Real-World Jammer and Spoofer Localization Using a Low-Cost Array-Based Software-Defined Radio

Lasse Lehmann; Søren R. Larsen; Benjamin B. Elsholm,; Daniel H. Olesen

doi:10.33012/navi.735

Abstract

Typical single-antenna global navigation satellite system (GNSS) receivers are highly susceptible to interference, especially from jamming and spoofing attacks. The use of an antenna array at the receiver may mitigate the impact of such attacks on GNSS reception and enable attacker localization. We investigate jammer and spoofer localization using the KrakenSDR, a low-cost multi-channel software-defined radio. The performance of the KrakenSDR was characterized for direction-of-arrival estimation and localization against commercial jammers during the open GNSS test campaign “Jammertest 2023” in Andøya, Norway. The tests included simple scenarios in which the jammer was displaced, as well as car-based jamming and spoofing observed in different receiver setups. Direction finding was accurate across tests for an unobstructed line of sight, which was ensured for simpler tests. The multipath environment affected vehicle-based jammer localization but correctly identified the car’s approach and provided consistent velocity estimates. The driving-based spoofing localization estimated the spoofer position close to its true position and also provided position data from GNSS spoofing.

Keywords

1 INTRODUCTION

The use of global navigation satellite system (GNSS) signals is prevalent in, but not limited to, the transportation, financial, and security sectors, ensuring continuous positioning and timing measurements to their users. However, the increasing reliance on GNSSs makes these sectors and their associated services vulnerable to GNSS disruptions, such as jamming or spoofing of the signals (Flytkjær et al., 2023).

Mitigation strategies may include the use of multiple GNSS signals evaluating position, velocity, and time (PVT) over a wider radiofrequency (RF) spectrum, although such strategies may not be possible for consumer-grade GNSS receivers (Larsen et al., 2021). Mitigation may also be performed via sensor fusion, which ensures PVT for deeply or ultra-tightly coupled solutions, even at low signal strength, and can be used to check for spoofing attacks (Olesen et al., 2017; Ruotsalainen et al., 2014). Interference mitigation introduced earlier in the processing chain, i.e., before the correlation stage, may provide greater flexibility and better performance. However, this mitigation is often achieved with specialized software or hardware, which may be prohibitively expensive for large-scale deployment of GNSS receivers.

Directive antennas can be deployed to localize sources of interference. These antennas can be mechanically scanned, as in the work by Chang et al. (2022), or operated from a drone, such as the JAGER demonstrator reported by Perkins et al. (2016). The latter study used a helical antenna mounted on a drone, relying on the motion of the platform to scan for signal sources; this approach was also adopted by Smith et al. (2024). However, developments with antenna arrays are the de facto standard for antenna-based localization, as this approach can ensure phase-coherent rather than amplitude-based measurement comparisons, resulting in more accurate bearing estimations toward interferers. This approach was also later adopted by the JAGER demonstrator (Perkins et al., 2019). Antenna arrays at the GNSS receiver front-end may apply beamforming to filter out the interfering signal, i.e., null steering, thus isolating the signal of interest (Rügamer et al., 2014; Shin et al., 2013). Aside from mitigation, localization and identification of interference sources are desirable for characterizing the interference and potentially stopping the transmission. The use of an antenna array enables spoofing detection based on the detection of multiple pseudorandom noise (PRN) signals sharing the same direction observed relative to the receiver (Psiaki & Humphreys, 2016).

The KrakenSDR is a phase-coherent five-channel software-defined radio (SDR) from KrakenRF, Inc. Its architecture consists of five paired chipsets identical to that of the RTL-SDR, which sees widespread use owing to its low-cost yet relatively high-performance margin. The channels of the KrakenSDR are conditioned by a common clock unit to enable frequency-based synchronization, as well as a noise source to control time synchronization (KrakenRF Inc, 2023b). The KrakenSDR has been considered for use in GNSS applications, where Trapani et al. (2023) first showed angle-based interference localization and Kocher et al. (2024) demonstrated its lane separation for vehicular jamming and accurate direction finding. Radio amateurs and hobbyists have also documented their use of the KrakenSDR for RF localization, among other uses of its antenna array (KrakenRF Inc, 2023a).

This paper is structured as follows: an introduction to the KrakenSDR, its use, and signal processing to obtain angular measurements is provided, followed by descriptions of source localization and spoofing detection. The proceeding section describes the calibration of the KrakenSDR. Results obtained during real-world GNSS jamming and spoofing tests are presented in three parts. The first part covers small-scale jammer displacement and derived triangulation achieved via two separate receivers. The second part presents measurements of a jammer operated from a car, observed from a single static receiver. The third part investigates spoofer localization and position, navigation, and timing (PNT) retrieval using observations from a car-mounted receiver. Finally, conclusions from these studies and plans for future work are presented. The following paper expands on the studies reported in our prior work (Lehmann et al., 2024).

2 SETUP AND METHODOLOGY

2.1 KrakenSDR and Array Configuration

The relevant specifications for the KrakenSDR are provided in Table 1. The tuning range covers the very high-frequency (VHF) band to the L band and can thus be used for all available GNSS signals. However, the low sampling rate of the KrakenSDR is only sufficient to support processing of the Global Positioning System (GPS) L1 coarse acquisition (C/A) signal, which requires a 2.046-MHz bandwidth to resolve the signal’s 1.023-MHz chipping rate. Thus, experiments will conform to this band for current and future studies using the KrakenSDR. The antennas available with the KrakenSDR include telescopic whip antennas, effectively used as quarter-wave antennas, assuming that a suitable ground plane is in place.

View this table:

Table 1 Select KrakenSDR Specifications Reproduced From Crowd Supply (2022)

The use of the KrakenSDR for jammer localization is intended to resolve the bearing of transmission sources in one plane, thus determining the azimuth direction-of-arrival (DOA) angle. To resolve the phase differences across the constituent antennas or channels, the array should ideally be placed with an inter-element spacing close to the Nyquist rate to achieve a refined main lobe response and to avoid grating lobes. The ideal value for uniform inter-element spacing has been given by Van Trees (2002):

$d_{s, N} = \frac{λ}{2}$ 1

where λ is the carrier wavelength of the incoming signal. The uniform circular array (UCA) may achieve this inter-element spacing and unambiguously resolve the source bearing for a complete 360° view. The antenna elements of a UCA are distributed at equally offset radials from the center of the array, as illustrated in Figure 1, along with enumerated ticks for the source azimuth θ. The array’s reference orientation is defined by the placement of Channel 0 (CH0). We will use the term “boresight” as a brief descriptor of said reference orientation.

FIGURE 1

(Left) Illustration of a five-element UCA corresponding to the deployment of a KrakenSDR; (right) three-dimensionally printed array holder scaled to GPS L1. In the left figure, each antenna is denoted according to its channel reference, CH0 to CH4. Enumerated ticks correspond to the bearing angle of sources relative to the array boresight, with the inner marks displaying an azimuth of θ ∈ [–180°, 180°] and the outer marks indicating θ ∈ [0°, 360°].

The radius r of a UCA can be determined from a provided inter-element spacing d_s and the number of antennas N as follows:

$r = \frac{d_{s}}{\sqrt{2 (1 - \cos (\frac{2 π}{N}))}}$ 2

The array dimensions should be scaled according to the GPS L1 carrier frequency of 1575.42 MHz, which suggests that r = 8 cm and d_s = 9.4 cm are suitable candidates. This spacing is close to the Nyquist rate, d_s = 0.988 ‧ d_sN, hence avoiding grating lobes for beamforming.

2.2 Array-Based Signal Processing

Planar symmetric arrays, such as UCAs, enable various kinds of methods for DOA estimation. Practical applications typically favor parametric and non-parametric methods that facilitate rapid computations, with techniques including conventional beamforming, the Capon method (Capon, 1969), and multiple signal classification (MUSIC) (Schmidt, 1986). Conventional or Barlett-based beamforming makes no assumptions and attains an angular resolution proportional to the number of constituent antenna elements. With just five channels available to the KrakenSDR, this approach results in a very coarse angular resolution, with relatively high sidelobes when the KrakenSDR is operated as a UCA. Thus, accurately determining the true source bearing is difficult, especially when the scenario is subject to a multipath environment.

Methods that enable super-resolution, i.e., resolution better than conventional beamforming, have an improved ability to separate closely spaced signal sources. Such methods are data-driven, as more observations improve the derived angular spectra. Methods for achieving super-resolution include the Capon method, also known as the minimum variance distortionless response, and MUSIC. Background on array signal models and DOA estimators has been reported by Stoica et al. (2005), with the array model and DOA estimators used for this paper presented and evaluated in the work by Lehmann (2022). An excerpt therefrom is introduced to provide an overview of array signal processing. The measurement matrix, X, describes the output signal of the array used for DOA estimation, which is provided from the steering matrix A and signal matrix S and subject to system noise governed by the noise matrix N:

$X= \underset{N \times K}{A} ‧ \underset{K \times M}{S} + \underset{N \times M}{N}$ 3

where the underset notations denote matrix dimensions, N indicates the number of antenna elements, k ∈ [1,2,…K] gives the index number of sources, and M indicates the number of observations or snapshots that denote measurements made with all channels. Central to all of the considered methods is their dependence on the sample covariance matrix, $\hat{R}$ , to calculate the beamformer response to a given steering angle:

$\hat{R} = A𝔼 [{SS}^{H}] A * + 𝔼 [{NN}^{H}]$ 4

Assuming that N is governed by system noise and can therefore be modeled as additive white Gaussian noise (AWGN), the noise present will decorrelate with an increasing number of observations. For data-driven methods such as MUSIC and Capon, this may significantly improve the beamforming response for true source bearing. For repeat observations, the rate at which estimates are made, or the burst rate, should be considered to accurately resolve the source bearing.

The processing settings used for DOA estimation are detailed in the following. All scans are performed in the horizontal plane to locate potential signal sources, assuming that only low-elevation signals are encountered. Only one interferer will be present in the scene for all presented simulations and tests. Hence, the evaluation of MUSIC is set to search for only a single signal. An angular search space using 455 angular bins (a 91-fold increase relative to the number of antennas) would be sufficient, resulting in a resolution of 0.79° for the estimates. For modest computational requirements, the use of an observation time of 0.5 ms, or M = 1200 snapshots, with a burst rate of 0.1 s, provided an adequate time resolution to resolve maneuvers captured between the sensor platform and signal source in the data captured with the KrakenSDR. The combined observation time and burst rate only uses 0.5% of the available data for DOA estimation, which may result in a missed detection of pulsed transmission sources. However, this limitation is inconsequential, as GNSS jammers typically operate at 100% duty cycle to achieve complete receiver blanking (Mitch et al., 2011).

The three methods were evaluated for a single signal source at different signal-to-noise ratios (SNRs), as shown in the left panel of Figure 2. Decreasing side-lobe levels are observed for all techniques with increasing SNR, as expected when AGWN is the dominant source of interference. It should be noted that the MUSIC estimator does not retain accurate power levels of signal sources, denoting its beamformer response as a pseudospectrum. However, the MUSIC estimator performs better than the other techniques at providing clearer DOA estimates for the true source location relative to the sidelobe level. Repeated observations performed at intervals enable the direction of the signal source to be tracked over time. A simulated sequence of DOA angles evaluated using the MUSIC algorithm is provided in the right panel of Figure 2. The source response is correctly associated with the true position when subject to an adequate SNR and isolated return. MUSIC will be used for DOA estimation, assuming a single source in view, for the remainder of the presented results.

FIGURE 2

Simulations of DOA estimation using a five-element UCA: (left) DOA methods, Bartlett, Capon, and MUSIC, evaluated for a signal source at a DOA angle of 0° and SNR levels of 20 dB and 0 dB; (right) DOA estimation for a signal source with an SNR of 20 dB, for an angular interval of [–180°, 180°] using MUSIC. The scan index reflects the same interval as the steering angles, providing the maximum response.

2.3 Source Localization

Geolocation, or localization, defines the process of relating a given object to a geographic placement. In the context of RF emitters, the timing, Doppler shift, or differences in power recorded of incident signals at distributed receivers can be compared to determine the emitter’s location (O’Donoughue, 2019). While the KrakenSDR is designed for angle-of-arrival or DOA estimation, other schemes could be considered to aid geolocation. However, the time or time difference of arrival (TDOA) would be subject to the low sampling rate of the RTL-SDR and thus the KrakenSDR would at best enable a range resolution of 117.2 m at the available bandwidth. Furthermore, this approach would require accurate synchronization of multiple distributed KrakenSDRs, which would take place in a GNSS-denied environment during planned experiments. Exploiting measured power differences for localization requires accurate control of power levels in equipment and minimal changes in antenna orientation or displacement, which cannot be ensured in operational settings. Comparing frequency differences using the frequency difference of arrival (FDOA), achieved by exploiting the Doppler shift, requires a high degree of phase stability. Furthermore, the Doppler shift of signals transmitted over a wider bandwidth (spread spectrum) may result in inaccurate FDOA measurements (O’Donoughue, 2019). For these reasons, only DOA estimation will be considered for this study. DOA estimation from a given receiver provides a direction or bearing to the emitter, with such lines of bearing (LOBs) emanating from the receiver’s location, with an arbitrary length. Multiple receivers or observations are needed to form intersections between LOBs and triangulate positions to localize the emitter. Although a minimum of two lines can be used to form an estimate, multiple observations are desirable to further constrain the spread of position estimates, i.e., the uncertainty of the estimates. The three schemes for enabling DOA-based localization considered in this study are based on (A) the use of dual receivers, (B) target constraints, and (C) wardriving, as summarized in Figure 3.

FIGURE 3

Illustration of the three different setups considered for localization: (A) static dual receivers to localize target(s) moving relative to the receivers; (B) a single static receiver localizing moving target(s) via a known path geometry, e.g., a straight road; (C) a single moving receiver to localize static target(s). Points mark the receiver (blue, green) and target (red) locations. LOBs are drawn from the receivers, with shading indicating the uncertainty of the estimated bearings.

The separation between multiple receivers, i.e., their baseline, will impact the positioning accuracy from triangulation. A smaller baseline will result in a better alignment of the involved bearings. In turn, this better alignment will result in a larger area of overlapping uncertainty in the bearing estimate, which is proportional to the position accuracy. Ideally, baselines formed between receivers are perpendicular to the target’s bearing, as triangulation becomes poorer for further off-angle estimates and unresolvable when the target is parallel with the spanned baseline. The fact that measurements are angular also leads to geographical errors that are proportional to the range from which estimates are made. In some cases, assumptions can be made about the target’s location based on a single static receiver. Case B in Figure 3 assumes that the target of interest is constrained to a single path in front of the receiver, such as a road, which can directly relate the estimated bearing to the target’s position along the path. Each intersection of LOBs forms a position estimate, which has a geometric solution found via parameterized systems of equations (O’Donoughue, 2019). In case A, the triangulated position estimates may need to be treated as individual position estimates owing to the emitter’s motion. For case C, the complete set of triangulated positions can be used to infer the most probable emitter location based on multiple observations.

To provide a basis for the presented geolocation results, we introduce terms for the position accuracy, as described below. The estimates’ uncertainty is comparable to the dilution of precision known from the GNSS, with its origins from the Loran-C system (Langley, 1999). Assuming that the system is unbiased and has an angular precision set by ∆θ, we can further gauge the expected geolocation performance, as shown in Figure 4. The different receivers noted can be interpreted as dual receivers operated simultaneously or a set of paired measurements using the same receiver at different times, corresponding to the scenario of wardriving.

FIGURE 4

Evaluation of uncertainty spaces (turquoise polygons) for the dual-receiver scenario. The signal source (red point) is simulated at a radial distance of 50 m from the common reference point (middle of the baseline) at reference angles of θ_ref ∈ [0°, 30°, 60°]. The simulations are performed for a baseline, B = 50 m and ∆θ= 5°, selected for illustrative purposes. The inset on the right depicts the four different sidelengths of the quadrilateral uncertainty space for θ_ref = 30°.

The rectangle spanned from the two receivers is a convex quadrilateral, which will be referred to as the uncertainty space. Although we do not establish an analytical term as a function of baseline, angular precision, or target distance, the expected performance is simulated for scenarios corresponding to the triangulation scenarios described below. For a given simulation, the corners are determined from the set of equations formed by the intersecting lines depicted in Figure 4. Then, the area, which we refer to as the area of uncertainty (AOU), can be calculated as follows (Josefsson, 2013):

$AOU= \frac{1}{2} \sqrt{(a^{2} + c^{2}) (b^{2} + d^{2})}$ 5

where a, b, c, and d are the sidelengths of the uncertainty space. Referring to Figure 4, it can be seen that a symmetric uncertainty space (equal sidelengths mirrored across the longest diagonal) is only observed head-on from the baseline, with the edges becoming increasingly more skewed as the orientation increases. The AOU is minimized when the signal source is equidistant from both receivers, forming a perpendicular angle with the baseline (reference angle, θ_ref = 0°). If θ_ref is decreased relative to the baseline, the AOU will increase accordingly. The AOU will increase immensely for large reference angles and will be unresolvable in the case that the signal source is collinear with the receiver baseline. For simplicity, we assume that the AOU approximates a square area with the sidelength as a proxy of positional accuracy, e.g., if AOU = 100 m², then the target can be confined by a square area with sidelength of 10 m, which we treat as the expected resolution. The expected angular precision of the KrakenSDR deployed as a UCA is close to ∆θ = 0.5°, as presented in Section 3. The AOU is then evaluated for the triangulation scenarios presented later in this paper and is displayed in Figure 5. Comparisons to scenarios will be made in their respective sections, but a few general observations can be made concerning the estimated AOU. Firstly, unsurprisingly, the smallest AOU is estimated at θ_ref = 0°, perpendicular to the spanned baseline, with the area rapidly growing toward orientations collinear with the baseline (θ_ref = ±90°). Secondly, increasing the baseline increases the effective distance at which a given maximum AOU value can be ensured. Finally, the AOU scales with distance for a given baseline; thus, a target is resolved at a coarser resolution when it is further away from the sensors. This trend can be seen in the left-side panel of Figure 5, which compares two target distances for the same baseline.

FIGURE 5

Estimated AOUs of presented scenarios for triangulation: (left) dual-receiver scenario presented in Section 4.2.1, which uses B = 2 m for target distances of 7.5 m and 15 m; (right) wardriving scenario presented in Section 4.4.2, which uses a maximum B ≈ 55 m regardless of target distance. Note that the colorbar limits are set to reflect the realizable positional accuracy of the given scenario.

2.4 PRN-Based DOA Estimation for Spoofing Detection

The use of controlled reception pattern antenna (CRPA) may enable spoofing detection, in the case where the measured DOA does not match the reported position of the satellite(s) in question (van der Merwe et al., 2023). Using antennas for localization, we can identify attempts at spoofing by simply determining whether the DOA estimates isolated for different PRNs all align toward the same transmission source. It is desirable to sample only the response at sparse burst intervals, as described in Section 2.2; however, the post-correlator response must be used to distinguish PRNs. This step is accomplished by using the correlator stage matching the Doppler shift provided by the acquisition stage to sequentially sample the following maximum responses. The responses for each burst are treated as a set of snapshots for DOA estimation, similar to the matched filter (MF) responses extracted for burst-based radar processing described by Lehmann (2022). The acquisition stage used for this study follows the implementation outlined by Borio (2008). Changes in Doppler shift will reduce the MF response with time; yet, the short time scales considered for this study lead to very small changes in Doppler shift, and Doppler tracking is therefore ignored. We refer to this scheme as a GNSS sequential acquisition processor (G-SAP), which is illustrated in Figure 6 and utilized in Section 4.4.3.

FIGURE 6

G-SAP scheme: (left) flowchart of G-SAP implementation; (right) correlator (MF) response consisting of multiple code sequences. The correlator peak from acquisition appears first, and sequential correlator peaks are pooled along with it. These peaks are treated as snapshots for DOA estimation to a single burst.

3 CALIBRATION OF KRAKENSDR

The accuracy of DOA estimation using the KrakenSDR was initially evaluated in an anechoic chamber. This step allowed transmissions comparable to the jamming of GPS L1 and correct array scaling in preparation for open-air tests. The transmitter was based on a HackRF One from Nooelec (see specifications reported by Great Scott Gadgets (2021)), which was set to transmit linear frequency modulation signals. The signal parameters were set to be similar to those of chirp-based commercial-off-the-shelf (COTS) jammers characterized by Mitch et al. (2011), transmitting chirps with a 2-MHz bandwidth and a pulse duration of 100 μ s at 100% duty cycle. Both the receiver and transmitter SDRs were operated using GNU Radio, with the KrakenSDR using the Heimdall library for coherent data acquisition (KrakenRF Inc, 2023b).

The KrakenSDR was configured as a UCA opposite the transmitter in an anechoic chamber, with both radio front-ends utilizing whip antennas. The presented methods for DOA estimation assume that plane waves arrive at the receiver from the signal source of interest. For this scenario to be applicable for real measurements, far-field conditions must apply, which requires, in part, that the separation between the transmitter and receiver exceeds the Fraunhofer distance:

$R_{F D} = \frac{2 D^{2}}{λ}$ 6

where D is the size of the antenna aperture. This requirement is aside from the other requirements of the antenna separation far exceeding the antenna aperture’s size and wavelength (Bansal, 1999). The distance between the transmitter and receiver in this setup is approximately 6.5 m, whereas R_FD = 0.27 m for an approximate antenna aperture equal to the UCA diameter of 0.16 m. Thus, far-field conditions are ensured for all presented measurements.

The KrakenSDR was placed on a styrofoam pedestal fixed to an azimuth positioner with a pointing accuracy of 0.05°. The antenna array was placed as close to the center of rotation as possible while ensuring that the setup on top of the pedestal remained stable. It was necessary to keep the personal computer (PC) used to interface with the KrakenSDR on the same pedestal to avoid any tug on the data cable, which may introduce multipath from close-in reflections. The leading edge of the CH 0 position of the array holder was used to align the boresight of the array with the transmitter using a laser rangefinder. After the system has been powered up and the KrakenSDR has been interfaced with Heimdall, the synchronization of amplitude and phase across all channels is initialized. This initialization may take several seconds before coherent beamforming can be achieved and may also repeat when commands are issued to start new recordings (Taylor et al., 2023; Trapani et al., 2023). The KrakenSDR was initialized in GNU Radio with a live viewer to show UCA-based beamforming for the characterization measurements. Once a coherent source is observable and remains stable for the shown DOA estimation, the recording of I/Q data can commence.

Two tests were performed during the recording, making a discretized and continuous sweep of positioner orientations. The first test captured discrete positions sampled over time to quantify the stability of the DOA estimates. The second test obtained a larger swath of angles as the positioner continuously rotated 360° throughout the test. During data capture, the receiver array was rotated on its axis in 10° increments to cover measurements for 360° orientations for the first test. The rotations were commanded manually. Hence, the time intervals were not synchronized with the data recordings. The second test was commenced immediately afterward, sweeping a complete 360° rotation upon command. The resulting DOA traces for the captured data are shown in Figure 8. The initial 40 s show the response with the array at boresight, followed by 10° increments commanded approximately every 10 s. The effects of multipath are evident for the interval of 180–250 s, showing strong reflections close to 0° when the true heading of CH0 is close to 180°. This scenario occurs when the interface PC is aligned with the path between the transmitter and the antenna array. Ignoring the multipath responses, we extract the azimuth heading to the transmission source for timeframes when the positioner is static. The statistics for the mean residual deviation (bias) and standard deviation (precision) are provided in Figure 9.

FIGURE 7

Test setup: (left) the transmitter operated from a window in an anechoic chamber (the back cover was in place when the transmitter was active); (middle) view from the antenna array (KrakenSDR); (right) antenna array resting atop the powerbank and SDR placed in a cutout in the styrofoam pedestal along with the PC used to interface with the KrakenSDR.

FIGURE 8

DOA traces for data capture in the anechoic chamber: (left) complete DOA trace, including continuous rotation starting at approximately 400 s; (right) zoomed-in plot of a portion consisting of continuous rotation.

FIGURE 9

Residual analysis for discrete estimates: (top) mean residuals; (bottom) standard deviation associated with each step.

The residuals are centered around 0°, showing oscillatory behavior and deviations of up to 10° from the true bearing. Residuals exceeding 10° are to be expected from open-air L1 emitter tests using the KrakenSDR, with the best precision reported at 0.48° and typical values above 1°, as established by the study of Taylor et al. (2023). This finding is supported by the discrete measurement series, where most measurements are made with a precision better than 0.5°. Discrepancies do appear, such as at an azimuth of 20°, where the DOA response around the expected bearing has a linear trend over a time interval when the setup is static, indicating a faulty response on the part of the array. The residuals for the continuously swept orientation are provided in Figure 10. Highly similar residuals are observed for the azimuth across discrete and continuous sweeps, with the same trends and magnitudes.

FIGURE 10

Residual calculated for continuous positioner recording.

However, bearings sometimes deviate by a few degrees upon repeat measurement. These results indicate that DOA estimates using the KrakenSDR are more precise than accurate. Increasing the number of expected sources may allow MUSIC to better resolve potential multipath sources, although this is reserved for future work. It should be noted that aside from potential reflection sources close to the receiver array, calibration to address antenna effects such as mutual coupling has not been utilized. This approach may affect the measured accuracy rather than the precision, which may explain some of the reported limitations. Yet, the measured accuracies and precision are more than adequate to perform geolocation, assuming that a sufficient number of observations and sufficiently long baselines are used (O’Donoughue, 2019). The calibration results indicate an otherwise consistent performance, which bodes well for the planned open-air tests using the KrakenSDR for GPS L1 jamming and spoofing.

4 RESULTS AT JAMMERTEST 2023

Tests were conducted during Jammertest 2023, an annual event for open GNSS experiments, where GNSS receivers are subjected to jamming and spoofing attacks in a controlled environment. The event was held in Andøya, Norway and was organized in cooperation between the Norwegian public roads administration, Norwegian communications authority, Norwegian defense research establishment, Norwegian metrology service, and Norwegian space agency. Jammertest 2023 provided open invitations to industry, authorities, and academia involved with GNSSs (Jammertest, 2024). A selection of portable jammers were used for both small-scale and automotive localization tests using the KrakenSDR.

4.1 Jammers for Tests

The tests utilized portable COTS jammers, rated to transmission powers of 1–100 mW (NKOM, 2023). Transmission schemes included continuous wave, chirp, and PRN-based transmitters, similar to previous GNSS-jammer characterization (Mitch et al., 2011). Because the KrakenSDR has a maximum bandwidth of 2.56 MHz, the experiments were limited to characterizing GPS L1. The relatively low sampling rate of the KrakenSDR is not sufficient for resolving signal transients, i.e., the slope of individual chirps, as jammer signals are typically generated at higher sampling rates. Four different settings available to jammer [A] were tested, namely, continuous wave, chirp, narrowband (NB), and wideband transmissions. Spectra of jammer transmissions characterized by a separate SDR are shown in Figure 11 alongside photos of the jammers. Continuous wave and chirp transmission modes give rise to a distinct tone and set of harmonics that can be resolved. The NB modulation of jammer [A] is PRN-based, whereas those of jammers [B] and [C] are chirp-based, but without resolvable harmonics at the sampling rate being used.

FIGURE 11

(Left) Jammers used for tests: [A] military-grade handheld, [B] handheld, [C] car cigarette lighter type; (right) spectral response of jammer recordings using a HackRF One, where a baseband filter limits the spectral response beyond ±1 MHz.

4.2 Dual-Receiver Tests

Two KrakenSDR units were set up as UCAs, forming a 2-m baseline. Both sets of arrays were configured as described in Section 3. The KrakenSDRs were denoted RX1 and RX2 and placed as depicted in Figure 12.

FIGURE 12

(Left) Recording setup using two KrakenSDRs placed about a center point used to measure out the circular routes for the jammer; (right) view of the antenna array in the holder, with a handheld jammer in the background.

Close-range tests were performed with the handheld jammer [B] active and carried along planned routes by a test participant, moving relative to the recording setup. Dual-receiver tests were performed by moving the jammer along two circular paths spanned from the center point, with a circle radius of r_c = [7.5 m or 15 m], referred to as short- and long-distance tests, respectively. The jammer was moved around the circular path in both clockwise (CW) and counter-CW directions. The results of DOA estimation using RX1 and RX2 for the large circular path are shown in Figure 13.

FIGURE 13

DOA traces recorded for both RX1 and RX2 in either direction for the longdistance test. The top and bottom rows show results for RX1 and RX2, respectively, with the left column showing CW motions and the right column showing counter-CW motions.

In all instances, the direction to the jammer traces out straight lines, as anticipated from the circular travel path. By comparing each receiver, we observe that for the respective directions of travel, CW and counter-CW, the two DOA trace maps appear as mirror images, with similar sidelobe levels along the same portions of the trajectories, indicating consistent performance of the KrakenSDR. Whereas the performance for RX1 seems consistent with the motion of the jammer, the traces of RX2 show a stronger deviation from the expected directions, as also observed for the extracted tracks in Figure 14. See, for example, the DOA estimates around 0–5 s of the CW test, where the jammer is static, but the DOA estimates alternate more than ±10°. Even though the jammer is handheld, these erratic changes would correspond to repeatedly displacing the transmitter by ±2.6 m within the timeframe, which cannot be attributed to the movement of the jammer and is not observed for RX 1. The more noisy estimates are likely due to the different sets of antennas and antenna cables used with RX2, which were not characterized before the experiments were conducted.

FIGURE 14

Extracted DOA traces for the long-distance test: (left) CW motion of the jammer; (right) counter-CW motion of the jammer.

4.2.1 Triangulation for Dual Static Receivers

The SDRs were not synchronized for tests, and even though measurements were initialized within a few seconds, a number of challenges were faced in conducting dual-receiver triangulation based on the recording. Coarse synchronization was achieved by introducing relative lags of measurements that would provide groupings of triangulation estimates closest to the expected circular perimeter of each test. For a burst rate of 0.1 s, lags were found for 0.4-2.0 s. The triangulated positions for both long- and short-distance tests are shown in Figure 15.

FIGURE 15

Triangulated positions for each test, with long-distance tests with r_c = 15 m shown in the left-most plots and short-distance tests with r_c = 7.5 m shown in the right-most plots. The colorbar indicates the relative time index of the individual estimates.

The coarse accuracy is evident across tests, with poor estimates made well outside the expected perimeter and most estimates grouped much closer to the receivers’ placement than the ground truth for tests. The order in which positions are reported is consistent across the tests comparing the grouped points with the relative time scale, with each set of CW and counter-CW measurements showing similar point groupings. Furthermore, the offset estimates are highly similar for both the long- and short-distance tests, indicating that the receivers perform similarly across tests regardless of distance. Indeed, this spread scales with the distance to the target, as expected from the AOU estimates shown in Figure 4. Although simulations would place the expected spread within AOU ≤ 1 m², the reported positions fill the entirety of the circular area. It is clear that the distance is underestimated, as nearly all estimates fall within the circular path marking the true distances to the signal source throughout the tests performed. The reported errors are attributed to bias introduced from differences in the antennas and antenna cables available, particularly for RX2.

4.3 Automotive Jammer Detection

Tests with the jammer inside a moving car were conducted to reflect disturbances experienced by GNSS stations near public roads. These tests are similar to scenarios presented by Bauernfeind and Eissfeller (2014) and Kar et al. (2014), which both relied on single-antenna placements near highly trafficked roads. While the study of Kocher et al. (2024) used a KrakenSDR to locate signals and showed viability for lane separation, the tests used distributed antenna placements encompassing the full zone of the target’s movement, as opposed to our use of a KrakenSDR with collocated antennas. In the current study, the jammers were operated from within a car, driven along a straight road, with turning points separated by at most 1.2 km, as depicted in Figure 16.

FIGURE 16

Overview of the route traveled by the car jammer. A KrakenSDR was placed in front of the road junction, with its array boresight facing the junction.

A single KrakenSDR was placed on a side road perpendicular to the road traveled by the car jammer, approximately 112 m from the road junction. The KrakenSDR was set to face the road junction, recording the jammer as it traveled by car from the starting point to the right of the array; the jammer passed the array, turned around at the end point to the left of the array, and then traveled along the opposite direction to return to the start point. Jammers [A], [B], and [C] were used for independent drive tests, with DOA estimation performed regularly throughout each drive, as shown in Figure 17.

FIGURE 17

DOA traces measured by RX1 for jammers [A], [B], and [C], from left to right, for the car jammer scenario.

Naturally, a stronger signal provides a better basis for beamforming; thus, jammer [A] can be tracked throughout the entirety of the drive, with decreasing fidelity in DOA maps as we compare jammer [A] with [B] and jammer [B] with [C]. Despite the different signal modulations, the direction finding appears similar for all three tests when adequate signal power is received. Using jammer [A] as a reference, a strong and isolated return appears, coinciding with the start and end of the recordings, where the jammer is observed to the right of the road junction. Beyond this interval, the jammer is further away and resolved at a coarser estimate, which includes multiple reflections. The road inlet forms a normal to the straight road traversed by the car, and hence, the distance along the road can be determined from the measured tangent angle and distance between the receiver and the road. The target bearings are extracted as the maximum response in the DOA trace for each time sample, after the largest outliers have been sifted via a 15-sample moving median filter. The estimated target bearings and distance for jammer [A] are provided in Figure 18.

FIGURE 18

(Left) DOA estimates for jammer [A] along with the expected bearing, assuming a mirrored passage and constant velocity in the observed interval; (right) distance derived from DOA estimates and two linear fits for outbound and inbound car passes. The reported distance is aligned with the road, with negative values corresponding to positions to the right of the midpoint and positive values corresponding to the left of the midpoint.

Along with the DOA estimate, the expected bearing is provided, assuming that the car was traveling at a constant velocity, as was planned for the test. The parts of the route to the right side of the road junction match reasonably well with the expected bearings, but the matching deteriorates rapidly for the left side of the road junction. This trend corresponds to the timestamp interval of 30–110 s, where we also observe a larger spread in angular estimates and outliers. We believe that this result should be attributed to a patch of vegetation that partially obscured the line of sight (LOS) between the receiver and car jammer. Such an obscurer may act as a screen and have a non-uniform volume with one or more portions of its volume partially open; the consequent diffraction may result in one apparent direction to the signal source, irrespective of the jammer’s placement behind the obscurer. We note that the car would spend at most 10 s in LOS conditions before reaching the road inlet, which may explain the otherwise good consensus between the estimates and expected bearings observed outside the time interval of 30–110 s.

The derived distance estimates are stable between approximately 100 m to the left and 250 m to the right of the road junction for both car passes. By applying linear fits to these portions of the data, we can derive the target velocity as 40.2 km/h and 43.7 km/h for the initial and final passes, respectively, retrieving a near-constant velocity for the target vehicle as expected. Extending this analysis to the other approaches requires masking of multipath at azimuth bearings that lie outside the interval of [–80°, 100°] to circumvent the presence of noisy estimates. This step is performed before the approaching and receding parts of the respective drives are selected. The ordering from jammer [A] to [C] reflects the relative power and accuracy in the DOA estimates, observed from the jumps in the estimates along the bearing profiles. The derived velocities are presented in Table 2. Aside from a noisy estimate skewing the estimated velocity of jammer [C] during the approach, the estimates all indicate a near-constant velocity of the jammer platform in both directions.

View this table:

Table 2 Estimated Velocities for Car-Based Jamming as the Jammer Approaches and Retreats from the Observer

The DOA estimates may be affected by multipath, thus under-reporting the car’s expected velocity above 50 km/h. Still, the setup enables robust estimates of both the car’s passage and its direction of travel, even at transmission powers as low as 10 dBm (NKOM, 2023). The deployment of the KrakenSDR may prove effective in identifying jammer-carrying vehicles in more densely trafficked highway scenarios. However, a better antenna placement with a clearer LOS would be preferable, especially considering the complex multipath environment with multiple vehicles and guard rails in such a scenario.

4.4 Spoofer Localization (Wardriving)

A wardriving scenario was applied for static spoofing of GPS L1, using a UCA mounted atop a test car to capture measurements throughout travel. The spoofing signal was transmitted from an omnidirectional antenna placed atop a local community house in Bleik. The spoofing signal was transmitted with a transmission power starting from –20 dBm to 25 dBm in steps of 5 dB every 2 min (NKOM, 2023). The observations obtained via the KrakenSDR started around the time spoofing commenced, with combined data capture lasting approximately 7.5 min.

The route driven by the car during the test is shown in Figure 20. The test car started from the parking lot of the community house, driving eastward toward the cemetery, where it turned back at the parking lot before returning toward the community house via the same road. The car then passed the spoofer location, drove to another spot suitable for turning around in the town of Bleik, and then returned to the community house. The road east of the spoofer location is free from any apparent obstructions to the LOS; the western part of the path is near buildings, which obfuscates most of the spoofer observations made during this portion of data capture. Data collection consisted of three separate recordings, changing between recordings at the turning points of the route. The separate captures were performed to minimize the risk of interruptions during data capture. Figure 21 shows the DOA estimation for the entire drive. The turns made by the car and portions of the route in which the car’s bearing coincides with the spoofer location are apparent. Aside from positions close to the spoofer, the DOA estimates tend to closely align with headings of 0° and ±180° when the SDR recedes from and approaches the spoofer, respectively. These large portions of the route will result in near-parallel baselines formed between observations, which will have a limited impact on triangulation. The significant change at approximately 150 s is attributed to resetting of the SDR for a new recording.

FIGURE 19

Receiver and transmitter antennas: (left) UCA antennas mounted atop a car for the wardriving scenario; (right) the antenna mast for spoofing at the community house. A printed spacer was used to align the antennas shown in the left image (reference in the direction of travel).

FIGURE 20

Overview of the route traveled by the car carrying the receiver and points of interest. The three segments associated with each recording are colored blue, green, and red, corresponding to the first, second, and third recordings.

FIGURE 21

DOA trace combined from all recordings captured during the wardrive, with black dashed lines corresponding to times separated by 1 min.

4.4.1 Evaluating LOS Conditions of DOA Estimates

DOA-based localization is not possible when non-LOS (NLOS) conditions apply, and measurements subject to these conditions should be culled from localization altogether. One cannot readily determine whether the receiver has entered NLOS conditions from the DOA estimates alone, because multiple signal sources, e.g., multipath, may occur at a given time, leading to erroneous tracking of a given target. When I/Q data are used, rapid changes in power level may indicate LOS transitions but can also be attributed to a varying range of the target signal. Metrics based on the sample covariance matrix $\hat{R}$ such as the Akaikes information criterion can be used to determine the most probable number of signals in the measurement (Van Trees, 2002). It is possible to determine whether a target is present by performing an eigendecomposition of $\hat{R}$ and comparing the relative strength of the first eigenvalue against the remainder. For a single distinct target, the first component is much stronger than the remaining values, and in the case of no signal, the values will be highly similar, as they will be random. This approach follows the same basis presented for separating the signal and nullspace in the MUSIC algorithm (Schmidt, 1986). We refer to this approach as the eigenvalue criterion (EC) to distinguish between LOS and NLOS conditions in the wardriving scenario. The EC is presented in Figure 22, along with channel amplitudes.

FIGURE 22

Analysis of NLOS conditions in the spoofer wardrive: (top) amplitude for all five channels; (bottom) the evaluated EC, with a window duration of 25 s used for the moving average.

All channels follow similar changes in amplitude associated with the distance between the receiver and signal source. The average CH0 amplitude spikes at approximately 150 s, which is attributed to the reset for the second recording. It is also noted that CH0 consistently initializes at a higher amplitude level, which we attribute to the synchronization process of the KrakenSDR, likely relying on noise injection. From the amplitude alone, it is challenging to isolate regions affected by NLOS at approximately 300–400 s and regions subject to longer range observations at 100-200 s. However, as shown in the EC graphs, a distinct plateau of relative strength close to 65% is observed when the receiver car enters the town of Bleik and NLOS conditions apply. A threshold of EC < 0.7 can be used to infer NLOS conditions for consistently low values (e.g., evaluated from the moving average) in the provided scenario to discard these values from use in localization. However, the scheme may not necessarily generalize to other scenarios without a further evaluation of the EC for partial concealment or multiple signal sources, both those that are valid and those caused by multipath.

4.4.2 Triangulation for Wardriving

Triangulation of the completed drive required an established ground truth of the car’s position during recording. Because of the active spoofing in GPS bands and risks to other constellations, the positions were referenced based on video footage captured during the drive, with timestamps noted as recognizable features in the surroundings were passed. From these data, interconnected lines for the path could be drawn, with georeferenced coordinates extracted using QGIS and interpolated to match the time reference of the DOA estimates. The expected ground truth is compared to the extracted DOA estimates in Figure 23. Aside from a few biases, the DOA estimates generally follow the expected bearings. It should be noted that the interpolated line segments assume a constant velocity. Manually drawn points give rise to small jumps in ground truth estimates, such as discrete jumps for the turn at the cemetery. Otherwise, the measurements resemble the expectations from the route traveled, which is used to form LOBs for localization.

FIGURE 23

Source azimuth extracted from the DOA trace compared against expectations from the route. The azimuth axis is shifted to better show maneuvers. Annotations are provided in blue boxes that reference maneuvers observed in the data.

The LOBs based on DOA estimates and interpolated car position are provided in Figure 24. Most of the LOBs are captured during the car’s drive eastward along the straight road and, therefore, provide an overall bearing and are not grounds for positioning. However, the spread is relatively small, correctly indicating the spoof-er’s proximity to the northern side of the road. The measurements closer to the spoofer’s location intersect with the LOBs obtained from the drive relative to the spoofer’s true position. An estimate for the spoofer’s location is provided by triangulating paired LOBs in sequence. To minimize the effect of noisy measurements, each triangulation is made from paired LOBs, which are 5 s apart, giving a maximum baseline at approximately 55 m, as the car was traveling at approximately 40 km/h. For a given LOB pairing, this approach should confine the individual estimates to AOU ≤ 100 m², assuming that the signal source is closer than 150 m (from Figure 4), resulting in a position resolution of 10 m, which is reasonable considering the size of the search area. Each triangulated position was accumulated within a grid covering the area of interest, with a cell spacing of 10 m, using the response for the largest accumulation to indicate the most probable location. The resulting heatmap is presented in Figure 25.

FIGURE 24

LOBs drawn for each recorded receiver position. The inset corresponds to the region close to the spoofer’s true location.

FIGURE 25

Accumulated triangulation for the entire drive displayed as a heatmap, with a pixel size of 10 m × 10 m. The area covered by the inset has been interpolated to estimate the most probable spoofer location.

The maximum response is found close to the spoofer’s true location at an offset of (∆x, ∆y) = (9.6 m, –15.4 m) or a distance of 18.1 m. This offset cannot be attributed to the receiver traveling along the road, as such a bias would be more closely aligned with the direction of travel. Still, the offset places the spoofer’s location at the premises where the antenna is installed. The effects of poor geometry for similar localization scenarios at Bleik were also reported by Wilde et al. (2024), with a similar accuracy, estimating the transmitter location at approximately 19 m from the actual position based on the TDOA.

Other hotspots include the origin at the outset of measurements and the turns made at the cemetery, near (x, y) = (1200 m, 0 m). These hotspots may be attributed to the receiver traveling at low speeds or stopping at times, providing a larger concentration of samples at these intervals, paired with noisy measurements. Despite this and the uncertainties associated with establishing the ground truth of the travel of the test vehicle, this simple approach still enables geolocation of the spoofer with a relatively high accuracy that is more than adequate for locating and acting upon the source of interference.

4.4.3 PNT from Spoofing

The RTL-SDR has long been known to be viable for use as a GNSS front-end owing to its specifications, particularly its stable oscillator (Fernández-Prades et al., 2013). Similar performance is expected from the KrakenSDR, as it is based on the same paired chipsets. In the case of spoofing attacks, the same recordings used for localization can be applied to monitor PVT and detect attacks as they occur. According to the Jammertest organizers, the spoofing signal was fixed to a static position of 70°N, 10°E in the middle of the Norwegian Sea, at approximately 250 km from the spoofer’s true location. The time was also spoofed from the time of recording, September 20, 2023, 09:30:16 CET, to October 1, 2023, 12:00:00 CET at the onset of spoofing (NKOM, 2023). The three recordings from CH0 were combined in sequence and processed in continuity using the GNSS-SDR introduced by Fernández-Prades et al. (2011). The carrier-to-noise density ratio (C/N₀) and reported positions are shown in Figures 26 and 27.

C/N0 from tracking across 15 channels for processing of the three recordings, including markers for a change of recording, with unstable tracks shown in gray.

FIGURE 26

C/N₀ from tracking across 15 channels for processing of the three recordings, including markers for a change of recording, with unstable tracks shown in gray.

FIGURE 27

Longitude and latitude from GNSS data processing captured for CH0. The single offset position reported at approximately 12:03 was off from both axes by more than 0.25°.

The C/N₀ levels follow the LOS conditions and distance to the spoofer, as established from the previous analysis. Interruptions occur around the time when recordings change, as expected, with tracks re-established shortly afterward. The reported positions are closely aligned with expectations, with standard deviations well below 0.0001°, i.e., within 5-m accuracy of the reported position.

We evaluated the previous DOA estimates for the L1 band, without isolating the response for individual PRNs. As previously established, this approach can be used as a dependable spoofing detection scheme, as all PRNs will be located to the same DOA angle(s) for typical singular spoofer attacks. We used the G-SAP scheme to calculate DOA traces for each of the available PRNs in the signal. Using a coherent processing time of 5 ms for initial acquisition and a burst rate of 0.1 s, we evaluated all 32 PRNs with G-SAP, as shown in Figure 28.

FIGURE 28

DOA traces for the first spoofing recording evaluated for all 32 PRNs using sequential matched filtering with G-SAP. Black pixels fall below the interval, with completely black plots caused by a lack of detection for that particular PRN.

The detected PRNs resemble the corresponding time interval of Figure 21. The varying SNR indicates that the PRNs may have been transmitted at different power levels. This approach would be sensible on the part of the spoofer, to avoid detection based on typical parameter monitoring, such as changes to C/N₀ and automatic gain control levels, associated with the commencement of an attack (Spens et al., 2022). However, MUSIC does not preserve relative signal power levels. For proper evaluation, the estimated SNR at the acquisition stage of G-SAP is presented in Figure 29, based on a varying coherent processing interval (CPI), i.e., the length of the correlator sequence. Compared with the estimated SNR at the acquisition stage, the same PRNs are found as the signals acquired using the GNSS-SDR, as shown in Figure 26. The proposed scheme exhibits a relatively low processing speed, owing to the multiple correlator calls. For the purposes of monitoring for spoofing attacks, it may be adequate to evaluate a single burst and determine whether multiple PRNs align, indicating an active attack. This approach would effectively screen for typical spoofing attackers relying on a single transmitter and would likely make sophisticated attacks much more challenging. The approach is applicable to adaptive patch antenna arrays and is pending further study in the future.

FIGURE 29

Estimated SNR of each PRN for the acquisition stage for varying CPIs, with acquisition tested at a time of 0 s (left) and 40 s (right). Low SNR tracks without valid detection are shown in gray.

5 CONCLUSIONS AND FUTURE WORK

This paper presents the first set of measurements for direction finding and localization of active GNSS jamming and spoofing using a low-cost array-based SDR in the form of the KrakenSDR. Real GNSS jammers were tested across scenarios for varied DOA estimates, demonstrating accurate direction finding in basic single- and dual-receiver tests. The automotive jammer detections were partly affected by the complex scattering environment but provided consistent velocity estimates and correct directions of approach for the car passes. Measurements from wardriving provided clearly traceable maneuvers associated with platform motion and estimated the spoofer’s position close to its real location. The spoofing data were also viable for regular GNSS processing, demonstrating the potential of using the KrakenSDR for simultaneous monitoring and localization of GNSS interference sources.

In the future, we plan to present analyses of the KrakenSDR using GNSS patch antennas to test jamming and spoofing mitigation in the form of null steering and other strategies for mitigation under real-world conditions. Furthermore, we plan to perform drone-based flights to enhance capabilities for localizing interference sources, aided by an improved LOS and the use of hemispherical DOA estimation.

HOW TO CITE THIS ARTICLE:

Lehmann, L., Larsen, S.R., Elsholm, B.B., & Olesen, D.H. (2026). Real-world jammer and spoofer localization using a low-cost array-based software-defined radio. NAVIGATION, 73. https://doi.org/10.33012/navi.735

ACKNOWLEDGMENTS

We would like to thank Casper Jepsen and Rene Ellekaer Greve from the Danish Agency for Climate Data (KDS) for their aid in conducting the experiments. We also thank our colleagues from Electromagnetic Systems, DTU Space, for the use of their anechoic chamber facilities. Furthermore, we are grateful to the organizers of Jammertest for providing this excellent opportunity for open-air experiments and its participants who contributed to a successful event. This work has been financially supported by KDS.

This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

REFERENCES

↵
Bansal, R. (1999). The far-field: How far is far enough? Applied Microwave & Wireless, 11(11), 59–60.
Google Scholar
↵
Bauernfeind, R., & Eissfeller, B. (2014, May). Software-defined radio based roadside jammer detector: Architecture and results. Proc. 2014 IEEE/ION Position, Location and Navigation Symposium-PLANS 2014, Monterey, CA, 1293–1300. https://doi.org/10.1109/plans.2014.6851504
Google Scholar
↵
Borio, D. (2008). A statistical theory for GNSS signal acquisition [Doctoral dissertation, Politecnico di Torino].
Google Scholar
↵
Capon, J. (1969). High-resolution frequency-wavenumber spectrum analysis. Proc. of the IEEE, 57(8), 1408–1418. https://doi.org/10.1109/proc.1969.7278
Google Scholar CrossRef
↵
Chang, H., Pang, C., Zhang, L., & Guo, Z. (2022). Rotating single-antenna spoofing signal detection method based on IPNN. Sensors, 22(19), 7141. https://doi.org/10.3390/s22197141
Google Scholar
Crowd Supply. (2022). KrakenSDR, A phase-coherent software-defined radio with five RTL-SDRs. Retrieved June 10, 2024, from https://www.crowdsupply.com/krakenrf/krakensdr
Google Scholar
↵
Fernández-Prades, C., Arribas, J., & Closas, P. (2013). Turning a television into a GNSS receiver. Proc. of the 26th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2013), Nashville, Tennessee, 1492–1507. https://www.ion.org/publications/abstract.cfm?articleID=11334
Google Scholar
↵
Fernández-Prades, C., Arribas, J., Closas, P., Aviles, C., & Esteve, L. (2011). GNSS-SDR: An open source tool for researchers and developers. Proc. of the 24th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2011), Portland, OR, 780–794. https://www.ion.org/publications/abstract.cfm?articleID=9640
Google Scholar
↵
Flytkjær, R., Sabri, F., Esteve, R., Jessie, W., Goulding, T., & Mathewson, P. (2023). The economic impact on the UK of a disruption to GNSS (tech. rep.). London Economics.
Google Scholar
↵
Great Scott Gadgets. (2021). User Documentation. Retrieved June 19, 2024, from https://hackrf.readthedocs.io/en/latest/index.html
Google Scholar
↵
Jammertest. (2024). Official website for the upcomming Jammertest 2024. Retrieved February 28, 2024, from https://jammertest.no
Google Scholar
↵
Josefsson, M. (2013). Five proofs of an area characterization of rectangles. Forum Geometricorum, 13, 17–21. https://www.researchgate.net/profile/James-Peters-3/post/Why_is_the_length_of_a_rectangle_longer_than_the_breadth_or_width/attachment/59d61db579197b8077979724/AS%3A272429761400836%401441963724479/download/views-of-rectangle.pdf
Google Scholar
↵
Kar, G., Mustafa, H., Wang, Y., Chen, Y., Xu, W., Gruteser, M., & Vu, T. (2014). Detection of on-road vehicles emanating GPS interference. Proc. of the 2014 ACM SIGSAC conference on computer and communications security, 621–632. https://doi.org/10.1145/2660267.2660336
Google Scholar
↵
Kocher, S., Hansen, J., & Rügamer, A. (2024). GNSS interference localization for vehicular jammers using low-cost COTS sensors. 2024 International Conference on Localization and GNSS (ICL-GNSS), 1–7. https://doi.org/10.1109/icl-gnss60721.2024.10578445
Google Scholar
↵
KrakenRF, Inc. (2023a). Demo videos, updates, and improvements. Retrieved June 26, 2024, from https://www.crowdsupply.com/krakenrf/krakensdr/updates/demo-videos-updates-andimprovements
Google Scholar
↵
KrakenRF, Inc. (2023b). KrakenSDR documentation. Retrieved February 28, 2024, from https://github.com/krakenrf/krakensdr_docs/wiki
Google Scholar
↵
Langley, R. B. (1999). Dilution of precision. GPS World, 10(5), 52–59.
Google Scholar
↵
Larsen, S. S., Jensen, A. B., & Olesen, D. H. (2021). Characterization of carrier phase-based positioning in real-world jamming conditions. Remote Sensing, 13(14), 2680. https://doi.org/10.3390/rs13142680
Google Scholar
↵
Lehmann, L. (2022). Multiple-input multiple-output radar for drone detection [Doctoral dissertation, Technical University of Denmark].
Google Scholar
↵
Lehmann, L., Larsen, S. R., & Olesen, D. H. (2024). Real-world jammer localization using a lowcost array-based software-defined radio. Proc. of the 37th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2024), Baltimore, MD, 3715–3729. https://doi.org/10.33012/2024.19911
Google Scholar
↵
Mitch, R. H., Dougherty, R. C., Psiaki, M. L., Powell, S. P., O’Hanlon, B. W., Bhatti, J. A., & Humphreys, T. E. (2011). Signal characteristics of civil GPS jammers. Proc. of the 24th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2011), Portland, OR, 1907–1919. https://www.ion.org/publications/abstract.cfm?articleID=9740
Google Scholar
↵
NKOM. (2023). Testplan for the event “jammertest 2023”. https://jammertest.no/previousjammertests/
Google Scholar
↵
O’Donoughue, N. (2019). Emitter detection and geolocation for electronic warfare. Artech House. https://doi.org/10.7249/cb909
Google Scholar
↵
Olesen, D., Jakobsen, J., & Knudsen, P. (2017). Ultra-tightly coupled GNSS/INS for small UAVs. In Proc. of the 30th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2017), Portland, OR, 2587–2602. https://doi.org/10.33012/2017.15282
Google Scholar
↵
Perkins, A., Chen, Y.-H., Lo, S., Lee, C., & Powell, J. D. (2019). Real-time unmanned aerial system (UAS) based interference localization in a GNSS denied environment. Proc. of the 32nd International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2019), Miami, FL, 1003–1019. https://doi.org/10.33012/2019.16992
Google Scholar
↵
Perkins, A., Dressel, L., Lo, S., Reid, T., Gunning, K., & Enge, P. (2016). Demonstration of UAV based GPS jammer localization during a live interference exercise. Proc. of the 29th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, OR, 3094–3106. https://doi.org/10.33012/2016.14661
Google Scholar
↵
Psiaki, M. L., & Humphreys, T. E. (2016). GNSS spoofing and detection. Proc. of the IEEE, 104(6), 1258–1270. https://doi.org/10.1109/jproc.2016.2526658
Google Scholar
↵
Rügamer, A., Neumaier, P., Sommer, P., Garzia, F., Rohmer, G., Konovaltsev, A., Sgammini, M., Caizzone, S., Meurer, M., Wendel, J., Schubert, F., Baumann, S. (2014). BaSE-II: A robust and experimental Galileo PRS receiver development platform. Proc. of the 27th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2014), Tampa, FL, 2579–2591. https://www.ion.org/publications/abstract.cfm?articleID=12321
Google Scholar
↵
Ruotsalainen, L., Kirkko-Jaakkola, M., Bhuiyan, M., Söderholm, S., Thombre, S., & Kuusniemi, H. (2014). Deeply coupled GNSS, INS and visual sensor integration for interference mitigation. Proc. of the 27th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2014), Tampa, FL, 2243–2249. https://www.ion.org/publications/abstract.cfm?articleID=12251
Google Scholar
↵
Schmidt, R. (1986). Multiple emitter location and signal parameter estimation. IEEE Transactions on Antennas and Propagation, 34(3), 276–280. https://doi.org/10.1109/tap.1986.1143830
Google Scholar CrossRef
↵
Shin, C., Ju, J., Kang, D., Choi, S., Lee, C., Cheong, C., Seo, J., Sarkar, T. K., & Salazar-Palma, M. (2013). Implementation of an antenna array for satellite communications with the capability of canceling jammers. IEEE Antennas and Propagation Magazine, 55(1), 32–48. https://doi.org/10.1109/map.2013.6474483
Google Scholar
↵
Smith, C., Yan, H., Hafez, O. A., Hopwood, J., & Joerger, M. (2024). UAS-based radio frequency interference localization using power measurements.Proc. of the 2024 International Technical Meeting of the Institute of Navigation, Long Beach, CA, 1169–1183. https://doi.org/10.33012/2024.19570
Google Scholar
↵
Spens, N., Lee, D.-K., Nedelkov, F., & Akos, D. (2022). Detecting GNSS jamming and spoofing on Android devices. NAVIGATION,69(3). https://doi.org/10.33012/navi.537
Google Scholar
Stoica, P., Moses, R. L., et al. (2005). Spectral analysis of signals (Vol. 452). Pearson Prentice Hall. https://doi.org/10.1007/978-3-031-02525-9
Google Scholar
↵
Taylor, F., Gattis, E., Trapani, L., Akos, D., Lo, S., Walter, T., & Chen, Y.-H. (2023). Software defined radio for GNSS radio frequency interference localization. Sensors, 24(1), 72. https://doi.org/10.3390/s24010072
Google Scholar
↵
Trapani, L., Taylor, F., Gattis, E., Chen, Y., Lo, S., Walter, T., Akos, D. (2023). Testing a coherent software defined radio platform for detection of angle of arrival of RF signals. Proc. of the 36th International Technical Meeting of the Satellite Division of the Institute of Navigation (IONGNSS+ 2023), Denver, CO, 3829–3836. https://doi.org/10.33012/2023.19377
Google Scholar
↵
van der Merwe, J. R., Rügamer, A., & Lipka, M. (2023). Enhanced spatial spoofing detection with and without direction of arrival estimation. IEEE Transactions on Aerospace and Electronic Systems, 59(5), 5530–5540. https://doi.org/10.1109/taes.2023.3262455
Google Scholar
↵
Van Trees, H. L. (2002). Optimum array processing: Part IV of detection, estimation, and modulation theory. John Wiley & Sons. https://doi.org/10.1002/0471221104
Google Scholar
↵
Wilde, W. D., Sleewaegen, J.-M., & Bougard, B. (2024). Precise interference localization with commercial GNSS receiver modules. Presented at the 37th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2024), Baltimore, MD.
Google Scholar

PDF

Previous Next

Real-World Jammer and Spoofer Localization Using a Low-Cost Array-Based Software-Defined Radio

Abstract

1 INTRODUCTION