GPS Spoofing-Resilient Filtering Using Self-Contained Sensors and Chimera Signal Enhancement

2.1 Extended Kalman Filter

Our state estimation framework builds off of the classical EKF, which we outline in this section. Consider the following discrete, nonlinear state transition and measurement model:

1

2

where x_k denotes the state at index k, u_k denotes the system input, if any, affecting the state transition, z_k denotes the received measurement, f_k and h_k denote the nonlinear state transition and measurement models, and w_k and r_k denote the process noise and measurement noise terms. The process noise and measurement noise terms are frequently modeled as zero-mean white Gaussian noise vectors, where and .

Given a sequence of past received measurements {z₁,…, z_k}, an EKF maintains an estimate of the current state x_k, represented as , and a corresponding covariance by recursively performing a predict step and an update step. In the predict step, the EKF propagates the previous state estimate and covariance forward by using the state transition model:

3

4

where is the Jacobian for the state transition model. Upon receiving a measurement z_k, the EKF then updates the state estimate and covariance through the following update step:

5

6

7

8

9

where is the Jacobian for the measurement model, γ_k is the innovation, and S_k represents the corresponding covariance of the innovation. The innovation term represents the additional information provided by the received measurement z_k, which is unmodeled by the expected measurement as determined from the measurement model and predicted state, i.e., .

2.2 M-Estimation

We additionally use M-estimation-based cost functions to strategically weigh the impact of the GPS measurements in the resilient filter state estimate. In this section, we provide an overview of M-estimation, which generalizes maximum likelihood estimation to be robust to outliers or extreme measurements. In particular, consider the following stochastic observation model:

10

where g represents a nonlinear function of the design variable β and e is the stochastic noise impacting our observations y. When each element of the residual error vector e_i is a zero-mean, Gaussian random variable, i.e., , and the residuals are independent and identically distributed, then the problem of estimating β is often formulated as follows:

11

where we observe the sum of squared residuals as the cost function to minimize and β^LS is referred to as the nonlinear least-squares solution. One drawback of using the cost function in Equation (11) is that the resulting state estimate β^LS is sensitive to outliers or extreme observations in y. Thus, in the 1960s, Huber introduced the first notion of an M-estimator to reduce the influence of outliers in regression (Huber, 1964), which minimizes the sum of a more general function Ω of the residuals:

12

where Ω is chosen as a symmetric, positive definite function with a unique minimum at 0 and is chosen to increase less rapidly than the the least-squares cost function to provide greater robustness to measurement outliers.

M-estimators are often characterized in terms of their score function or influence function, which is the derivative of the cost function with respect to the residual, defined as . From the influence function, the M-estimator-based regression problem can be written as a weighted least-squares function, where the weight function is defined as . In this work, we examine three types of M-estimators, the Huber (Huber, 1964), Tukey (Tukey, 1962), and Hampel (Hampel, 1974) M-estimators, with respective weight functions:

13

14

15

The above M-estimator weight functions are correspondingly plotted in Figure 1 in comparison to the traditional least-squares function. The weight function thresholds τ_a, τ_b, and τ_c in Equations (13)–(15) are also denoted in Figure 1 and are used to determine the assigned reduced weight of the received measurement residual for robust estimation.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 1

M-estimator weight functions for the Huber (Huber, 1964), Tukey (Tukey, 1962), and Hampel (Hampel, 1974) M-estimators, defined in Equations (13), (14), and (15), respectively The weight functions are piecewise functions in terms of the denoted thresholds of measurement residuals. In comparison to least-squares functions, the M-estimators downweigh larger residuals to ensure greater robustness to measurement outliers.

3.1 Trusted Measurement Update Using Self-Contained Sensor Measurements

For any available self-contained sensor measurements , we leverage the fact that these sensors are inherently trustworthy and perform the traditional EKF update as discussed in Section 2.1. Thus, we correspondingly perform the trusted measurement update using the expressions in Equations (5)–(9) with respect to the set of self-contained measurements and obtain an updated state estimate and covariance, which we denote as .

3.2 M-Estimation-Based GPS Measurement Update

After the trusted measurement update, if any GPS measurements are available, we perform a modified EKF update step on the intermediate state estimate and covariance . In particular, we first evaluate the GPS measurement innovation and innovation covariance as in Equations (5)–(6), but using only the GPS measurements and evaluating the expected measurement with respect to the intermediate state estimate and covariance obtained after the trusted measurement update:

16

17

where , and represent the nonlinear measurement model, linearized model with respect to , and measurement covariance for the received GPS measurement vector, respectively. The resilient filter maintains a fixed window of the GPS measurement innovations and covariances as in Equations (16)–(17) from the past N time steps. Similar to prior works (Khanafseh et al., 2014; Tanil et al., 2017), we evaluate a test statistic of the sum of normalized, squared innovations over the window:

18

When the received GPS measurements are authentic and follow the nominal distribution with zero-mean Gaussian noise, as modeled in Equation (2), the test statistic q_k follows a central chi-squared distribution with n^q := (Nn^gps) degrees of freedom, where n^gps represents the number of received GPS measurements. We assume that the spoofer is self-consistent, in order to overcome detection through the use of receiver autonomous integrity monitoring (RAIM), and thereby modifies all GPS measurements in a self-consistent manner to induce the false navigation solution (Psiaki & Humphreys, 2016a). In this respect, we develop a single weighting factor at each time step in order to deweigh the influence of all GPS measurements, if determined to be inconsistent with the self-contained sensor measurements. Thus, from the test statistic q_k, we evaluate the scalar weighting factor for time step k as follows:

19

Here, w represents a generalization of the M-estimator weight function and outputs a value between 0 and 1, where a smaller value indicates less weight on the received GPS measurements. Indeed, when evaluating the weight function w in Equation (19), we extend the M-estimator weight functions in Section 2.2 from operating on absolute residuals, which nominally follow a standard normal distribution, to norms of multi-variate standard normal distributions. Note that the square root of the test statistic represents the norm of a multi-variate standard normal distribution, because q_k is a sum of squared, normalized Gaussian innovation vectors under nominal conditions, as shown in Equation (18). As a concrete example, we correspondingly extend the Huber M-estimator weight function as follows:

20

where we use a modified threshold based on the degrees of freedom of the multi-variate residual. Indeed, notice that, when the number of degrees of freedom n^q is 1 for the test statistic q_k, the generalized weight function in Equation (20) reduces to the classical definition of the Huber M-estimator weight function in Equation (13). Additionally note that the threshold values for the weight function, based on the norm of the residual vector, can be represented as a confidence level. In particular, we choose the generalized weight ^function threshold τ′ to represent the α quantile, such that we have the following:

21

22

where represents the probability and F(·; n^q) represents the cumulative distribution function (CDF) of the chi-squared distribution with n^q degrees of freedom. Then, we can choose the corresponding threshold value as follows:

23

where F⁻¹(·; n^q) represents the inverse CDF for the chi-squared distribution with n^q degrees of freedom. We perform analogous extensions to the Tukey and Hampel M-estimator weight functions to evaluate the corresponding weighting factor in Equation (19).

With the weighting factor d_k from Equation (19), we inflate the GPS measurement covariance used in the EKF update step, thereby reducing the reliance on GPS measurements during state estimation when the weighting factor becomes smaller and closer to zero. In particular, we modify the EKF update expressions (Equations (6)–(9)) as follows:

24

25

26

27

Note that d_k is a scalar weight between 0 and 1. If d_k is too close to 0 in value, Equation (25) may become challenging to compute in practice, because of numerical overflows that arise when the inflated covariance is evaluated. Thus, in practice, we only perform the update in Equations (24)–(27) for sufficiently large d_k.

The filter also leverages the periodic Chimera authentication, when available, to increase trust in the received GPS signal. In particular, if the received authentication is successful, the filter chooses d_k = 1 for the first N_chim GPS measurements, given the recently confirmed authenticity of the received signal, where N_chim is chosen to correspond to a short duration, e.g., ~ 1 s.

3.3 Extending the Spoofing-Resilient Filter Framework to Address GPS Multipath Scenarios

In this work, we focus on developing a spoofing-resilient filtering strategy for the case in which the received authentic GPS measurements are nominal, without degradation from multipath errors. To extend this framework to address multipath-affected GPS measurements, one could leverage the fact that an adept spoofer would spoof all GPS signals in a self-consistent manner, whereas individual multipath errors would lead to inconsistent bias errors in the received GPS measurements. Thus, to address multipath errors, this framework could be extended to include an initial multipath mitigation step, in which one verifies whether the received GPS measurements are self-consistent before performing the spoofing-resilient measurement update. Such an extension of the current framework is left as future work, but for the initial multipath mitigation step, one could utilize prior works on the detection and exclusion of erroneous GPS measurements (Groves, 2013) as well as multipath bias estimation and correction methods (Cheng et al., 2016; Lesouple et al., 2018).

4.1 State Overview

The state vector consists of the vehicle’s two-dimensional position (p^x, p^y), heading θ, heading rate , linear velocity v, linear acceleration a, IMU gyroscope and accelerometer biases (b^g, b^a), and receiver clock bias and drift states (b^clk, ḃ^clk). The vehicle’s position, heading, and heading rate are in the local navigation frame of reference, whereas the linear velocity and acceleration are in the body frame, pointing towards the direction of vehicle motion.

4.2 State Propagation Model

At time index k, we propagate the vehicle position and heading via a Dubins car model (Thrun et al., 2005):

28

and we propagate the linear velocity using the linear acceleration, v_k+1 = v_k + δt^imu a_k. The IMU bias states are modeled as follows:

29

Here, the IMU bias process noise , where Q^{b, imu} is a block diagonal matrix with gyroscope and accelerometer terms, Q^{b, imu} = diag(Q^{b, gyro}, Q^{b, acc}), which we model using bias instability and correlation time parameters from IMU Allan deviation plots, as discussed in Section 4.4. The receiver clock states are modeled through a random walk process:

30

where . Q^{b, clk} is modeled using the h₀ and h₋₂ power spectral density (PSD) coefficients, which are derived from Allan deviations and converted to units of m and m/s, respectively, based on the speed of light c (Morton et al., 2021):

31

4.3 Measurement Model

IMU measurements from the gyroscope and accelerometer are modeled as biased with Gaussian noise with respect to the corresponding true heading rate and linear acceleration as follows:

32

33

where and , with Section 4.4 providing more details on modeling R^gyro and R^acc. Wheel encoder measurements of the linear velocity are modeled with additive Gaussian noise , given by the following:

34

For each satellite i, the GPS pseudorange and pseudorange rate measurements are modeled as follows:

35

36

where is the receiver position in the NED frame, pⁱ is the satellite position in the NED frame, and are additive, white Gaussian noise terms, ṗ_k and denote the receiver and satellite velocities in the NED frame, and ||·|| denotes the l₂ norm in Equation (36).

4.4 IMU Noise Covariance Modeling

We model the gyroscope and accelerometer process and measurement noises using the bias instability and random walk parameters, as described by Farrell et al. (2020) and summarized in this section. The process noise covariance is modeled via the bias instability parameter B^imu and correlation time T^b, obtained from the IMU Allan deviation plot or datasheet. T^b is reported in seconds, and B^imu is reported in m/s² for accelerometers and °/s for gyroscopes. The bias instability parameter is converted to the bias instability PSD , which is then converted to the process noise covariance for the IMU bias terms:

37

The measurement noise covariance is modeled via the velocity random walk parameters N^imu, obtained from the IMU Allan deviation plot or datasheet. N^imu is reported in m/s^1.5 for accelerometers and °/s^0.5 for gyroscopes. From the velocity and angular randomwalk terms, we obtain the randomwalk PSD , which is then converted to the IMU measurement covariance:

38

5.1 Experimental Setup

We validate our proposed Chimera spoofing-resilient filter in a simulated test environment for the ground vehicle model outlined in Section 4, under various simulated GPS spoofing attack scenarios. We assume that the user has access to the 3-min Chimera slow authentication channel, and we simulate the scenario for two Chimera epochs, i.e., for 6 min in total. The simulated spoofing attack begins 60 s into the second Chimera epoch, i.e., 4 min after the simulation starts.

We assume that the spoofer has perfect knowledge of the vehicle state and gradually ramps the linear acceleration error in the true heading direction of the ground vehicle. We consider five different ramping rates between 10⁻⁴ m/s³ and 10⁻² m/s³ and cap the linear acceleration error at a maximum of 0.1 m/s². We consider two separate vehicle trajectories, which are depicted in Figure 2, along with various spoofing ramp rates. Both trajectories are simulated using a Dubins car model (Thrun et al., 2005) with Gaussian noise of covariance Q^p = 10⁻⁴ m² added to the vehicle position states (p^x, p^y).

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 2

Two simulated scenarios of ground vehicle trajectories with different degrees of spoofing attacks (a) Trajectory A (b) Trajectory B

We examine the performance of our Chimera spoofing-resilient filter for different degrees of spoofing attacks. In each case, the error in the GPS measurements is gradually ramped to reflect a corresponding linear acceleration error in the true heading direction of the Dubins car model. The corresponding false trajectories induced by the simulated GPS spoofing attacks are indicated by the red curves, for three of the five tested spoofing attack levels. We assume that the spoofer has perfect knowledge of the vehicle state.

Additionally, we simulate IMU measurements at 100 Hz, wheel encoder measurements at 10 Hz, and GPS pseudorange and pseudorange rate measurements at 10 Hz. We consider two grades of IMUs: a tactical-grade IMU and a micro-electromechanical system (MEMS) IMU (Groves, 2013, Chapter 4). The noise parameters from Section 4.4 for both IMU grades are specified in Table 1.

For the wheel encoder, measurement noise is modeled as R^whl = 0.005 m²/s². For the GPS measurements, we simulate satellite positions and velocities using an ephemeris file from June 13, 2022 at 01:50am coordinated universal time. We that assume our trajectories begin at the Durand building on the Stanford campus, using an elevation mask of 5°. We set the GPS pseudorange and pseudorange rate measurement covariances to be 36 m² and 1 m²/s², respectively. For the receiver clock covariance in Equation (31), we set the PSD coefficients as h₀ = 2.0 × 10⁻¹⁹ and h₂ = 2.0 × 10⁻²⁰ (Curran et al., 2012).

Given the above covariance values, we consider an inflated process noise covariance for our spoofing-resilient filter as Q = 3 · diag[Q^p, Q^p, 0, 10⁻⁴ rad²/s², 0, 10⁻⁴ m²/s⁴, Q^{b, gyro}, Q^{b, acc}, Q^{b, clk}]. We compare the performance of our filter against other baseline filters, as detailed in Section 5.2. To determine the initial covariance matrix for the tested filters, we ran a conventional EKF with an inflated initial state error for 60 s prior to the start of the trajectory, allowing it to reach a steady-state covariance. We then used this steady-state covariance matrix for initialization of each tested filter.

In total, we have 20 test scenarios, one for each IMU grade, vehicle trajectory, and degree of spoofing attack. For each test scenario, we perform 10 Monte Carlo runs and examine the mean position errors during both authentic GPS conditions and during the spoofing attack. These results are discussed in Section 5.3 and Section 5.4.

5.2 Tested and Baseline Filters

For each test scenario, we examine the performance of our proposed Chimera spoofing-resilient filter for three different M-estimator weight functions (Huber, Tukey, and Hampel), with thresholds derived from chi-squared confidence levels, as given in Equation (23). For the Huber weight function, we chose a confidence level of 0.1 to obtain τ_a; for the Tukey weight function, we chose a confidence level of 0.997 to obtain τ_c. For the Hampel weight function, we chose confidence levels of 0.3, 0.6, and 0.9 to obtain τ_a, τ_b, and τ_c, respectively. We use window sizes N_chim and N of 15 GPS measurements, corresponding to 1.5 s for a rate of 10 Hz.

Additionally, we compare the performance of our proposed filter with a series of baseline filters:

• Naive Filter: This filter executes the classic EKF prediction and update expressions, as described in Section 2.1. In particular, this filter directly incorporates GPS measurements without performing any consistency-checking.

• Odometry-Only Filter: This filter only relies on the self-contained sensor measurements, i.e., the IMU and wheel encoder measurements, during the Chimera epoch. At the same time, this filter runs a naive filter in parallel. Upon receiving a successful Chimera authentication, the filter updates its state estimate and covariance to that of the naive filter, before continuing state estimation with odometry-only sensor measurements for the next Chimera epoch.

• Authentic-GPS-Only Filter: This filter directly uses GPS measurements only when they are authentic and immediately stops using these measurements at the start of the spoofing attack, after which it relies only on the self-contained sensors for the remaining duration of the attack. While this filter is likely not realizable, because of the zero-delay response to induced attack errors, it provides an interesting baseline filter for comparison against our framework.

• Chi-Squared Detector Switching (CSDS) Filter: This filter relies on GPS measurements until it detects spoofing, using a chi-squared test statistic for the GPS measurements, similar to prior IMU-based innovation monitors (Khanafseh et al., 2014; Tanil et al., 2016). We initiate the cumulative, chi-squared test statistic at the beginning of each Chimera epoch. Then, after the statistic accumulates at least N_chim GPS measurements, at each time step, we compare the test statistic to a threshold determined from the inverse CDF and a user-defined FAR for the confidence level, via the conversion in Equation (23). We test this detector for two FARs: 3 · 10⁻³ and 10⁻⁶. If the chi-squared-based detector declares an attack, the filter stops using GPS measurements and only relies on self-contained sensor measurements until the next Chimera authentication time.

• Kalman Gain Scaling (KGS) Filter: Extending the CSDS filter, after the first N_chim time steps, this heuristic filter uses the chi-squared statistic to weight the Kalman gain matrix in the GPS measurement update step. In particular, the confidence level associated with the chi-squared test statistic is obtained via the expression in Equation (22) as , where n^{q, csd} represents the number of degrees of freedom of the statistic. This confidence level is used to weight the Kalman gain matrix before the measurement update step is performed with the GPS measurements as .

• Adaptive Measurement Covariance Estimation (AMCE) Filter: This filter adaptively estimates the diagonal GPS measurement covariance matrix, based on the innovation for the GPS measurement update. At the start of each Chimera epoch, the filter initializes the diagonal GPS measurement covariance as the nominal covariance outlined in Section 5.1. Then, after N_chim time steps, the filter updates this estimate at each subsequent time step as follows:

  39

  40

  41

  where the (i, i) subscript represents the i-th diagonal element of the covariance matrix, λ = 0.95, and ϵ⁺ = 10⁻⁶. The maximum operation in Equation (39) ensures that the measurement covariance remains positive definite at all time steps.

5.3 Monte Carlo Results: Mean Position Estimation Errors Over Time

In Figures 3 and 4, we plot the mean position errors over 10 simulated rollouts for several levels of GPS spoofing attacks with the tactical-grade and MEMS IMU, respectively. In Figure 3, we observe that the odometry-only filter accumulates an average error of 10–30 m during the Chimera epoch when relying on the tactical-grade IMU, wheel encoder, and vehicle dynamics model. In contrast, as shown in Figure 4, the errors accumulate to 50–200 m for the MEMS IMU. For the naive filter, depending on the level of spoofing attack, we observe that the average errors accumulate to just above 15 m for the smallest attack magnitude with a ramp rate of 10⁻⁴ m/s³ to over 400 m for the largest attack magnitude with a ramp rate of 10⁻² m/s³.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 3

Mean position estimation errors over time across 10 Monte Carlo runs, for various spoofing attack levels with the tactical-grade IMU and wheel encoder as self-contained sensors (a) Larger spoofing attack (10⁻³ m/s³ ramp rate) with Trajectory A (b) Larger spoofing attack (5 · 10⁻³ m/s³ ramp rate) with Trajectory B (c) Smaller spoofing attack (10⁻⁴ m/s³ ramp rate) with Trajectory A (d) Smaller spoofing attack (5 · 10⁻⁴ m/s³ ramp rate) with Trajectory B

The odometry-only filter (periwinkle) accumulates 10–30 m of error during the Chimera epoch, whereas the naive filter (green) accumulates over 400 m of error for the largest attack. The Huber spoofing-resilient filter (purple) and ACME filter (pink) only show marginally better spoofing mitigation than the naive filter in all scenarios, except for the largest attack magnitude, as shown in Figure 3(b). The CSDS filters (orange and lime green) both demonstrate an ability to mitigate the spoofing attack with a significantly lower accumulated error than the naive filter during spoofing, for all but the smallest attack magnitude, as shown in Figure 3(c). The KGS filter (olive) shows improved spoofing mitigation over the CSDS filters; however, the best spoofing mitigation performance is observed for the proposed spoofing-resilient filters with the Tukey and Hampel weight functions (brown and sky blue), with the lowest accumulated average error in each scenario.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 4

Mean position estimation errors over time across 10 Monte Carlo runs, for various spoofing attack levels with the MEMS IMU and wheel encoder as self-contained sensors (a) Larger spoofing attack (10⁻³ m/s³ ramp rate) with Trajectory A (b) Larger spoofing attack (10⁻² m/s³ ramp rate) with Trajectory B (c) Smaller spoofing attack (10⁻⁴ m/s³ ramp rate) with Trajectory A (d) Smaller spoofing attack (5 · 10⁻⁴ m/s³ ramp rate) with Trajectory B

The odometry-only filter (periwinkle) accumulates 50–200 m of error during the Chimera epoch, whereas the naive filter (green) accumulates over 400 m of error for the largest attack. Similar to Figure 3, the Huber spoofing-resilient filter (purple) and ACME filter (pink) only exhibit marginally better spoofing mitigation than the naive filter in all scenarios except for the largest attack magnitude, as shown in Figure 4(b). The CSDS filters (orange and lime green) both demonstrate a significantly lower accumulated error than the naive filter for all but the smallest spoofing attack, as shown in Figure 4(c). The KGS filter (olive) shows improved spoofing mitigation over the CSDS filters; however, the best spoofing mitigation performance is observed for the proposed spoofing-resilient filters using the Tukey and Hampel M-estimator weight functions (brown and sky blue), with the lowest accumulated average error in each spoofing scenario.

For each case in Figures 3 and 4, we notice that the spoofing-resilient filter with the Huber weight function only performs marginally better than the naive filter, with an accumulated error magnitude comparable to that of the naive filter during the simulated attacks. Thus, on average, the Huber spoofing-resilient filter accumulates larger errors than the odometry-only filter for nearly all spoofing attacks in Figures 3 and 4, except for the smallest magnitude size with a ramp rate 10⁻⁴ m/s³. We observed similar performance results when utilizing different thresholds for the Huber weight function. Indeed, because of the shape of the Huber weight function, moderate measurement outliers are treated the same as very large outliers, thereby making this filter less resilient to spoofing attacks as compared with the re-descending Tukey and Hampel spoofing-resilient filters. The AMCE filter also accumulates a significant amount of position error during the simulated attacks, exceeding the accumulated error of the odometry-only filter in all cases with the tactical-grade IMU, as shown in Figure 3, and in the larger attack with the MEMS IMU, as shown in Figure 4(a).

The CSDS filters both show an ability to mitigate the spoofing attack, with a significantly lower accumulated error on average than the naive filter for nearly all cases in Figures 3 and 4. We can particularly observe this in the examples in Figures 3(b) and 4(d), when both CSDS filters distinctly stop following the same error growth rate as the naive filter and begin accumulating additional error at slower drift rates, comparable to the rate of error growth observed for the odometry-only filter at the start of the Chimera epoch. Indeed, at this time point, the CSDS filters switch to using only the self-contained sensors and correspondingly reject the spoofed GPS measurements. However, because the CSDS filters rely completely on GPS until the test statistic falls below the FAR threshold, these filters tend to more readily incorporate errors induced by the spoofer at the onset of the attack, leading to a larger overall accumulation of position errors on average than the Tukey and Hampel spoofing-resilient filters as well as the heuristic KGS filter in each case. Indeed, because the KGS filter begins to partially deweight inconsistent GPS measurements earlier than the CSDS filters, we observe better error mitigation with this filter as compared with the switching filters, with smaller average accumulated errors for all cases in Figures 3 and 4. In Figure 3(c), we further notice that the mean position estimation error grows slightly during the first Chimera epoch for the CSDS filter with a FAR of 3 · 10⁻³. This result arises from the fact that 1 of the 10 Monte Carlo simulation runs had a false alarm event and switched to using only the self-contained sensors until the start of the next Chimera epoch, when it began re-accepting GPS measurements because of the successful Chimera authentication.

Interestingly, for the smaller spoofing attack magnitude cases with the MEMS IMU, as shown in Figures 4(c) and 4(d), we observe that the CSDS filters and KGS filter consistently outperform the authentic-GPS-only filter, maintaining similar or smaller average position errors. In this case, the authentic-GPS-only filter immediately stops using the GPS measurements once spoofing starts, and the MEMS IMU and wheel encoder sensors together still lead to a greater position error drift rate as compared with the error growth initially induced by the spoofing attacks. Thus, we observe that these filters acquire an advantage by following the smaller-magnitude spoofing attack for a longer time duration. In particular, for the smallest-magnitude attack, as shown in Figure 4(c), the growth of the spoofing-induced errors is less than the error growth incurred by using only the self-contained sensors accumulated from the start of the attack. Consequently, the CSDS and KGS filters largely utilize the spoofed GPS measurements and accumulate less error than the authentic-GPS-only filter in this case. Similarly, as shown in Figure 4(d), we observe that by tracking the spoofed GPS measurements a bit longer (while the errors are relatively small) before rejecting GPS measurements, the CSDS and KGS filters accumulate less error than the authentic-GPS-only filter for this milder attack scenario.

For each scenario in Figures 3 and 4, we observe the best spoofing mitigation performance for the spoofing-resilient filters with the Tukey and Hampel M-estimator weight functions, with the lowest accumulated position errors during the attack. In fact, both spoofing-resilient filters have comparable or even lower accumulated position errors than the authentic-GPS-only filter in each scenario. For each case, we observe that these spoofing-resilient filters utilize the GPS signal while the spoofing-induced errors are small, but still switch away from using the spoofed GPS measurements once the errors grow, even before the CSDS and KGS filters, which follow the error growth trajectory of the naive filter for a longer duration. This effect is particularly noticeable in Figures 3(b) and 4(d). Although the Tukey spoofing-resilient filter consistently outperforms the Hampel spoofing-resilient filter during the spoofing attacks, its conservative use of GPS measurements also results in slightly worse performance (larger mean position errors) than the Hampel spoofing-resilient filter when the GPS signal is authentic, as discussed in more depth in Section 5.4.

5.4 Monte Carlo Results: Mean Position Errors During Authentic and Spoofed Conditions

We next examine the overall mean position errors for each scenario (IMU type, spoofing attack level, and trajectory) and for each filter type. The mean position errors are computed across the 10 Monte Carlo simulations and across time, for both the duration when the GPS signal is authentic as well as the duration of the simulated attack. In Figure 5, we plot the mean position error during authentic conditions on the x-axis and the mean error during the spoofing attack on the y-axis. Figures 5(a) and 5(b) show the Monte Carlo results obtained with the tactical-grade IMU for Trajectories A and B, respectively, whereas Figures 5(c) and 5(d) show results obtained with the MEMS IMU for the two trajectories. At the top of the figure, we include a legend that denotes the results from each filter type with a different color and those for each level of spoofing attack with a different type of plotting marker. The results plotted in Figure 5 are also numerically presented in Table 2.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 5

Mean position estimation errors over 10 Monte Carlo runs during authentic-GPS and spoofing conditions (a) Trajectory A, tactical-grade IMU (b) Trajectory B, tactical-grade IMU (c) Trajectory A, MEMS IMU (d) Trajectory B, MEMS IMU

Figures 5(a) and 5(b) show results for the simulated scenarios with the tactical-grade IMU for Trajectories A and B, respectively, and Figures 5(c) and 5(d) show results for the MEMS IMU. The legend at the top denotes the different colors for each tested and baseline filter and the different marker shapes for each level of spoofing attack. We observe that the naive filter (green) performs well when the GPS signal is authentic, but exhibits an average error of over 100 m (across time and Monte Carlo rollouts) during the worst-case spoofing attacks. The odometry-only filter (periwinkle) exhibits increased spoofing resilience, but at the cost of significantly larger average errors when the GPS signal is authentic. The Huber spoofing-resilient filter (purple) and AMCE filter (pink) have only marginally smaller average position errors than the naive filter during spoofing. Both CSDS filters (orange and lime green) show larger errors than the authentic-GPS-only filter (blue) during spoofing when equipped with the tactical-grade IMU, whereas the KGS filter (olive) shows improved spoofing mitigation performance with smaller accumulated errors than the CSDS filters. Our proposed Tukey and Hampel spoofing-resilient filters (brown and sky blue) show the best spoofing mitigation, with a smaller average position error than the other filters during attack conditions. Moreover, the Hampel spoofing-resilient filter maintains position errors comparable to those of the naive and authentic-GPS-only filters during authentic conditions.

In each scenario, we notice that the naive filter performs well during authentic-GPS conditions, providing a sub-meter-level average error when using the on-board IMU, wheel encoder, vehicle dynamics model, and authentic GPS pseudorange and pseudorange rate measurements for state estimation. However, during the simulated spoofing attacks, this filter accumulates a significant amount of position error, with an average error of over 100 m for the worst-case attacks. At the same time, we notice that the odometry-only filter is more resilient than the naive filter during spoofing, exhibiting an average error on the order of 10 m (across time and across rollouts) when equipped with the tactical-grade IMU and less than 100 m for the MEMS IMU. As a result, the odometry-only filter accumulates less average position error than the naive filter during spoofing, except when the degree of the spoofing attack is smaller than the amount of drift from the set of odometry sensors on-board the vehicle, as observed for the two smallest spoofing attacks (5 · 10⁻⁴ m/s³ and 10⁻⁴ m/s³) with the MEMS IMU. However, this increased spoofing resilience of the odometry-only filter occurs at the cost of significantly larger average errors during authentic conditions, because the filter does not utilize the authentic GPS signals to improve its state estimation during the Chimera epoch.

Similar to our observations in Section 5.3, for each scenario in Figure 5, we observe that the Huber spoofing-resilient filter has only marginally smaller average position errors during spoofing as compared with the naive filter. Similarly, we observe that the AMCE filter exhibits significantly larger errors during spoofing, with an error of approximately 20 m or greater for all but the smallest spoofing scenario, while also having larger errors than the naive and authentic-GPS-only filters during authentic conditions.

For the CSDS filter with a FAR of 10⁻⁶, we observe average position errors similar to those of the naive and authentic-GPS-only filters during authentic conditions. However, for the CSDS filter with a FAR of 3 · 10⁻³, we occasionally observe larger average errors under authentic conditions, for instances in which a spoofing attack is falsely declared and the filter switches to using only the self-contained sensors. Indeed, the CSDS filter maintains an updated chi-squared statistic at the GPS measurement rate of 10 Hz and tests for spoofing at the same rate, leading to occasional false alarms during authentic conditions, across Monte Carlo simulations. We observe in Figures 5(c) and 5(d) that, during spoofing, both CSDS filters have average position errors comparable to that of the authentic-GPS-only filter when equipped with the MEMS IMU, with an error of 10–20 m; however, during the attack scenarios in Figures 5(a) and 5(b), we observe that the CSDS filters have 2–3 times larger error than the authentic-GPS-only filter when equipped with the tactical-grade IMU.

Additionally, we observe that our proposed Chimera spoofing-resilient filters with the Tukey and Hampel weight functions maintain a lower average position error during spoofing than the other tested filters for nearly every simulated scenario in Figure 5, including the KGS filter. As also observed in Section 5.3, both of these spoofing-resilient filters perform either comparatively well or better than the authentic-GPS-only filter during spoofing. During authentic conditions, the Tukey resilient filter performs slightly worse than the naive and authentic-GPS-only filters, with the position errors being approximately 1.5 times larger on average. However, the Hampel resilient filter only exhibits slightly larger average position errors than the naive and authentic-GPS-only filters during authentic conditions, with the additional error being consistently less than 0.1 m for each scenario. Thus, our results demonstrate that the Tukey and Hampel spoofing-resilient filters not only strategically leverage the received GPS measurements during authentic conditions to improve state estimation during the Chimera epoch, but also successfully mitigate spoofing-induced errors for different degrees of simulated attacks.