A GNSS spoofing signal detection/elimination includes tracking acquired candidate GNSS signals for each target GNSS signal, identifying the acquired candidate GNSS signals as authentic, unauthenticated, or counterfeit, removing the counterfeit GNSS signal(s) from tracking, generating a first list of the authentic GNSS signals and a second list of unauthenticated candidate GNSS signals, creating a plurality of sets of GNSS signals by selecting at least four GNSS signals from among the first list and the second list, such that each set includes all of the authentic GNSS signals, if any, and at least one unauthenticated candidate GNSS signal such that each set includes only one candidate signal per target GNSS signal, calculating PVT solutions and post-fit residuals for each set, thereby obtaining a plurality of estimated solutions, estimating authenticity of unauthenticated GNSS signals by analyzing the plurality of estimated solutions.

Techniques for detecting GNSS spoofing using inertial mixing data are disclosed. One or more navigation parameters are determined by at least one GNSS receiver and a plurality of IRS from at least two periods of time. The navigation parameters from the GNSS receiver(s) and the IRS are compared at each time period, and the difference(s) between the compared navigation parameters are further compared to generate at least one differential value. A system can detect GNSS spoofing by comparing the at least one differential value to a suitable threshold. In one aspect each IRS navigation parameter is compared with a corresponding GNSS navigation parameter, wherein the plurality of differential values is mixed before threshold comparison. In another aspect, each IRS navigation parameter is mixed before comparison with a GNSS navigation parameter, and the resulting differential value is then compared against a threshold.

In some examples, a system includes a transceiver configured to receive surveillance messages from Y target vehicles, where Y is an integer greater than two. The system includes processing circuitry configured to determine predicted positions of the Y target vehicles based on the surveillance messages. The processing circuitry is also configured to determine reported positions of the Y target vehicles based on later received surveillance messages. The processing circuitry is further configured to determine that respective differences between the respective predicted position and the respective reported position for X of the Y target vehicles is greater than a threshold distance. The processing circuitry is configured to determine that Global Navigation Satellite System interference has occurred in response to determining that X divided by Y is greater than a threshold level.

A computer architecture for geolocation spoofing/meaconing detection is disclosed. According to some aspects, a computer accesses an incoming geolocation positioning signal. The computer determines, using a signal characteristics calculation subsystem, geolocation positioning signal characteristics for the incoming geolocation positioning signal. The computer provides, using a geolocation positioning spoofing/meaconing detection subsystem, the geolocation positioning signal characteristics as an input vector to a neural network, wherein the neural network determines whether the incoming geolocation positioning signal is legitimate or fake. If the incoming geolocation positioning signal is determined to be fake: the computer computes, using a Bayesian inference subsystem, a likelihood and a severity of a geolocation positioning technology based attack. The computer provides, as a digital transmission, an indication of whether the incoming geolocation positioning signal is legitimate or fake.

A interference detection device (22) perform the following actions: receiving individual position data from mobile terminals (4(j)) which individual position data indicates an area (12(j)) in which individual ones of the mobile terminals (4(j)) are located based on positioning signals received by the mobile terminals (4(j)); identifying if individual position data may have been affected by one or more interfering signals transmitted by interfering device (14(m)) and interfering with the positioning signals; (A) identifying if a number of mobile terminals (4.sub.v(j)) in a first area (18) is higher than a maximum threshold number, and, if so, determining that individual position data of the number of mobile terminals (4.sub.v(j)) may have been affected by the interfering signals; or (B) identifying if a number of the mobile terminals (4(j)) in a second area (36) is lower than a minimum threshold number; and, if so, determining that individual position data of the number of mobile terminals (4(j)) may have been affected by interfering signals; or (C) receiving further individual position data which indicates further areas (18) in which mobile terminals (4(j)) are located based on another positioning technique than a positioning technique used to determine the individual position data as received from the mobile terminals (4(j)); determining if the areas (12(j)) overlap with the further areas (18) at least to a minimum extent, and, if not, determining that individual position data of the mobile terminals (4(j)) may have been affected by the interfering signals.

A global navigation satellite system (GNSS) spoofing detection and classification technique is provided. An optimization problem is formulated at the baseband correlator domain by using an optimization algorithm such as the Least Absolute Shrinkage and Selection Operator (LASSO) algorithm, for example. A model of correlator tap outputs of the intended received signal is created to form a dictionary of pre-computed waveform functions (e.g., triangle-like-shaped functions). Sparse signal processing can be leveraged to choose a decomposition of pre-computed waveform functions from the dictionary. The optimal solution of this minimization problem can discriminate the presence of a potential spoofing attack peak by observing the decomposition of two different code-phase values (authentic and spoofed) in a sparse vector output. A threshold can be used to mitigate false alarms. Furthermore, a variation of the minimization problem can be provided that enhances the dictionary to a higher resolution.

A system and method for detecting spoofing of global navigation satellite system (GNSS) signals using a single antenna is provided.

A satellite tracking channel has a frequency loop tracking a carrier frequency of a satellite signal. A first indication of a spoofed signals is generated based on a determined satellite signal noise floor value associated with the satellite tracking channel and a tracking channel signal noise threshold associated with the satellite tracking channel. A second indication of a spoofed signal is generated based on a determining satellite tracking phase noise associated with the satellite tracking channel and a tracking channel phase noise threshold associated with the satellite tracking channel. Reception of a spoofed signal on the satellite tracking channel is detected based on the generated first indication of a spoofed signal and the generated second indication of the spoofed signal.

A transceiver system and methodology generate, monitor and detect changes in Global Navigation Satellite System (GNSS) interferometric reflectometry signatures as to provide defensive security for GNSS signals used for positioning, navigating, and timing applications.

Some embodiments of the time resilient system and methods disclosed herein can be configured to detect and defend against invalid time signals. According to various embodiments of the disclosed technology, the time resilient system include a receiver for collecting time signals sourced from an external clock. By way of example only, the external clock may be a high precision clock housed within a Global Positioning System. Other embodiments may include an internal clock calibrated to a time reflected on the external clock so that the internal clock and the external clock are synchronized. Additionally, a controller may monitor changes in time signals of the external over a period of time against the internal clock, where the system is alerted of a timing attack when the time signals collected from the receiver deviate a pre-determined time range with the time of the internal clock.