy, speed accuracy, time accuracy, etc.) values are collected through scattering information (accuracy estimate) data such as location, speed, and time (S710 and S720). If the GPS receiver itself provides these values, the corresponding values are collected. In the learning step, a machine learning model, for example, a deep neural network (DNN) is trained using the collected values (S730). That is, in the learning stage, accuracy estimates (or degree of dispersion) for satellite signals and deceptive signals are collected and stored in a database. Train a machine learning classifier model using stored data. As the output layer utilizes a multilayer perceptron (MLP) model where the output layer is a softmax layer, the model outputs the probability that the input accuracy estimate belongs to the true signal class and the deceptive signal class. Of course, the learning model in the present invention is not limited or limited to the MLP model, and other machine learning models, for example, a Support Vector Machine (SVM) model, a decision tree model, a convolutional neural It may include a network (CNN) model and the like.

When the model is sufficiently trained, it is loaded into the actual system and moved to the Operation Phase. When a signal of unknown origin is input to the receiver of the same model, the output value of the GPS receiver is collected and the extracted GPS accuracy value is inputted to the trained machine learning model. is determined and an alarm is generated. At this time, depending on the nature of the system, the threshold can be adjusted in such a way that if you want to make it more sensitive, make it low, and if you want to reduce false alarms as much as possible, make the threshold high. For example, in the operational phase, the receiver's accuracy estimate is fed to the trained model and raises an alert when the probability that the input belongs to a class of deceptive signals exceeds a decision threshold (eg, th = 0.5). Specifically, as shown in FIG. 8 , the operation step is to input a signal to be determined whether a satellite signal/deception signal is present to the GPS receiver ( S810 ), and output values of the GPS receiver, for example, location, speed, time, etc. By inputting the scattered information data into a learning model, for example, a machine learning model learned by the learning step of FIG. 7 ( S820 ), when the output value of the machine learning model exceeds a preset threshold, a GPS deception attack is detected and An alarm is generated for (S830, S840), and when the output value of the machine learning model is less than a threshold value, it can be determined as a GPS satellite signal (S850).

Since the degree of dispersion of the GPS output value may vary depending on the location distribution and number of GPS satellites, it is necessary to learn more than a certain amount of data in order to improve the accuracy of the system and to have constant accuracy whenever the system operates. In addition, the dispersion degree of the GPS output value can change significantly even when receiving GPS satellite signals due to poor radio wave environment when there are many buildings around or when moving. Therefore, false alarms may occur. In order to make a system with constant accuracy even in such a situation, data from various radio wave environments must be collected and reflected in learning.

The present invention can utilize a multi-layer perceptron (MLP) model with two hidden layers of 64 nodes and 32 nodes. MLP is the simplest form of neural network model, and it is known that even a lightweight MLP model can achieve high accuracy if the training data set is sufficient. For each hidden layer, a dropout technique can be applied to reduce overfitting. The dropout technique involves each node in the network dropping out with a given probability p, and the network computes the result using the remaining nodes in the learning phase. For all evaluations, the dropout probability can be corrected to p = 0.7. To create and train a model, you can use Tensorflow, the most popular open source software library for machine learning.

As such, the method according to an embodiment of the present invention can detect a GPS deception attack using the difference in the output value of the GPS receiver, and since it operates only with the output of the existing GPS receiver, a very simple logic is implemented without additional hardware installation or hardware change. It is relatively practical because it can be sufficiently applied to the existing system even by updating the software.

In addition, since the method according to the embodiment of the present invention is based on a signal difference generated due to the characteristics of the signal generating principle of the deceptive signal generating apparatus, the possibility of bypass is also relatively low compared to other technologies. Therefore, it is possible to safely protect GPS-dependent systems from GPS spoofing attacks through the application of the technology of the present invention.

The present invention can be applied to intelligent mobile and unmanned mobile devices, intelligent power grids and communication networks, and GPS receivers.

As described above, the method according to an embodiment of the present invention detects whether a GPS deception attack occurs by utilizing the accuracy of the results when the receiver calculates the location, speed, time, etc. using the signal received by the GPS receiver. Since it is based on the difference in signals caused by the characteristics of the signal generating principle of the GPS deception signal generating device, the possibility of bypassing is also relatively low compared to the existing technology.

9 shows a configuration of a GPS deception attack detection apparatus according to an embodiment of the present invention, and shows a conceptual configuration of an apparatus for performing the method of FIGS. 1 to 8 .

Referring to FIG. 9 , an apparatus 900 for detecting a GPS deception attack according to an embodiment of the present invention includes a learning unit 910 , a receiving unit 920 , and a determining unit 930 .

The learning unit 910 collects scattering degree data including position, speed and time output from the GPS receiver by labeling whether a GPS satellite signal or a GPS deceptive signal is present, and learns a learning model using the collected data.

Here, the learning unit 910 calculates the dispersion degree data of the position output of the GPS receiver with respect to the GPS satellite signal and the GPS deceptive signal, collects the accuracy estimate of the GPS receiver using the calculated dispersion degree data, and collects the collected A training model can be trained using the accuracy estimate.

In this case, the learning model may include a multi-layer perceptron model whose output layer is a softmax layer.

The receiver 920 receives a GPS signal to determine whether it is a GPS spoof signal or a GPS satellite signal.

The determining unit 930 determines the GPS signal received by the receiver as a GPS satellite signal or a GPS deceptive signal using a learning model learned based on the difference in the output values of the GPS receiver, that is, the learning model learned by the learning unit 910 . do.

In this case, when the output value of the learning model for the received GPS signal exceeds a preset threshold, the determination unit 930 may detect it as a GPS deception attack.

Although the description of the device of FIG. 9 is omitted, the device of FIG. 9 may include all of the contents described with reference to FIGS. 1 to 8, which is obvious to those skilled in the art of the present invention. .

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a designable logic. One or more general purpose computers or special purpose computers, such as a field programmable gate array (FPGA), programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. It can be implemented using a computer. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that a processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that including For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be placed on any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or provide instructions or data to the processing device. It can be embody. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded in the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible by those skilled in the art from the above description. For example, the described techniques are performed in an order different from the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims also fall within the scope of the following claims.

Claims (12)

receiving a GPS signal; and
Determining the received GPS signal as a GPS satellite signal or a GPS deceptive signal using a learning model learned based on the difference in the output values of the GPS receiver
including,
collecting scattering degree data including position, speed, and time output from the GPS receiver by labeling whether a GPS satellite signal or a GPS deceptive signal is present; and
Learning the learning model using the collected data
further comprising,
The collecting step
For a GPS satellite signal and a GPS spoof signal, calculating scattering degree data of the position output of the GPS receiver, and collecting an accuracy estimate of the GPS receiver using the calculated scattering degree data;
The learning step
GPS deception attack detection method, characterized in that the learning model is trained by using the collected accuracy estimate.
delete delete According to claim 1,
The learning model is
A multi-layer perceptron model in which the output layer is a softmax layer, a support vector machine (SVM) model, a decision tree model, and a convolutional neural network (CNN) model including any one machine learning model. GPS deception attack detection method, characterized in that.
According to claim 1,
The determining step is
When the output value of the learning model with respect to the received GPS signal exceeds a preset threshold, the GPS deception attack detection method, characterized in that the detection as a GPS deception attack.
receiving a GPS signal; and
Determining the received GPS signal as a GPS satellite signal or a GPS deceptive signal using a learning model learned based on the difference in output values of the GPS receiver
including,
collecting scattering degree data including position, speed, and time output from the GPS receiver by labeling whether a GPS satellite signal or a GPS deceptive signal is present; and
Learning the learning model using the collected data
GPS deception attack detection method further comprising a.
delete a receiver for receiving a GPS signal; and
A determination unit that determines the received GPS signal as a GPS satellite signal or a GPS deceptive signal using a learning model learned based on the difference in the output values of the GPS receiver
including,
A learning unit for collecting scattering degree data including position, speed, and time output from the GPS receiver by labeling whether a GPS satellite signal or a GPS deceptive signal, and learning the learning model using the collected data
further comprising,
the learning unit
For a GPS satellite signal and a GPS spoof signal, calculate scatter data of the position output of the GPS receiver, collect an accuracy estimate of the GPS receiver using the calculated scatter degree data, and use the collected accuracy estimate GPS deception attack detection device, characterized in that to learn the learning model.
delete delete 9. The method of claim 8,
The learning model is
A multi-layer perceptron model in which the output layer is a softmax layer, a support vector machine (SVM) model, a decision tree model, and a convolutional neural network (CNN) model including any one machine learning model. GPS deception attack detection device, characterized in that.
9. The method of claim 8,
the determining unit
The GPS deception attack detection apparatus of claim 1, wherein when the output value of the learning model for the received GPS signal exceeds a preset threshold value, the GPS deception attack is detected as a GPS deception attack.

Images