Performance Analysis of GNSS/INS Loosely Coupled Integration Systems under Spoofing Attacks

Abstract

The loosely coupled integration of Global Navigation Satellite System (GNSS) and Inertial Navigation System (INS) have been widely used to improve the accuracy, robustness and continuity of navigation services. However, the integration systems possibly affected by spoofing attacks, since integration algorithms without spoofing detection would feed autonomous INSs with incorrect compensations from the spoofed GNSSs. This paper theoretically analyzes and tests the performances of GNSS/INS loosely coupled integration systems with the classical position fusion and position/velocity fusion under typical meaconing (MEAC) and lift-of-aligned (LOA) spoofing attacks. Results show that the compensations of Inertial Measurement Unit (IMU) errors significantly increase under spoofing attacks. The compensations refer to the physical features of IMUs and their unreasonable increments likely result from the spoofing-induced inconsistency of INS and GNSS measurements. Specially, under MEAC attacks, the IMU error compensations in both the position-fusion-based system and position/velocity-fusion-based system increase obviously. Under LOA attacks, the unreasonable compensation increments are found from the position/velocity-fusion-based integration system. Then a detection method based on IMU error compensations is tested and the results show that, for the position/velocity-fusion-based integration system, it can detect both MEAC and LOA attacks with high probability using the IMU error compensations.

1. Introduction

The vulnerability of Global Satellite Navigation Systems (GNSSs) to various intentional and non-intentional radio frequency interferences is an obstacle of GNSS applications [1,2]. Within them, the spoofing interference is a type of troublesome and malicious interference. Spoofing signals have the same characteristics to the legitimate GNSS signals. Thus, they are able to pass through the correlators of target receivers. Usually stronger than authentic signals, spoofing signals guide the victim receivers to track themselves, and then throw the victims astray [3,4,5].

Many approaches have been proposed to detect or suppress spoofing attacks. For stand-alone GNSS receivers, multiple antennas are widely used to mitigate the effect of spoofing interference by monitoring the direction of arrival signals [6,7]. For single-antenna GNSS receiver, some signal-processing-based techniques have been implemented as effective ways to find spoofing attacks, including Receive Power Monitoring (RPM) [8], correlation function analysis [9] and Kalman filter-based tracking loop [10].

Besides, INS aided methods have also developed because the inertial navigation system (INS) is autonomous and the integration of GNSS and INS is considered the possibility of countering spoofing attacks. The GNSS/INS integration systems overcome the drawbacks of each stand-alone system and become popular navigation systems [11,12,13]. In the integration systems, the defects of INSs, the unknown absolute initial position and the accumulative position errors are compensated by GNSS that provides absolute positioning estimations with stationary noise [11,14,15]. Meanwhile, autonomous INSs independent of surroundings have the capability to improve the robustness of GNSSs [16,17].

Actually, of normal GNSS/INS integration systems, the capability to counter spoofing attacks is limited [18,19,20], since spoofing effects on GNSS probably pollute the estimations of the integration algorithm, such as the Kalman Filter, and then mis-correct the INS states. Some current researches improve the performance of integration systems under spoofing attacks. Using an INS-aided integrity monitoring algorithm, the tightly GNSS/INS integration systems, which fuse both systems using pseudoranges, effectively mitigate spoofing attacks [21]. INS-estimated positions, as well as the satellite positions and receiver clock errors from the GNSS, are used to generate redundant virtual pseudoranges, considered as spoofing-free reference pseudoranges. When one satellite pseudorange is quite different from its virtual pseudorange, the distribution of pseudorange residuals change and the satellite is likely under spoofing attacks. Besides, as the Kalman Filter innovations in tightly GNSS/INS integration systems show unreasonable fluctuations under spoofing environments, they can be used as an alternative detection method [22,23,24]. With dual antennas, GNSS is able to measure the vehicle heading. The consistency of attitudes resolved by INS and GNSS is able to detect spoofing attacks, due to the difference from the spoofing heading to the actual heading [25,26].

However, these methods are difficultly realized in low-cost GNSS chips that support neither pseudorange outputs nor dual/multiple antenna inputs. Additionally, for these black-box receivers, there is no access to signal processing-based interference detections. The GNSS/INS loosely coupled integration system, fusing both systems using positions (and velocities in some cases), is easily available and widely employed [20]. Thus, we try to find a method to detect spoofing attacks based on the GNSS/INS loosely coupled integration system without additional hardware, information or special requirements.

Considering different behaviors of spoofing effects and different integration fusions, we analyze the performance of the GNSS/INS loosely coupled integration systems with position and position/velocity fusion under two typical spoofing attacks, Meaconing attacks (MEAC attacks) with constant spoofing-induced relative pseudoranges and Lift-off-aligned attacks (LOA attacks) with gradually increasing relative pseudoranges [27]. In the analysis, we focus on variations of the IMU error compensations estimated by the Kalman filer. The compensations refer to IMU physical characteristics and vary within reasonable ranges. Abnormal increments of compensations are likely to alarm spoofing attacks and deeply discussed in the study. Besides, a spoofing detection algorithm based on the compensations is proposed and tested. MEAC attack could be alarmed by GNSS/INSs with both position and position/velocity fusion within one second and two seconds, respectively. For LOA attack, GNSS/INSs with position/velocity fusion are capable of alarming it instantly, while the system with position fusion fails in perceiving spoofing interference. One obvious merit of the spoofing detection is the easy availability for low-cost GNSS/INSs without extra-hardware or improvement on the receiver structure.

In Section 2, the main features of different types spoofing attacks are introduced, as well as their effects on GNSS position and velocity estimations. In Section 3, the effects of spoofing interferences on GNSS/INS loosely coupled integration system are discussed in detail. The effects of different spoofing interferences are compared by experimental studies and a detection method of spoofing attacks is proposed in Section 4. Finally, the conclusions of this study are given in Section 5.

2. Effects of Spoofing Attacks on GNSS Position and Velocity Estimations

Spoofing attacks can be realized by using special devices, such as a GNSS transmitter, to emit GNSS-like signals. The GNSS-like signals have the same signal structures to the authentic signals, but high signal power and different PRN code delays ${\tau }_s$. The similar signal structures and high power cause the spoofing signals passing through the correlators and being tracked by the receiver. The different PRN code delays induce different pseudorange measurements and then the false GNSS position and velocity estimations. The delay ${\tau }_s^i$ of spoofing signal referring to the $i$-th satellite can be written as:

$${\tau }_s^i={\tau }_a^i+∆{\tau }^i,$$

(1)

where ${\tau }_a^i$ is the delay of the authentic signal from the $i$-th satellite and $∆{\tau }^i$ is the relative spoofing delay. Correspondingly, the relationship within spoofing, authentic and relative pseudoranges is written as:

$${\mathit{\rho }}_s=c{\mathit{\tau }}_s={\mathit{\rho }}_{au}+∆\mathit{\rho }={\left[{\rho }_{au}^i\right]}_{N\times 1}+{\left[∆{\rho }_s^i\right]}_{N\times 1},$$

(2)

where $c$ is the speed of light, ${\mathit{\rho }}_s$ and ${\mathit{\rho }}_{au}$ are spoofing and authentic pseudorange vectors, respectively, and N is the number of available satellites. The estimated position ${\mathit{P}}_{GNSS}$ and receiver clock bias $\delta t_u$ are

$$\left[\begin{array}{c}{\mathit{P}}_{GNSS}\\ \delta t_u\end{array}\right]={\left({\mathit{A}}^T\mathit{A}\right)}^{-1}{\mathit{A}}^T\left[{\mathit{\rho }}_{au}+∆\mathit{\rho }\right]={\left({\mathit{A}}^T\mathit{A}\right)}^{-1}{\mathit{A}}^T{\mathit{\rho }}_{au}+{\left({\mathit{A}}^T\mathit{A}\right)}^{-1}{\mathit{A}}^T∆\mathit{\rho }=\left[\begin{array}{c}{\mathit{P}}_{au}+∆{\mathit{p}}_s\\ \delta t_{ua}+∆\delta t_{us}\end{array}\right],$$

(3)

where $\mathit{A}$ is the satellite geometry matrix referring to the satellite number and distribution, ${\mathit{P}}_{au}$ is the authentic position, $∆{\mathit{p}}_s$ is the spoofing induced relative position, $\delta t_{ua}$ is the authentic receiver clock bias, and $∆\delta t_{us}$ is the spoofing induced relative receiver clock bias.

Meanwhile, the simulated motion of the spoofing signals also leads to incorrect interpretation of the Doppler shift ($f_s^i\ne f_d^i \left[\mathrm{Hz}\right]$). The false Doppler shifts mis-lead the velocity solution of the victim receiver. The relationship between the Doppler shift and pseudorange rate is expressed as:

$${\dot{\rho }}_s^i={\dot{\rho }}_{au}^i+∆{\dot{\rho }}_s^i=-\lambda \left(f_d^i+∆f_s^i\right)=-\lambda f_s^i,$$

(4)

Similarly, the velocity solution can be written as

$$\left[\begin{array}{c}{\mathit{V}}_{GNSS}\\ \delta {\dot{t}}_u\end{array}\right]={\left({\mathit{A}}^T\mathit{A}\right)}^{-1}{\mathit{A}}^T\left(-\lambda {\mathit{f}}_s\right)=-{\left({\mathit{A}}^T\mathit{A}\right)}^{-1}{\mathit{A}}^T\left(\lambda {\mathit{f}}_d\right)+{\left({\mathit{A}}^T\mathit{A}\right)}^{-1}{\mathit{A}}^T∆{\dot{\mathit{\rho }}}_s=\left[\begin{array}{c}{\mathit{V}}_{au}+∆{\mathit{v}}_s\\ \delta {\dot{t}}_{ua}+\delta {\dot{t}}_{us}\end{array}\right],$$

(5)

where ${\mathit{V}}_{au}$ is the velocity vector from the authentic signals, $∆{\mathit{v}}_s$ is the spoofing induced relative velocity, $\delta {\dot{t}}_{ua}$ is the authentic receiver clock error rate, and $\delta {\dot{t}}_{us}$ is the spoofing induced relative receiver clock drift.

Spoofing attacks can be simply and low-costly realized by a transmitter or a repeater which delay the received GNSS signals and transmit them with high power via a transmitting antenna, as shown in Figure 1. Under the situation, signals collected by the target receiver are transmitted from the spoofer rather than the satellites. Therefore, the pseudoranges measured by the target receiver consist of the ranges from satellites to the spoofer receiving antenna $r_{sat-RA}^i$, from the spoofer receiving antenna to the spoofer transmitting antenna $r_{RA-TA}$, and from the spoofer transmitting antenna to the target receiver $r_{TA-u}$. In addition, the measured pseudoranges include the hardware-time-delay induced range $c\delta {\tau }_{hard}$ in the spoofer and receiver-clock-bias induced range $c\delta t_{ua}$ in the target receiver.

Within these ranges, $r_{sat-RA}^i$ is different in each pseudorange ${\rho }_s^i$ since its value refers to the different satellite position. The ranges $r_{RA-TA}$, $r_{TA-u}$, $c\delta {\tau }_{hard}$ and $c\delta t_{ua}$ are the same in all pseudoranges. The total pseudorange collected by the target receiver referring to one satellite is written as,

$${\rho }_s^i=r_{sat-RA}^i+r_{RA-TA}+r_{TA-u}+c\delta {\tau }_{hard}+c\delta t_{ua}.$$

(6)

From Equations (2) and (6), the relative spoofing pseudorange can be estimated as,

$$\mathsf{\Delta }{\rho }^i=r_{sat-RA}^i-r_{au}^i+r_{RA-TA}+r_{TA-u}+c\delta {\tau }_{hard}.$$

(7)

Equation (7) shows that the spoofing induced position error $∆{\mathit{p}}_s$ depends on the range difference between $r_{sat-RA}^i$ and $r_{au}^i$. The spoofing induced clock bias error $\delta t_{us}$ (in the unit of meter) includes $r_{RA-TA}$, $r_{TA-u}$, $c\delta {\tau }_{hard}$ and the common part of $r_{sat-RA}^i-r_{au}^i$. Each them has the same value in all pseudoranges and hence the same behavior to the receiver clock bias. Specially, if $r_{sat-RA}^i=r_{au}^i$ and $r_{TA-u}=0$, namely the transmitter and the target receiver settled near to each other, it can be obtained that $∆{\mathit{p}}_s=\mathbf{0}$.

In Equation (7), the item $r_{RA-TA}$ is constant, equal to the cable length between the spoofer receiving antenna and transmitting antenna. Other items $r_{sat-RA}^i$, $r_{au}^i$, $r_{TA-u}$ and $\delta {\tau }_{hard}$ are time-varying. Thus, the spoofing induced pseudorange rate is written as,

$$\mathsf{\Delta }{\dot{\rho }}^i={\dot{r}}_{sat-RA}^i-{\dot{r}}_{au}^i+{\dot{r}}_{TA-u}+c\delta {\dot{\tau }}_{hard}.$$

(8)

Similarly, the different part ${\dot{r}}_{sat-RA}^i-{\dot{r}}_{au}^i$ in the pseudorange rate leads to velocity variation, which is the spoofing induced velocity. The common parts ${\dot{r}}_{TA-u}$ and $c\delta {\dot{\tau }}_{hard}$ affect the receiver clock drift error.

Neither receiver clock bias nor drift is integrated in the GNSS/INS loosely coupled integration system. Their variations under spoofing attacks are simplified in the following analysis. According to Equations (3), (5), (7) and (8), it can be obtained that $\mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{v}}_{s}t+\mathsf{\Delta }{\mathit{p}}_{s0}$. A common case of $\mathsf{\Delta }{\mathit{v}}_s=\mathbf{0}$ and $\mathsf{\Delta }{\mathit{p}}_{s0}\ne \mathbf{0}$ would occur under MEAC attack. The item $\mathsf{\Delta }{\mathit{p}}_{s0}$ is the initial position offset, the position difference between the spoofer and the target receiver. The nonzero item $\mathsf{\Delta }{\mathit{v}}_s$ results from the pseudorange rate difference of ${\dot{r}}_{sat-RA}^i$ and ${\dot{r}}_{au}^i$ When the spoofer is near to the target receiver and both are relatively static, the item $\mathsf{\Delta }{\mathit{v}}_s$ is close to zero. The value of $\mathsf{\Delta }{\mathit{p}}_s$ steps up to a constant value when spoofing occurs.

Different to the impulsive position error case, the other common case of $\mathsf{\Delta }{\mathit{v}}_s\ne \mathbf{0}$ and $\mathsf{\Delta }{\mathit{p}}_{s0}=\mathbf{0}$ would occur under Lift-off-aligned attack (LOA attack). In this case, the spoofing signal aligned to the authentic signal at the beginning of the attack, i.e., $\mathsf{\Delta }{\rho }^i=0$, meanwhile the spoofing induced position deviation $\mathsf{\Delta }{\mathit{p}}_{s0}=\mathbf{0}$. Under LOA attack, the spoofing relative delay increases with time. As a result, the spoofing induced relative pseudorange $\mathsf{\Delta }{\rho }^i$ increases with time, i.e., $\mathsf{\Delta }{\rho }^i=\mathsf{\Delta }{\dot{\rho }}^{i}t$. In this case, pseudorange rate is nonzero and the position estimated from the spoofed receiver are gradually away from the authentic position over time, i.e., $\mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{v}}_{s}t$. It should be noted that the variation $\mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{v}}_{s}t$ is also able to realize under MEAC attack. For instance, the spoofer is close to the target receiver and then far away from it. The simple implementation is not exact LOA attack since the spoofing signal with unknown hardware delay is unaligned to the authentic signal.

Generally, the position and velocity measured by GNSS under spoofing attacks can be written as,

$$\begin{array}{c}\left[\begin{array}{c}{\mathit{P}}_{GNSS}\\ {\mathit{V}}_{GNSS}\end{array}\right]=\left[\begin{array}{c}{\mathit{P}}_{au}+\mathsf{\Delta }{\mathit{p}}_s\\ {\mathit{V}}_{au}+\mathsf{\Delta }{\mathit{v}}_s\end{array}\right],\\ \mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{v}}_s\mathit{t}+\mathsf{\Delta }{\mathit{p}}_{s0}.\end{array}$$

(9)

Shortly, under MEAC attack, $\mathsf{\Delta }{\mathit{v}}_s=\mathbf{0}$ and $\mathsf{\Delta }{\mathit{p}}_{s0}\ne \mathbf{0}$, GNSS-estimated positions step up without significant velocity variations. Under LOA attack, $\mathsf{\Delta }{\mathit{v}}_s\ne \mathbf{0}$ and $\mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{v}}_{s}t$, GNSS-estimated velocities jump up and the estimated positions are gradually away from the actual position.

3. Effects of Spoofing Attacks on the GNSS/INS

The variations of spoofing-induced relative positions and velocities under MEAC and LOA attacks can be described as two typical situations of $\mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{p}}_{s0}$ and $\mathsf{\Delta }{\mathit{p}}_s=\mathsf{\Delta }{\mathit{v}}_{s}t$, respectively. Their effects on the integration system are investigated after a short introduction to the integration system model under spoofing-free situation.

3.1. The GNSS/INS Loosely Coupled Integration System Model in the Normal Case

GNSS/INS loosely coupled integration systems commonly employ the Kalman Filter to estimate the position and velocity errors, gyroscope bias and first-order Markov process random noise errors, and accelerometer bias error. Then, the state vector ${\mathit{X}}_k={\left[\begin{array}{ccc}\delta {\mathit{P}}_k& \delta {\mathit{V}}_k& \begin{array}{ccc}{\mathit{\epsilon }}_{b,k}& {\mathit{\epsilon }}_{r,k}& {\nabla }_k\end{array}\end{array}\right]}^T$ consists of INS position error $\delta \mathit{P}$, velocity error $\delta \mathit{V}$, gyroscope bias errors ${\mathit{\epsilon }}_b$, and first-order Markov process random noise errors of gyroscope ${\mathit{\epsilon }}_r$ and accelerometer bias error $\nabla$ [2,6,28]. The process model is commonly as,

$${\mathit{X}}_k={\mathit{F}}_{k,k-1}{\mathit{X}}_{k-1}+{\mathit{G}}_{k-1}{\mathit{W}}_{k-1},$$

(10)

where ${\mathit{F}}_{k,k-1}$ is the state transition matrix, ${\mathit{G}}_k$ is the system noise matrix, and ${\mathit{W}}_k$ is the process noise, which is assumed as white noise with covariance ${\mathit{Q}}_k=E\left[{\mathit{W}}_k{\mathit{W}}_k^T\right]$.

The acquisition of attitude in GNSS requires multiple antennas, while typical commercial GNSS receivers are equipped with only one receiver antenna and cannot resolve attitudes directly. Therefore, in the GNSS/INS loosely coupled integration systems, GNSS position or GNSS position/velocity are fused with INS. The position and velocity differences between INS and GNSS are considered as measurements. The measurement model is written as:

$${\mathit{Z}}_k=\left[\begin{array}{c}{\mathit{Z}}_{p,k}\\ {\mathit{Z}}_{v,k}\end{array}\right]=\left[\begin{array}{c}{\mathit{P}}_{INS,k}-{\mathit{P}}_{GNSS,k}\\ {\mathit{V}}_{INS,k}-{\mathit{V}}_{GNSS,k}\end{array}\right]=\left[\begin{array}{c}\delta {\mathit{P}}_k+{\mathit{N}}_{g,k}\\ \delta {\mathit{V}}_k+{\mathit{M}}_{g,k}\end{array}\right]=\left[\begin{array}{c}{\mathit{H}}_{p,k}\\ {\mathit{H}}_{v,k}\end{array}\right]{\mathit{X}}_k+\left[\begin{array}{c}{\mathit{N}}_{g,k}\\ {\mathit{M}}_{g,k}\end{array}\right]={\mathit{H}}_k{\mathit{X}}_k+{\mathit{V}}_k,$$

(11)

where ${\mathit{N}}_g$ and ${\mathit{M}}_g$ are position error and velocity error of GNSS, respectively. ${\mathit{H}}_p$, ${\mathit{H}}_v$ are the measurement matrices. The measurement error ${\mathit{V}}_k$ is considered as white noise, i.e., $E\left({\mathit{V}}_k\right)=0$. Its covariance ${\mathit{R}}_k$ can be estimated as ${\mathit{R}}_{\mathit{k}}=E\left[{\mathit{V}}_k{\mathit{V}}_k^T\right]$. Details about the specific parameters of $\mathit{F},\mathit{G},\mathit{H}$ can be found in [28]. In Equation (11), the item ${\mathit{Z}}_k$ represents the position and velocity difference between the GNSS measurements and INS estimation. Under the normal cases, the position and velocity states of GNSS are consistent with that of INS, and hence the position and velocity difference ${\mathit{Z}}_k$ is small, equal to the sum of GNSS noise and INS errors, i.e., ${\mathit{Z}}_k={\mathit{V}}_k$. If all INS errors are corrected, the item ${\mathit{Z}}_k$ is GNSS noise. In some loosely coupled integration systems, the velocity difference $\delta \mathit{V}$ is optional. Then, the GNSS/INS integration system becomes integration with position fusion, and the measurement model becomes ${\mathit{Z}}_{\mathit{k}}={\mathit{H}}_{p,k}{\mathit{X}}_k+{\mathit{N}}_{g,k}$.

3.2. Analysis of the Effect of Spoofing Interference on the GNSS/INS

Kalman Filter is most used in the GNSS/INS integration systems. In a standard Kalman Filter, the posteriori state estimate ${\widehat{\mathit{X}}}_k$ is estimated as,

$${\widehat{\mathit{X}}}_k={\widehat{\mathit{X}}}_{k,k-1}+{\mathit{K}}_k\left({\mathit{Z}}_k-{\mathit{H}}_{\mathit{k}}{\widehat{\mathit{X}}}_{k,k-1}\right),$$

(12.1)

$${\widehat{\mathit{X}}}_{k,k-1}={\mathit{F}}_{k,k-1}{\widehat{\mathit{X}}}_{k-1},$$

(12.2)

$${\mathit{K}}_k={\mathit{P}}_{k,k-1}{\mathit{H}}_k^T{\left({\mathit{H}}_k{\mathit{P}}_{k,k-1}{\mathit{H}}_k^T+{\mathit{R}}_k\right)}^{-1},$$

(12.3)

where ${\widehat{\mathit{X}}}_{k,k-1}$ is the priori state estimate, ${\mathit{K}}_k$ is the optimal Kalman gain, ${\mathit{P}}_{k,k-1}=E\left[{\widehat{\mathit{X}}}_{k,k-1}{\widehat{\mathit{X}}}_{k,k-1}^T\right]$ is the priori error covariance matrix, ${\mathit{P}}_k=E\left[{\widehat{\mathit{X}}}_k{\widehat{\mathit{X}}}_k^T\right]$ is the posteriori error covariance matrix. The items ${\mathit{P}}_{k,k-1}$ and ${\mathit{P}}_k$ are computed as,

$${\mathit{P}}_{k,k-1}={\mathit{F}}_{k,k-1}{\mathit{P}}_{k-1}{\mathit{F}}_{k,k-1}^T+{\mathit{G}}_{k-1}{\mathit{Q}}_k{\mathit{G}}_{k-1}^T,$$

(12.4)

$${\mathit{P}}_k=\left(\mathit{I}-{\mathit{K}}_k{\mathit{H}}_k\right){\mathit{P}}_{k,k-1},$$

(12.5)

The item ${\widehat{\mathit{X}}}_k$ is the optimal estimate of the errors of position, velocity and the IMU errors. It also used to compensate the position, velocity and IMU errors. In the normal case, the item ${\widehat{\mathit{X}}}_k$ is close to zero, meaning that the all errors of INS are compensated. According to the errorless ${\widehat{\mathit{X}}}_k$, the item ${\mathit{Z}}_k$ equal to the GNSS noise, and $E\left({\mathit{Z}}_k\right)=0$. However, when the standard Kalman Filer is in steady state, the matrix ${\mathit{P}}_{k,k-1}$, ${\mathit{P}}_k$, and ${\mathit{K}}_k$ tend to be constant matrices. They slightly vary with the change of measurement noise or process noise. As a result, the Kalman Filter is degraded and equivalent to a constant weighted average method.

Under a spoofing attack, the GNSS position and velocity errors include additional spoofing-induced relative position and relative velocity. The measurement ${\mathit{Z}}_k$ becomes,

$${\mathit{Z}}_k^J=\left[\begin{array}{c}\delta {\mathit{P}}_k+{\mathit{N}}_{g,k}+∆{\mathit{p}}_{s,k}\\ \delta {\mathit{V}}_k+{\mathit{M}}_{g,k}+∆{\mathit{v}}_{s,k}\end{array}\right]={\mathit{Z}}_k+{\mathit{J}}_k,$$

(13)

where the spoofing vector ${\mathit{J}}_k$ is ${\left[\begin{array}{cc}∆{\mathit{p}}_{s,k}& ∆{\mathit{v}}_{s,k}\end{array}\right]}^T$. The offsets of position $∆{\mathit{p}}_{s,k}$ and velocity $∆{\mathit{v}}_{s,k}$ generated by spoofing attacks cannot be eliminated by using Equation (11). The spoofed measurements ${\mathit{Z}}_k^J$ includes the deviation ${\mathit{J}}_k$. Clearly, spoofing attracts can lead to measurement increase. Besides spoofing attacks, the increase may result from the vehicle motion and IMU error.

Substituting Equation (13) into (12.1), the state compensation ${\widehat{\mathit{X}}}_k^J$ at moment k when spoofing attack appears becomes,

$${\widehat{\mathit{X}}}_k^J={\widehat{\mathit{X}}}_{k,k-1}+{\mathit{K}}_k\left({\mathit{Z}}_k^J-{\mathit{H}}_k{\widehat{\mathit{X}}}_{k,k-1}\right)={\widehat{\mathit{X}}}_k+{\mathit{K}}_k{\mathit{J}}_k={\widehat{\mathit{X}}}_k+\delta {\widehat{\mathit{X}}}_k^J,$$

(14)

In Equation (14), the priori state estimate ${\widehat{\mathit{X}}}_{k,k-1}$ is related to the previous state compensation ${\widehat{\mathit{X}}}_{k-1}$, which is independent of the measurement ${\mathit{Z}}_k^J$ at the k − 1 moment, and ${\widehat{\mathit{X}}}_k$ is the part of state compensation without spoofing attack effects. Therefore, the spoofing effects on state compensation is $\delta {\widehat{\mathit{X}}}_k^J={\mathit{K}}_k{\mathit{J}}_k$. Since ${\mathit{J}}_k\ne \mathbf{0}$ and $\mathrm{E}\left(\delta {\widehat{\mathit{X}}}_k^J\delta {\widehat{\mathit{X}}}_k^{J,T}\right)>0$, it can be obtained that $\mathrm{E}\left({\widehat{\mathit{X}}}_k^J{\widehat{\mathit{X}}}_k^{J,T}\right)>\mathrm{E}\left({\widehat{\mathit{X}}}_k{\widehat{\mathit{X}}}_k^T\right)={\mathit{P}}_k$. The value of ${\mathit{P}}_k$ in the spoofing environment varies slightly, disagreement with the state error variations. As pointed in Reference [18], it is difficult to detect spoofing attacks using single ${\mathit{P}}_k$. Meanwhile, the posteriori state estimate ${\widehat{\mathit{X}}}_k$ varies with ${\mathit{J}}_k$. It means that the spoofing attack causes abnormal corrections on all state compensations, including the navigation compensations ($\delta \mathit{P}$ and $\delta \mathit{V}$) and IMU error compensations (${\mathit{\epsilon }}_b$, ${\mathit{\epsilon }}_r$ and $\nabla$). Between the two types of compensation, the navigation information follows the spoofed GNSS [18]; because, without spoofing detection, integration algorithms tend to believe the position and velocity difference between GNSS and INS relating to the carrier motion. Thus, the position and velocity from the integration system are quickly corrected as the similar to the spoofing values.

The IMU errors refer to its inherent physical characteristics, and therefore the compensation of the IMU errors ${\mathit{\epsilon }}_b$, ${\mathit{\epsilon }}_r$ and $\nabla$ theoretically vary within reasonable ranges. During spoofing, GNSS measured position and velocity are inconsistent with INS estimated ones. The inconsistency leads to abnormal compensation of the IMU errors through the Kalman gain.

Under MEAC attacks ${\mathit{J}}_k={\left[∆{\mathit{p}}_{s,k}^T,{\mathbf{0}}_{\mathbf{3}\times \mathbf{1}}\right]}^T$, the item $\delta {\widehat{\mathit{X}}}_k^J$ is ${\mathit{K}}_{k,p}^{PV}∆{\mathit{p}}_{s,k}$ for the integration system with position/velocity fusion, and $\delta {\widehat{\mathit{X}}}_k^J={\mathit{K}}_{k,p}^P∆{\mathit{p}}_{s,k}$ for the system with position fusion. The IMU error compensations are the 7–15th elements of $\delta {\widehat{\mathit{X}}}_k^J$ and their values are proportional to $∆{\mathit{p}}_{s,k}$. Both integration systems, with position and position/velocity fusions, are sensitive to the spoofing position deviations under MEAC attacks. Under LOA attack, the spoofing position gradually deviates from the authentic position with small initial position offset $∆{\mathit{p}}_{s,0}\approx \mathbf{0}$ (${\mathit{J}}_k$=${\left[\begin{array}{cc}{\mathbf{0}}_{\mathbf{3}\times \mathbf{1}}& ∆{\mathit{v}}_{s,k}\end{array}\right]}^T$). The state compensation is $\delta {\widehat{\mathit{X}}}_k^J={\mathit{K}}_{k,p}^P\mathbf{0}=\mathbf{0}$ in the system with position fusion and the norm $\Vert {\mathit{K}}_{k,p}^P∆{\mathit{p}}_{s,k}\Vert =\mathbf{0}$. In the system with position/velocity fusion, the item $\delta {\widehat{\mathit{X}}}_k^J={\mathit{K}}_{k,v}^{PV}∆{\mathit{v}}_{s,k}\ne \mathbf{0}$, is proportional to spoofing velocity deviations $∆{\mathit{v}}_{s,k}$. Therefore, the IMU error compensations in the system with position/velocity fusion have more significant increment at the moment spoofing velocity changes.

Generally, the analysis shows three effects of spoofing attacks on the GNSS/INS loosely coupled integration systems.

(1)

Spoofing attack ${\mathit{J}}_k={\left[\begin{array}{cc}∆{\mathit{p}}_{s,k}& ∆{\mathit{v}}_{s,k}\end{array}\right]}^T$ leads to an additional compensation $\delta {\widehat{\mathit{X}}}_k^J={\mathit{K}}_k{\mathit{J}}_k$ in the integration systems. The $\delta {\widehat{\mathit{X}}}_k^J$ modifies the INS estimated position and velocity into spoofed ones.

(2)

The $\delta {\widehat{\mathit{X}}}_k^J$ mis-corrects the IMU errors different from its own physical features, which is possibly used to detect spoofing attacks.

(3)

The integration systems with position fusion and position/velocity fusion are susceptible to MEAC attacks. To LOA attack, the system with position/velocity fusion is more susceptible.

4. Experimental Results and Discussions

In this section, MEAC attack and LOA attack are implemented. The performances of the Global Positioning System/Inertial Navigation System (GPS/INS) loosely coupled integration systems with position fusion and position/velocity fusion are tested under these two spoofing attacks.

4.1. Experimental

Figure 2 shows the experimental setup of the spoofing interference on the roof of the College of Automation Engineering (CAE) Building 2 in the Nanjing University of Aeronautics and Astronautics (NUAA) campus.

A GPS repeater is used to generate spoofing signal. Its receiving antenna is about 20 m distance from the target receiver in the case of MEAC attack, and gradually far away from the target receiver in the case of LOA attack. In the test, the spoofing signals cover limited ranges, about 2–5 m. The transmitting antenna should be close to the target receiver to ensure a strong power of spoofing signals. The target receiver is a software-defined GPS receiver with the OLinkStar NS210M IF sampler (OLinkStar Co., Beijing, China) collecting GPS L1 signals. Meanwhile, inertial data are acquired using the low-accurate Xsens MTi-G-710 inertial sensors (Xsens Co., Enschede, The Netherlands), where nominal specifications are shown in

Table 1. IMU nominal specifications.

	Gyro	Accelerometer
In-run bias stability	10 deg/h	40 μg
Noise density	0.01 deg/s/Hz1/2	80 μg/Hz1/2

.

It should be noted that spoofing attacks in the experiments are not strict MEAC attack or LOA attack, due to the unknown hardware delay of the repeater. The two cases simulate the position and velocity variations of MEAC attack and LOA attack. LOA attack tries to drag the GPS measured position gradually far away from its authentic position. MEAC attack tends to lead a sudden position variation. In MEAC attack case, the distance between antennas of the receiver and repeater is fixed. The collected data length is about 150 s and spoofing attack starts at 83 s. In LOA attack case, the antenna of the repeater is slowly (about 1.2 m/s measured by GPS) away from the receiving antenna of the receiver.

Two common loosely coupled integration systems are tested. One integration system fuses position and velocity information in the Kalman Filter; the other uses position information only. The employed standard Kalman Filter is updated twice per second. The measurement noise covariance matrix is set as ${\mathit{R}}_k=\mathrm{diag}{\left(\left[\begin{array}{cc}\begin{array}{ccc}3 \mathrm{m}& 3 \mathrm{m}& 6 \mathrm{m}\end{array}& \begin{array}{ccc}0.2 \mathrm{m}/\mathrm{s}& 0.2 \mathrm{m}/\mathrm{s}& 0.2 \mathrm{m}/\mathrm{s}\end{array}\end{array}\right]\right)}^2$, based on the accuracy of GPS position errors and velocity errors in ENU coordinate. The process noise, is set as ${\mathit{Q}}_k=E\left(\left[\begin{array}{ccc}{\mathit{w}}_{wg}& {\mathit{w}}_{rg}& {\mathit{w}}_{wa}\end{array}\right]{\left[\begin{array}{ccc}{\mathit{w}}_{wg}& {\mathit{w}}_{rg}& {\mathit{w}}_{wa}\end{array}\right]}^T\right)$, where ${\mathit{w}}_{wg}=\left[\begin{array}{ccc}0.28& 0.28& 0.28\end{array}\right]$ deg/s, ${\mathit{w}}_{rg}=\left[\begin{array}{ccc}10& 10& 10\end{array}\right]$ deg/h, and ${\mathit{w}}_{wa}=\left[\begin{array}{ccc}98& 98& 98\end{array}\right]$μg.

4.2. Navigation Performanceof the GPS/INS under SpoofingAttacks

The average position in East-North-Up coordinate from the GPS receiver under normal situation is considered as the reference value. Figure 3 shows the eastern position errors and eastern velocities from the GPS receiver and the two GPS/INS loosely coupled integration systems.

In Figure 3a, during MEAC attack, the eastern position errors of GPS suddenly jump to −12 m from 0 m and the eastern velocity mainly keeps at zero except a slight increment during 83 s to 90 s. The slight increment on velocity probably results from spoofing attack. The eastern position errors from the two GPS/INS loosely coupled integration systems show the similar performance to that of GPS. Although the velocity fusion smooths the increase of position error, the GPS/INS system has been spoofed under MEAC attack. For the velocity estimation, the integration system with position/velocity fusion performs similar to the GPS receiver, estimated eastern velocity varying slightly and close to zero. However, the integration system with position fusion displays a high sensitivity to MEAC attack, a −3.8 m/s eastern velocity jerk following the occurrence of MEAC attack.

As shown in Figure 3b, under LOA attack, the eastern position errors of GPS deviate gradually from the authentic location during 55.5 s to 78 s, and maintain at about 22 m after 78 s. Like the GPS receiver, the both integration systems are spoofed by LOA attack. Their velocity estimations show the same variation during the spoofing period. A short velocity increase by 0.5–1.8 m/s occurs during the dragging period from 55.5 s to 78 s. Then, the velocity turns back zero after 78 s.

To investigate the overall influence of spoofing attacks on the position and velocity, the norms of position compensation $\Vert \delta \mathit{p}\Vert$ and velocity compensation $\Vert \delta \mathit{v}\Vert$ are defined as:

$$\begin{array}{c}\Vert \delta \mathit{p}\Vert =\sqrt{{\left(\delta p_e\right)}^2+{\left(\delta p_n\right)}^2+{\left(\delta p_u\right)}^2}=\sqrt{{{\displaystyle \sum }}_{i=1}^3{\left({\widehat{X}}_k^J\left(i\right)\right)}^2},\\ \Vert \delta \mathit{v}\Vert =\sqrt{{\left(\delta v_e\right)}^2+{\left(\delta v_n\right)}^2+{\left(\delta v_u\right)}^2}=\sqrt{{{\displaystyle \sum }}_{i=4}^6{\left({\widehat{X}}_k^J\left(i\right)\right)}^2},\end{array}$$

(15)

Figure 4 shows the norms of position and velocity compensation under spoofing attacks. Under MEAC attack, the position and velocity compensation norms from the GPS/INS with position fusion increases greatly, while the norms from the GPS/INS with position/velocity fusion change a little. Under LOA attack, both the norms estimated by the GPS/INS with position fusion and position/velocity fusion here have some increments, not as significant as variations under MEAC attack. In addition, the norm increments of position and velocity from the system with position fusion quickly and sharply follow the occurrence of MEAC attack. Under LOA attack, the increment occurs at 64 s, about lagging 9 s to the occurrence of LOA attack. It implies a possible spoofing detection for the integration system with position fusion through using unreasonable increment on norms of position and velocity compensation. The unreasonable norm increment occurs following MEAC attack and a period lagging to LOA attack. It should be pointed out that under LOA attack the position and velocity compensation norms increments is difficult to detect.

Shortly, the GPS/INS loosely coupled integration systems based on standard Kalman Filter are deceived by both MEAC and LOA attacks.

4.3. The Variations of IMU Error Compensation under MEAC and LOA Attacks

Figure 5 shows the estimated gyroscope bias errors from the GPS/INS with position and position/velocity fusions under MEAC and LOA attacks. Before spoofing, the gyroscope bias errors vary within 0.01 deg/h in Figure 5a and 0.03 deg/h in Figure 5b. Under MEAC attack, the gyroscope bias errors in Z-axis range between −0.07 deg/h and 0.06 deg/h. The two integration systems show the similar performance. The gyroscope bias errors significantly increase during the whole MEAC spoofing. Under LOA attack, the gyroscope bias errors estimated by the position/velocity-fusion-based integration system become large, ranging between −0.08 deg/h and 0.14 deg/h. With the position fusion, the GPS/INS integration system is little disturbed by LOA attack.

In addition, the effects of spoofing attacks on different axial gyroscopes are different. To investigate the overall influence of the spoofing attack on the IMU, the norms of the XYZ-axis gyroscope bias compensation $\Vert {\mathit{\epsilon }}_b\Vert$, the gyroscope first-order Markov compensation $\Vert {\mathit{\epsilon }}_r\Vert$ and the XYZ-axis accelerometers bias compensation $\Vert \nabla \Vert$ are defined as,

$$\begin{array}{c}\Vert {\mathit{\epsilon }}_b\Vert =\sqrt{{\left({\epsilon }_{bx}\right)}^2+{\left({\epsilon }_{by}\right)}^2+{\left({\epsilon }_{bz}\right)}^2}=\sqrt{{{\displaystyle \sum }}_{i=7}^9{\left(\delta {\widehat{X}}_k^J\left(i\right)\right)}^2},\\ \Vert {\mathit{\epsilon }}_r\Vert =\sqrt{{\left({\epsilon }_{rx}\right)}^2+{\left({\epsilon }_{ry}\right)}^2+{\left({\epsilon }_{rz}\right)}^2}=\sqrt{{{\displaystyle \sum }}_{i=10}^{12}{\left(\delta {\widehat{X}}_k^J\left(i\right)\right)}^2},\\ \Vert \nabla \Vert =\sqrt{{\left({\nabla }_x\right)}^2+{\left({\nabla }_y\right)}^2+{\left({\nabla }_{\mathrm{z}}\right)}^2}=\sqrt{{{\displaystyle \sum }}_{i=13}^{15}{\left(\delta {\widehat{X}}_k^J\left(i\right)\right)}^2},\end{array}$$

(16)

Figure 6 shows the norms of the IMU error compensation under spoofing attacks. Under MEAC attack, as shown in Figure 6a, the norms of the gyroscope bias compensations become much larger than that under spoofing-free period. The norm of the gyroscope bias compensation reaches 0.074 deg/h at 95 s during spoofing period. Under spoofing-free condition, the maximum norm value is 0.007 deg/h at 64.5 s. Similar variations are also found in $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$. Although the occurrence of the incorrectness in the GPS/INS loosely coupled integration with position/velocity fusion is 1 s slower than that in the system with position fusion, two systems show the similar sensitivity to MEAC attack. Thus, the norms of the IMU error compensation have the capability to detect MEAC attack.

Under LOA attack, as shown in Figure 6b, the increments of $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ from the integration system with the position fusion become insignificant. Differently, from the system with the position/velocity fusion, the norms also increase during LOA attack. Although the increments are not as obvious as that under MEAC attack, the maximum value of $\Vert {\mathit{\epsilon }}_b\Vert$ reaches 0.14 deg/h, 4.6 times larger than the value under spoofing-free periods.

To test the performance of $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ under dynamic situation, the IMU is placed on a turntable to simulate attitude movement, i.e., heading, pitch and roll angle changes simultaneously. The collected inertial data is integrated with the spoofed GPS data to study whether spoofing attacks would have significant impacts on the dynamic IMU error compensation. The results are shown in Figure 7.

In Figure 7a, the fluctuations of IMU error compensation norms, under spoofing-free period, are slightly larger than the static IMU. Under MEAC attack, the norms significantly increase regardless of whether the fusion information is position or position/velocity. Similar to the static case, the variation of $\Vert {\mathit{\epsilon }}_b\Vert$ from the integration system with position fusion is not obvious under LOA attack, as shown in Figure 7b. With the position/velocity fusion, the maximum value of $\Vert {\mathit{\epsilon }}_b\Vert$ reaches 0.43 deg/h during spoofing period, which is five times of the maximum norm under normal condition. The variations of $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ are similar to $\Vert {\mathit{\epsilon }}_b\Vert$. It should be noted that the moment with obvious spoofing-induced increments on $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ are later than the moment spoofing appearing. It may be due to the smoothing effects of Kalman Filter on velocity correction.

Shortly, for the loosely coupled integration system with the position/velocity fusion, the IMU error compensations are sensitive to both MEAC and LOA attacks. The compensations increase significantly during spoofing. For the system with position fusion, the IMU error compensation are sensitive to MEAC attacks. Different to the position and velocity compensations which also affected by the receiver dynamic situation, the IMU error compensations refer to IMU physical features and are possible to detect spoofing attacks in the GPS/INS loosely coupled integration systems.

To test the feasibility of spoofing attack detection based on IMU error compensations, a basic detection is employed. When the instantaneous $\Vert {\mathit{\epsilon }}_b\Vert$ is larger than its historical statistics, the state of $\Vert {\mathit{\epsilon }}_b\Vert$ will stay at pre-alarm state (marked as 2 in Figure 8), which means there would be a possibility of spoofing attack. The states of the item $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ are detected using the similar method. Then the alarm of spoofing attack is given through combining detection results of $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$. Since both $\Vert {\mathit{\epsilon }}_b\Vert$ and $\Vert {\mathit{\epsilon }}_r\Vert$ are the features of gyroscopes and $\Vert \nabla \Vert$ is related to accelerometers, the spoofing attack is alarmed when the state of $\Vert \nabla \Vert$ is pre-alarm, and any state of $\Vert {\mathit{\epsilon }}_b\Vert$ or $\Vert {\mathit{\epsilon }}_r\Vert$ is pre-alarm.

Figure 8a illustrates the detection results of MEAC attack in GPS/INS with position and position/velocity fusions. Under MEAC attack, $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ of the GNSS/INS with position fusion suddenly rise at 83 s, the moment of MEAC attack beginning. All $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ are into the pre-alarm state and spoofing is detected at 83 s. For the GPS/INS with position/velocity fusion, the visible rise of $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ follows the occurrence of MEAC attack after about two seconds. Each of them alarms the spoofing after a short delay. Therefore, the voted alarm of MEAC attack is about two second later than the moment of spoofing occurrence. By contrast, under LOA attack, as shown in Figure 8b, any item of $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ in system with position fusion fails in alarming spoofing; because, the IMU error compensations increase slightly. Fortunately, these items, especially the $\Vert \nabla \Vert$ and $\Vert {\mathit{\epsilon }}_b\Vert$, of the system with position/velocity fusion, increase dramatically once LOA attack occurs. Although the item $\Vert {\mathit{\epsilon }}_r\Vert$ switches into pre-alarm state with 8 s delay, the voted spoofing alarm is at 56 s, close to the occurrence moment of LOA attack. In short, INS error compensations, in both integration systems with position and position/velocity fusions, can be used to detect MEAC attack. LOA attack is likely to be detected effectively by using the INS error compensations from the position/velocity fusion-based integration system. Once the spoofing attack being detected, it is suggested to reject GPS information input to Kalman filter, which is shown in Figure 9.

Figure 9 shows the eastern position error estimated by GPS/INS with two types of fusions before and during spoofing attacks. Under MEAC attack, as shown in Figure 9a, both GPS/INS systems with position fusion and position/velocity fusion succeed in detecting the occurrence of MEAC attack with a short delay, about one or two seconds. The integration system degrades into independent INS. The estimated position is no longer deceived by spoofing attacks. It is no doubt that the position error of stand-alone INS increases with time. Therefore, in Figure 9a, the position error of GPS/INS with position fusion increases to 12 m at 88 s. After 5 s since spoofing detection, the position error of the system with position fusion is larger than the spoofing induced position error. With position/velocity fusion, the GPS/INS shows better performances than the one with position fusion. It keeps its position error within 12 m for about 16 s. The improvement is probably due to more accurate error compensation than that estimated by the system with position fusion. Under LOA attack, as shown in Figure 9b, the GPS/INS with position fusion fails in spoofing detection since its $\Vert {\mathit{\epsilon }}_b\Vert$, $\Vert {\mathit{\epsilon }}_r\Vert$ and $\Vert \nabla \Vert$ increments are too slight to detect spoofing attack. The system with position/velocity fusion still successfully detects the spoofing attack and turns into stand-alone INS at 56 s. The position error under LOA attack quickly increases to 22 m at 76 s. During the 20 s duration, the INS position error keeps less than spoofing induced position error. The slight superiority results from the growth rate of INS position error lower than the spoofing velocity $\mathsf{\Delta }{\mathit{v}}_s$. It is a combination result of IMU performance and error compensation, as well as the values of spoofing velocity $\mathsf{\Delta }{\mathit{v}}_s$ and position deviation $\mathsf{\Delta }{\mathit{p}}_s$, which are out of the discussion of the study.

Shortly, IMU error compensation-based spoofing detection is effective. For GPS/INS with position/velocity fusion, it is possible to detect both MEAC attack and LOA attack. Once the integration system turns into the stand-alone INS after spoofing detection, the system is able to isolate spoofing effects. In this case, the accumulative position error is inevitable. High-precise IMUs and advanced IMU error compensation algorithms are helpful in slowing the INS position error growth.

5. Conclusions

In this paper, the performance of the GNSS/INS loosely coupled integration systems with position and position/velocity fusions under MEAC attacks and LOA attacks are analyzed. The GNSS/INS loosely coupled integration systems with either position fusion or position/velocity fusion is easily disturbed by spoofing attacks, similar to GNSS.

However, we can exploit the fact that the position and velocity from GNSS are inconsistent with the physical states measured by the INS. The inconsistency causes abnormal corrections to the IMU error compensations. Specially, the incorrect IMU error compensations from the integration system with the position fusion are significant under MEAC attack, which generates a jump of positioning results. Under LOA attack with slow position variation, as well as MEAC attacks, the compensations from the system with the position/velocity fusion are more sensitive. Thus, it is possible, using IMU error compensations, which are related to IMU’s physical features, to detect spoofing attacks. A simple detection method is implemented and tested. The detection results show that with position/velocity fusion, the GNSS/INS loosely coupled integration system is able to detect both MEAC and LOA spoofing attacks through using the IMU error compensations.

The paper focuses on the possibility of spoofing detection based on IMU error compensation for the loosely coupled integration system. Further studies will interest in the effects of IMUs with different accuracy levels and the spoofing detection and mitigation methods.