M2-T6: GNSS jamming and spoofing

Learning objectives

After this lesson, you should be able to:

• Distinguish jamming, spoofing and unintentional interference by their effect and detectability.
• Explain how an innovation gate and an odometry cross-check detect spoofing and why slow ramps are hard.
• Design a response policy for detected jamming or spoofing.
• Reproduce a spoofing ramp against a gated filter and measure detection delay.

Conceptual explanation

Jamming raises the noise floor so receivers lose lock: the symptom is no fix or a degraded fix. Spoofing transmits counterfeit signals that a receiver accepts as genuine: the symptom is a confident, wrong position. Interference can be unintentional (a poorly shielded onboard device or a nearby transmitter) and looks like jamming.

Jamming is a loss of availability and is usually obvious. Spoofing is a loss of integrity and is not obvious from the GNSS data alone: the receiver may report good satellite counts and low DOP. Detection therefore comes from comparison with another source: the inertial and odometry estimate.

Engineering intuition

Imagine the filter as a skeptical navigator who always has a dead-reckoned position in mind. A GNSS fix that disagrees by a few sigma is rejected. A spoofer who understands this does not jump the position: it drags it slowly, so each fix is within the gate, and the filter follows the ramp. The defence is a longer memory: over several seconds, the displacement reported by GNSS must agree with the displacement from independent odometry. A spoofed ramp moving at 1 m/s relative to truth accumulates a visible disagreement within a few seconds.

Mathematical formulation

Innovation gate

For a GNSS position measurement $z$ with filter prediction $\hat{z}$, innovation $y=z-\hat{z}$ and innovation covariance $S=H\,P\,H^{\top}+R$, accept the measurement if the normalised innovation squared stays below a chi-square threshold:

Odometry cross-check

Compare the GNSS displacement over a window of $N$ seconds with the displacement predicted by GNSS-independent sources, averaging samples at both ends to suppress noise:

$\bar{z}$

mean of $n$ GNSS samples at the start or end of the window.

$\hat{p}$

mean estimated position from the odometry-driven filter at those same times.

$\kappa$

threshold multiplier (typically 4–6) chosen for a target false-alarm rate.

The detection delay for a spoof ramp of rate $\rho$ against a threshold $\delta$ over a window $W$ is approximately $t\approx \delta /\rho +W/2$: slower ramps take longer, and with $\rho$ below noise-limited sensitivity the spoof cannot be separated from drift of the odometry itself. The odometry’s own drift is the floor of this method.

Architecture and data flow

GNSS receiver → gate (per fix) → cross-check monitor (windowed, against visual and LiDAR odometry) → trust flag → estimator and navigation manager. When the flag drops, GNSS is excluded from the filter, the mode manager moves to a GNSS-denied mode, and the mission may be restricted. The GNSS-Denied Failure Simulator implements exactly this chain.

Real-world UAV applications

• Operating near conflict zones or large transmitters where interference is known.
• Integrity monitoring of a delivery or inspection UAV that must not follow a false position.
• Choosing between GNSS-reliant and odometry-reliant flight modes automatically.
• Authenticated or multi-band receivers add signal-level protection; they complement, not replace, a cross-check.

Implementation example

This runs as shown: a minimal gated filter fed a spoof ramp. It prints the fast-ramp case (caught by the gate) and the slow-ramp case (the filter follows until a displacement cross-check against pure odometry fires).

import numpy as np
rng = np.random.default_rng(4)

def run(ramp, cross_check, T=120.0, dt=0.2, sigma_gnss=1.5, sigma_odo=0.05, q_pos=0.03):
    """1-D position. True velocity 4 m/s. Odometry measures velocity (sigma_odo m/s). GNSS measures position.
    q_pos is process noise per step: it stands for odometry scale error and unmodelled motion."""
    x, P = 0.0, 4.0                      # estimate, variance
    hist_z, hist_o = [], []
    odo = 0.0                            # pure dead reckoning from odometry only: independent of GNSS
    detected_at, t = None, 0.0
    truth = 0.0
    while t < T:
        truth += 4.0 * dt
        v_meas = 4.0 + sigma_odo * rng.standard_normal()
        x += v_meas * dt; odo += v_meas * dt; P += (sigma_odo * dt) ** 2 + q_pos
        spoof = max(0.0, ramp * (t - 30.0))                       # spoofing starts at t = 30 s
        z = truth + spoof + sigma_gnss * rng.standard_normal()
        hist_z.append(z); hist_o.append(odo)
        S = P + sigma_gnss ** 2
        accept = (z - x) ** 2 / S < 6.63                            # 1-D chi-square 99% gate
        if cross_check and detected_at is None and len(hist_z) > 60 and t > 35:
            n = 10
            dz = np.mean(hist_z[-n:]) - np.mean(hist_z[-60:-60 + n])
            dx = np.mean(hist_o[-n:]) - np.mean(hist_o[-60:-60 + n])
            if abs(dz - dx) > 3.0: detected_at = t
        if accept and detected_at is None:
            K = P / S; x += K * (z - x); P *= (1 - K)
        t += dt
    return x - truth, detected_at

for ramp in (5.0, 0.3):
    e_off, _ = run(ramp, False); e_on, t_det = run(ramp, True)
    print(f"ramp {ramp} m/s: error without cross-check {e_off:6.1f} m; with it {e_on:6.1f} m, detected at {t_det}")
e_fast, _ = run(5.0, False); e_slow, _ = run(0.3, False); e_slow_chk, t = run(0.3, True)
assert abs(e_fast) < 15            # the gate alone rejects a fast ramp
assert abs(e_slow) > 15            # the filter follows a slow ramp: error approaches the spoof offset
assert t is not None and abs(e_slow_chk) < abs(e_slow)

Common engineering mistakes

Failure modes

Debugging approach

1. Replay logs with a synthetic ramp added to the GNSS channel and measure detection delay and false-alarm rate.
2. Plot innovation (y) and NIS over time: a persistent small positive trend is the signature of a slow ramp.
3. Check C/N0 and automatic-gain-control indicators from the receiver for jamming evidence.
4. Verify the estimator excludes GNSS completely (not just down-weights it) after the trust flag drops.

Practical exercises

1. Estimate the detection delay for a 0.5 m/s ramp with a 4 s window and a 3 m threshold.
2. Add a gate on the receiver-reported velocity (Doppler) and see whether it helps against position ramps.
3. Extend the example to two dimensions with a spoof that also changes direction.
4. Argue what odometry drift rate would make a 3 m threshold unusable.

Interview questions

Write an answer in your own words, then reveal the model answer. Nothing is sent anywhere.

References and further reading

Primary papers, official documentation and standards. Each claim above that is specific to a tool or version points here.

• $P$. $D$. Groves, Principles of GNSS, Inertial, and Multisensor Integrated Navigation Systems, 2nd ed., Artech House, 2013 (integrity monitoring).
• M. L. Psiaki, T. E. Humphreys, “GNSS spoofing and detection”, Proceedings of the IEEE, 2016
• PX4: EKF2 GNSS checks and fusion parameters

What’s next