A real/fast-time simulator for impact assessment of spoofing & jamming attacks on GNSS receivers

TL;DR

The paper tackles the challenge of assessing GNSS vulnerabilities to jamming and spoofing in aviation by introducing a GNSS Threat Simulator (GTS) that injects threat-induced deviations into GNSS measurements for both real-time and fast-time testbeds. It decomposes the GTS into RFI threats and Cyber threats modules and implements them in MATLAB/Simulink, interfacing with a tightly coupled GNSS/IMU/ADS fusion unit (HNU) whose outputs feed a flight data recorder. Key contributions include explicit jamming and spoofing models—$G_{ ext{RFI}}^{(i)}(f) = \frac{1-\beta}{1+\text{INR}_{\text{c}}(f)+\text{INR}_{\text{p}}(f,\beta)+\text{SPNR}_i(f)}$ and pseudorange drift formulations involving $\rho_{i,r}(t)$, $\tau_{i,r}^{(s)}$, $\Delta t^{(i,r)}_{s}$, and $\delta t_{s,\text{pred}}$—and validates them through fast-time simulations, real-time HIL tests, and in-flight demonstrations. The results demonstrate effective threat reproduction and integration with GNSS navigation, enabling evaluation of intrusion detection and mitigation strategies with practical aviation impact. Future work aims to enhance spoofing realism with smart control laws and to extend modeling to lower-layer physical aspects for jamming and spoofing.

Abstract

In aviation, the impact of threats is becoming increasingly significant, particularly for global navigation satellite system (GNSS). Two relevant GNSS threats are represented by jamming and spoofing. In order to evaluate the technological solutions to counter GNSS attacks, such attacks should be assessed by means of a proper GNSS threat simulator. This work shows the implementation and the testing results of a GNSS security impact simulator which injects the desired threat scenarios as a deviations on the GNSS actual measurements. The proposed simulator can be integrated in both real- and fast-time simulation environments. The provided results confirm the effectiveness of the simulator, and include in-flight demonstrations by means of a flight experimental vehicle.

Figures (6)

• Figure 1: RFI/Cyber Threat effects on PRN#19.
• Figure 2: Spoofing-signal delay and pseudorange-drifts of PRN#20.
• Figure 3: In-flight test architecture.
• Figure 4: Input and spoofed pseudoranges in real-time simulation.
• Figure 5: Pseudorange drift in real-time simulation.