Participatory Detection and Localization of a GNSS Jammer

Abstract

Global navigation satellite system (GNSS) receivers are ubiquitous in our society, and because they are vulnerable to jamming attacks, it is important to quickly detect and localize any attackers. Instead of relying on dedicated sensing infrastructure for localization, one can utilize crowdsensing, or participatory sensing, where a large ensemble of users contributes measurements. In this work, the used measurements are carrier-to-noise-density ratio (C/N₀) estimates and automatic gain control (AGC) values, which can both be retrieved from commercial connected GNSS receivers such as mobile phones. We extend our localization algorithm, with the option to use AGC values or C/N₀ estimates alone or in combination, and improve the convergence rate. The flexibility of the proposed algorithm in using either AGC or C/N₀ data, depending on the type of phone, increases the potential of the algorithm for participatory localization. The proposed algorithm was evaluated using data from different types of mobile phones in a simulated environment and in over-the-air field tests. These evaluations show that the proposed algorithm can operate in real-world situations and that it outperforms similar localization algorithms, achieving an estimated error of approximately 50–60 m for a free line-of-sight path loss. Moreover, for a varying path loss, the error remains well below 500 m most of the time. Given that the receivers are placed up to over 5000 m from the transmitter, these results show that the proposed localization algorithm is efficient in narrowing down the jammer position. Based on this localization, a report to relevant authorities can be facilitate further action, e.g., precise localization and removal of the jammer.

Keywords

1 INTRODUCTION

Global navigation satellite system (GNSS) receivers are widespread and are currently used in society-critical services. It is known that GNSS receivers are vulnerable to jamming attacks, and over the last decade, numerous incidents have been reported worldwide (Goward, 2023). Therefore, given that jamming can single-handedly block GNSS service, it is crucial not only to detect but, more importantly, to localize the source of such attacks. This detection can be difficult without a dedicated sensing infrastructure, which is typically absent outside of special-purpose locations (e.g., airports). The challenge is to be able to detect jamming in any location, e.g., a road, without deploying a sensing infrastructure. The notion of participatory sensing, or crowdsensing, presents a valuable alternative: rather than relying on a dedicated sensing infrastructure, a large ensemble of voluntary contributors could provide measurements. The participatory sensing network considered in this work is based on GNSS receivers embedded in connected devices, particularly mobile phones that are widely available.

The provided measurements refer to receiver-reported carrier-to-noise-density ratio (C/N₀) estimates and automatic gain control (AGC) values. C/N₀ measurements are provided by most GNSS receivers, from low-cost to professional. Some embedded receivers, such as modern Android devices (see, e.g., the work by Spens et al. (2022)), also output AGC gain values. The AGC is used to maintain a desired signal amplitude at the receiver’s analog-to-digital converter, even though the incoming signal varies in amplitude. Both of these measurements allow for detection and localization of the a jamming source using different types of embedded GNSS receivers.

Similar ideas have been considered in previous work on crowdsensing-based GNSS interference detection and localization (e.g., the work by Ahmed and Sokolova (2020), Ahmed et al. (2021), Borio et al. (2016), Kraemer et al. (2012), Liu et al. (2020), Olsson et al. (2022, 2023), Strizic et al. (2018), and Wang and Morton (2020)). These papers exploit jamming power estimation via C/N₀ estimates, AGC values, or direct power measurements. Kraemer et al. (2012) and Strizic et al. (2018) considered a crowdsourcing approach using data from mobile phones. While Strizic et al. (2018) did not describe a localization algorithm based on mobile phones in enough detail for implementation, the principles of the power difference of arrival (PDOA) and time difference of arrival (TDOA) are briefly mentioned in that work, and the results of a TDOA solution based on raw data from a software-defined radio (SDR) are presented. Kraemer et al. (2012) assumed that the receiver travels along two straight perpendicular lines. This assumption is highly restrictive regarding the users’ movements and may be challenging to implement.

Ahmed and Sokolova (2020), Ahmed et al. (2021), Borio et al. (2016), Liu et al. (2020), and Wang and Morton (2020) presented system models that are similar to the model used in this work and more or less identical to the model presented by Olsson et al. (2022) and Olsson et al. (2023). The model of Olsson et al. (2022) and Olsson et al. (2023), which is also applied in this work, differs from earlier models by including a stochastic measurement error and assuming that the path loss between the jammer and each receiver is unknown, which is necessary for practical applications. Moreover, this model does not need to be calibrated beforehand, which is required by the algorithms of Ahmed and Sokolova (2020), Ahmed et al. (2021), Borio et al. (2016), and Wang and Morton (2020).

Other examples of similar work have focused on TDOA- or PDOA-based algorithms, as presented by Blay and M. (2018) and Tucker et al. (2020), respectively. The PDOA approach is similar to using AGC or C/N₀ measurements, and the TDOA approach assumes an unknown path loss. However, the PDOA approach measures the received power directly, and the TDOA approach requires access to baseband in-phase/quadrature data, both of which are usually not available in commercial-off-the-shelf (COTS) GNSS receivers that are of interest for a participatory sensing application.

In this work, we propose a novel jamming detection and localization algorithm based on participatory sensing, taking AGC or C/N₀ estimates from a COTS smartphone. The proposed approach can be viewed as a variation of PDOA, but using AGC and C/N₀ as input data. In this context, we propose a novel problem formulation and solution to the problem, taking into account the unknown path loss between the jammer and each of the participating receivers. This work extends the work of Olsson et al. (2022) and Olsson et al. (2023) by making it possible to use AGC measurements or a combination of AGC and C/N₀measurements, instead of using only C/N₀ measurements. The algorithm is modified to increase the convergence rate is made, and additional tests with a mobile phone are performed to validate the measurement model and to evaluate the proposed algorithm for participatory sensing, for example, by testing two different types of jamming waveforms. Finally, field tests with multiple phones are conducted to further evaluate the algorithm in realistic scenarios.

2 SYSTEM MODEL

Here, we provide the system model assumptions, adopted from the models presented by Olsson et al. (2022) and Olsson et al. (2023). We consider n participatory sensing nodes, termed receivers, in an area affected by a jammer at an unknown position to be estimated. In order to formulate the measurement models to derive position estimators, the following assumptions are made:

All receiver and jammer antennas have constant gains in the direction from the jammer to each receiver during the observation interval.
The path loss between the jammer and each receiver is assumed to be constant, but not equal, during the observation interval.
The jammer is stationary during the measurement, i.e., its position p₀ = [x₀, y₀, Z₀]^T is constant.
The jammer transmits with constant power, J₀.
The receiver noise power is constant during the measurement.
The receivers are moving and their positions are known and denoted by ${p_{i} [n] = x_{i} [n], y_{i} [n], z_{i} [n]]}^{T}$ at time n for receiver i = 1,…, N_r.

Similar assumptions were made, explicitly or implicitly, by Ahmed and Sokolova (2020), Ahmed et al. (2021), Borio et al. (2016), and Wang and Morton (2020). The assumption of constant antenna gains in the direction from the jammer to the receiver during each observation interval is required to estimate the channel. This assumption is important because the path loss exponent must be (approximately) constant during the measurement interval. This constant gain can be achieved, e.g., by isotropic antennas. Importantly, the assumptions need to be valid only within the duration of an observation interval. Another way to achieve this would be to assume that the antenna directions between the receiver and jammer are constant during the measurement. A constant noise power is a fair approximation within the relatively short time frame considered, and an assumption of constant jamming power is valid for most jammers. To simultaneously estimate the channel, the receivers must be in motion to attain noticeable differences in received power. The movement should, however, be modest during the measurement time, because significant mobility increases the risk that the path loss exponent will change when the environment changes.

To estimate the jammer position in three dimensions, measurements from more than three receiver positions are needed. In practice, this requirement also implies the need for more than three receivers to obtain a good receiver geometry, as the receivers move relatively short distances within each measurement interval. The receiver positions can be gathered by integration of GNSS and other embedded sensors, e.g., an inertial measurement unit and terrestrial network receivers, and thus an estimate of the position can be obtained even if the GNSS receiver is affected by interference.

It should be noted that the proposed algorithm is able to estimate the jammer position even if all assumptions do not hold perfectly, although the estimate may be less accurate. For example, the jammer position estimate will be less accurate if the jammer is moving, the transmit power fluctuates, or the receiver positions are inaccurate. Furthermore, with the hardware setup used in this work, the assumption of isotropic antennas might not be realistic, which will result in a larger estimation error.

The receiver estimates that are usually referred to as C/N₀, with a slight abuse of terminology, are, in practice, estimates of the carrier-to-noise-and-interference-density ratio (CNIR). To avoid this common abuse of terminology, the measured metric is referred to as CNIR in the remainder of this paper. The transmitter position p₀ is estimated using either AGC measurements, CNIR measurements, or a combination of both. The measurement model for AGC measurements is explained first, followed by the model for CNIR measurements.

Crowdsensed contributions are provided by participants and are authenticated and their integrity safeguarded by leveraging a state-of-the-art architecture with client misbehavior detection, as discussed by Eryonucu and Papadimitratos (2022, 2024a, 2024b) and Gisdakis et al. (2016). We do not further dwell on such considerations here, as our focus is on jammer localization per se. Participant trustworthiness and reliability can be assessed and their contributions excluded if needed. We leverage this ability as explained in Section 3.1.

2.1 AGC

Let h_i[n] denote the channel power gain between the transmitting jammer and receiver i at time n. The received jamming power J_i[n] is then given as follows:

J_{i} [n] = J_{0} h_{i} [n]

The channel gain is dependent on the distance, d_i[n], between the jammer and receiver i:

d_{i} [n] ≜ ‖ p_{0} - p_{i} [n] ‖ = \sqrt{{(x_{0} - x_{i} [n])}^{2} + {(y_{0} - y_{i} [n])}^{2} + {(z_{0} - z_{i} [n])}^{2}}

With a path loss model in which h_t[n] ∝ 1/d^α_i, the received jamming power is as follows:

J_{i} [n] = \frac{J_{0} κ}{d_{i} {[n]}^{α_{i}}}

Here, α_i is the unknown path loss exponent for receiver i. κ is a proportionality constant, dependent on, for example, carrier frequency and antenna gain, which are constant for every receiver, as all antennas are assumed to be isotropic. The total received power can be expressed as follows:

P_{i} [n] = J_{i} [n] + N_{G, i} + \sum_{j = 1}^{N_{m}} C_{i, j} [n]

where N_G,i is the unknown background noise power at the AGC circuit of receiver i, which is assumed to be constant. The received signal power from satellite j = 1,…, N_m, denoted by C_i,j, is small compared with the receiver noise power and can therefore be neglected, resulting in the following:

P_{i} [n] \approx J_{i} [n] + N_{G, i} = \frac{J_{0} κ}{d_{i} {[n]}^{α_{i}}} + N_{G, i}

The AGC gain for receiver i = 1,…, N_r at time n is denoted by g_i[n]. Ideally, we have the following:

g_{i} [n] \sqrt{P_{i} [n]} = \sqrt{{\bar{P}}_{i}}

where $\sqrt{\bar{P_{i}}}$ is the desired signal amplitude at the receiver. When no jamming is present, i.e., when J₀ = 0, the AGC gain is assumed to be known and denoted $\bar{g_{i}}$ . This gives us the following:

{\bar{g}}_{i} \sqrt{N_{G, i}} = \sqrt{{\bar{P}}_{i}}

The gain $\bar{g_{i}}$ can be easily estimated by long-term estimation or during initialization when no jamming is present. It should also be noted that the algorithm uses the difference relative to the desired signal amplitude, $\bar{g_{i}}$ , not the absolute signal amplitude. This distinction is important, as the absolute AGC measurements can vary substantially between different manufacturers.

Combining Equation (6) with Equation (7) gives the following:

g_{i} [n] = {\bar{g}}_{i} \sqrt{\frac{N_{G, i}}{P_{i} [n]}} = {\bar{g}}_{i} \sqrt{\frac{N_{G, i}}{\frac{J_{0} κ}{d_{i} {[n]}^{α_{i}}} + N_{G, i}}}

In turn, when expressed in decibels with added measurement noise, this equation is as follows:

G_{i} [n] = {\bar{G}}_{i} - 10 \log_{10} (\frac{J_{0} κ}{N_{G, i}} d_{i} {[n]}^{- α_{i}} + 1) + w_{G_{i}} [n]

Here, $G_{i} [n] ≜ 20 \log_{10} (g_{i} [n])$ , ${\tilde{G}}_{i} [n] ≜ 20 \log_{10} (\bar{g_{i}})$ , and $w_{G_{i}} [n]$ is the measurement noise in decibels, assumed to be zero-mean white Gaussian with unknown variance $σ_{G, i}^{2}$

2.2 CNIR

The model for CNIR measurements is derived in analogy to the AGC measurement model in Section 2.1. Let s_i,j[n] be the observed CNIR, estimated by the GNSS receiver i. The CNIR can be written as follows:

s_{i, j} [n] ≜ \frac{C_{i, j} [n]}{N_{0, i} + {\tilde{J}}_{i} [n]} = \frac{C_{i, j} [n]}{N_{0, i}} . \frac{1}{1 + \frac{{\tilde{J}}_{i} [n]}{N_{0, i}}}

where N_0,i is the background noise power spectral density at receiver i and ${\tilde{J}}_{i} [n]$ is a spectrally-flat-equivalent interference power density at receiver i. By multiplying ${\tilde{J}}_{i} [n]$ and N_0,i in the denominator with the receiver bandwidth, the bandwidth dependence is canceled, and by taking the mean CNIR of all received satellite signals, the mean CNIR can be expressed as follows:

s_{i} [n] = \frac{1}{N_{m}} \sum_{j = 1}^{N_{m}} (\frac{C_{i, j} [n]}{N_{0, i}} . \frac{1}{1 + \frac{J_{i} [n]}{N_{S, i}}})

where N_S,i is the noise power experienced in CNIR estimation.

Similar to the AGC model, we estimate a baseline value corresponding to the case in which no jamming is present, which is denoted as follows:

{\bar{s}}_{i} [n] = \frac{1}{N_{m}} \sum_{j = 1}^{N_{m}} (\frac{C_{i, j} [n]}{N_{0, i}})

Combining Equation (11) with Equation (12) yields the following:

s_{i} [n] = {\bar{s}}_{i} . \frac{1}{1 + \frac{J_{i} [n]}{N_{S, i}}}

Expressing this term in decibels, with $S_{i} [n] ≜ {10 log}_{10} (s_{i} [n])$ and ${\bar{S}}_{i} [n] ≜ {10 log}_{10} ({\bar{s}}_{i})$ , and adding measurement noise gives the following:

S_{i} [n] = {\bar{S}}_{i} - 10 \log_{10} (\frac{J_{0} κ}{N_{S, i}} d_{i} {[n]}^{- α_{i}} + 1) + w_{S_{i}} [n]

where $w_{s_{i}} [n] \sim N (0, σ_{S, i}^{2})$ is the measurement noise with unknown variance $σ_{S, i}^{2}$ . This is analogous to Equation (9).

3 PROPOSED ALGORITHM

To estimate the jammer position, the likelihood function of Equation (9) or Equation (14) is maximized. With the AGC observations for each receiver grouped in $G ≜ [G_{1}, ..., G_{N_{r}}]$ , where G_i contains data for the time instances n = 1,…, N, and the known AGC baseline $\bar{G} ≜ [{\bar{G}}_{1}, ..., {\bar{G}}_{N_{r}}]$ , the likelihood function for AGC measurements is as follows:

\begin{array}{l} p (G | \bar{G}, p_{0}, α, ζ, σ_{G}^{2}) \\ = \prod_{i = 1}^{N_{r}} {(2 π σ_{G, i}^{2})}^{- N / 2} \exp [- \frac{1}{2 σ_{G, i}^{2}} \sum_{n = 1}^{N} {(G_{i} [n] - ({\bar{G}}_{i} - 10 \log_{10} (ζ_{i} d_{i}^{- α_{i}} [n] + 1)))}^{2}] \end{array}

The unknowns are the path loss exponents for each receiver $α ≜ [α_{1}, ..., α_{N_{r}}]$ , the constants $ζ_{i} ≜ \frac{J_{0} κ}{N_{G, i}}$ for each receiver stacked in the vector $ζ ≜ [ζ_{1}, ..., ζ_{N_{r}}]$ , the measurement noise variances $σ_{G}^{2} ≜ [σ_{G, 1}^{2}, ..., σ_{G, N r}^{2}]$ , and the sought transmitter position p₀. The jammer position is found by maximizing Equation (15) as follows:

p_{0}^{*} = \underset{p_{0}, α, ζ, σ_{G}^{2}}{arg max} p (G | \bar{G}, p_{0}, α, ζ σ_{G}^{2})

The likelihood for the CNIR measurements is similar:

\begin{array}{l} p (S | \bar{S}, p_{0}, α, η, σ_{S}^{2}) \\ = \prod_{i = 1}^{N_{r}} {(2 π σ_{S, i}^{2})}^{- N / 2} \exp [- \frac{1}{2 σ_{S, i}^{2}} \sum_{n = 1}^{N} {(S_{i} [n] - ({\bar{S}}_{i} - 10 \log_{10} (η_{i} d_{i}^{- α_{i}} [n] + 1)))}^{2}] \end{array}

where $η ≜ [η_{1}, ..., η_{N_{r}}]$ , $η_{i} ≜ \frac{J_{0} κ}{N_{S, i}}$ and $σ_{S}^{2} ≜ [σ_{S, 1}^{2}, ..., σ_{S, N_{r}}^{2}]$ . This likelihood is maximized in the same way as when using AGC measurements.

The two different measurements can also be combined, for instance, if one set of receivers can only deliver CNIR and another set of receivers delivers AGC. The combined measurement model can then be expressed as follows:

p (S, G | \bar{S}, \bar{G}, p_{0}, α, ζ, η, σ_{G}^{2}, σ_{S}^{2}) = \prod_{i = 1}^{N_{r}} X_{i}

Here, X_i is the expression after the product operator in Equation (15) if receiver i contributes AGC measurements or the expression after the product operator in Equation (17) if receiver i gives only CNIR measurements. If both measurements can be obtained by a receiver, the product of the two likelihoods can be used instead, provided that the AGC and CNIR measurements performed by one receiver are independent. However, this is likely not the case in reality. To derive the joint likelihood of the AGC and CNIR would then require knowledge or estimation of the covariance, which is beyond the scope of this work. It should also be noted that the algorithm uses only time instances for which the received AGC or CNIR measurements fall below a certain threshold from the baseline, i.e., the expression after the sum operator in Equation (17) can be denoted as the conditional variable:

Y_{S, i} [n] = {\begin{matrix} S_{i} [n] - {\bar{S}}_{i} + 10 \log_{10} (η_{i} d_{i}^{- α_{i}} [n] + 1), \\ 0, \end{matrix} \begin{matrix} if S_{i} [n] - {\bar{S}}_{i} < γ \\ otherwise \end{matrix}

where γ is the detection threshold. This is also the case for AGC measurements. As a consequence, if input data are missing during some of the time, the data are automatically excluded from the estimation process. That is, the proposed algorithm can handle an intermittent loss of measurements, for example, if a receiver is completely saturated by the jammer such that it cannot provide the required AGC and CNIR data.

3.1 Estimation From a Subset of Sensors

If some sensors are unreliable or do not fit the model well, for instance, if the path loss model h_i[n] ∝ 1/d_i[n]^α_i is inaccurate, the position estimation might not perform well. This scenario occurs, for example, if there is an object between the jammer and the receiver that blocks the signal and makes the distance-dependent path loss model invalid. To improve the estimation accuracy, only a subset of the sensors is used for the estimation, and this subset consists of those receivers that are deemed to have a free line of sight to the jammer, i.e., α ≈ 2. In reality, the path loss exponent may vary greatly, and thus, the assumption α = 2 might be misleading. Therefore, only receivers with an estimated α_i < 2.3 are deemed useful and used in the localization estimation.

To determine each receiver path loss exponent, the likelihood function is maximized by using each receiver individually with respect to all unknowns while keeping α_i fixed, testing different values for the path loss exponent using a grid search. The value of α_i resulting in the highest likelihood is regarded as that particular receiver’s estimated path loss exponent. The receivers that are deemed the most useful are then used in the joint estimation of the jammer position.

3.2 Maximizing the Likelihood Function

Because the maximization of Equation (15), (17), or (18) cannot be solved analytically, the solution is found by using a gradient descent on the negative log-likelihood, using a backtracking line search to find a suitable step size. The path loss exponent α_i is, as previously noted, estimated using a grid search, i.e., different fixed values of α_i are tested while other parameters are optimized during the gradient descent. The variables σ_G,i and σ_s,i can be solved analytically, conditioned on the other unknown parameters. When using AGC, for example, σ_G,i is determined as follows:

σ_{G,i}^{2} = \frac{1}{N} \sum_{n = 1}^{N} {(G_{i} [n] - {\bar{G}}_{i} + 10 \log_{10} (ζ_{i} d_{i}^{- α_{i}} [n] + 1))}^{2}

and is computed after each iteration of the gradient descent. When the CNIR is used, σ_S,i is calculated in a corresponding way. σ_G,i and σ_S,i are initiated as the variance of the AGC or CNIR value of each receiver when no jamming is present. The unknowns ζ_i and η_i are both initiated to 10⁸ during the path loss estimation, and the resultant values on ζ and η are then used as initial values during the joint estimation. Finally, the initial jammer position estimate is set to the mean starting position of all receivers used, i.e., $p_{0} = \frac{1}{N_{r}} \sum_{i = 1}^{N_{r}} p_{i} [0]$ , both for the path loss estimation and the joint estimation.

If no solution is found, i.e., if the gradient descent does not converge within a predetermined number of iterations, the joint estimation is performed again, but in this case, the jammer position is initiated with the mean position of only the receivers with an estimated α_i < 2.3, i.e., only the receivers that are used in the joint estimation. Although this additional run does not always find a solution, it at least increases the of likelihood of finding a solution. If no solution is found, one can use the mean position as the final solution, as suggested by Borio et al. (2016). This option is, however, not applied for this algorithm.

4 HARDWARE SIMULATIONS

The proposed algorithm is evaluated using hardware simulations designed to be similar to the software simulations described by Olsson et al. (2022), using a COTS receiver in order to evaluate the effectiveness of mobile phones as participatory sensors. With the simulator used, there was a lower limit on the jamming power. To obtain AGC and CNIR levels similar to those of Olsson et al. (2022), the scenario area and the receiver speed had to be scaled up. Otherwise, all receivers would be completely jammed. The hardware setup is the same as that used by Olsson et al. (2023).

4.1 Hardware Setup

Hardware simulations were performed using a Spirent GSS9000 GNSS simulator, which is capable of generating GNSS and jamming signals. The Android phone Samsung Galaxy S20+ was used as an indicative contemporary platform that supports participatory sensing/crowdsensing with an embedded GNSS receiver. Because the phone has an internal GNSS antenna, a universal radiofrequency (RF) shield box from Rohde & Schwarz was used to transmit both the GNSS and jamming signals over the air. The box gives rise to multipath effects within the box, but these effects are neglected because the travel distances are small (a couple of decimeters at maximum). The box also shields the phone from any unwanted signals from the surroundings. The Android application GnssLogger, presented by van Diggelen et al. (2020), was used to extract and store AGC and CNIR measurements from the phone. The setup of the hardware simulation is shown in Figure 1.

Figure 1

Hardware setup for simulations

The same individual phone was used for all of the tests, but with individually generated scenarios to simulate the virtual movements and received signals. The scenarios were created with an individual movement pattern for each (virtual) phone during a specific time frame. Global Positioning System (GPS) L1 signals were then generated in the simulator to represent this scenario. To ensure that the phone would lock on to the simulated signals, the phone had to be set in flight mode to ensure that network-based positioning did not affect the experiment and the phone time had to be set to a value close to the scenario start time. In this scenario, the jammer was located at a fixed position in accordance with the assumed system model presented in Section 2. The jammer placement and the simulated phone movements are shown in Figure 2.

Figure 2

Simulated trajectories for eight virtual phones

Each virtual phone used for participatory sensing was simulated as follows:

A position fix was acquired during a start-up time of 5 min with a static phone position and no jamming signal present. Measurements from this period were also used to estimate the baseline values ${\bar{G}}_{i}$ and ${\bar{S}}_{i}$ .
The simulated phone movement, generated by the GNSS simulator, occurred in straight lines with a constant velocity of 80 km/h, with the jamming signal present. The observations G_i and S_i used in the algorithm were measured during this period.

The path loss model in Equation (3) was used to define the path loss of the jamming signal and to calculate the received jamming power at each time instance.

Two jamming waveforms were used:

A continuous wave centered at the GPS L1 frequency.
Zero-mean white Gaussian noise, filtered with a 3-dB bandwidth of 2 MHz, centered at the GPS L1 frequency.

Both of the jamming signal waveforms were simulated with the path loss exponent, α, set to 2, 2.22, or 2.5 to emulate differences between the receivers.

4.2 AGC Measurements

The raw AGC measurements extracted from the mobile phone are noisy, and the proposed algorithm cannot find a solution without preprocessing of the data. The raw measurements are shown in Figure 3(a) and can be compared with the mean CNIR of all received satellite signals shown in Figure 3(b).

Figure 3

Measurements reported by a Samsung S20+, with each curve colored according to the receiver trajectory in Figure 2. (a) Raw AGC level for each receiver, (b) Average CNIR values for each receiver, (c) Smoothed AGC level for each receiver.

The jamming signal is turned on at 300 s and turned off at 540 s.

To smoothen the AGC data, a moving average is applied with a window size of 20 samples. However, the moving average makes the edge between unjammed and jammed levels less sharp than it would be without filtering. To prevent this limitation from affecting the estimation performance, a number of samples at the edge, corresponding to the window size, are ignored in the position estimation process. The smoothed AGC values are shown in Figure 3(c).

4.3 Validation of the Measurement Model

Simulations were performed to validate the proposed measurement models, particularly the relationships between the received signal power and the observables AGC and mean CNIR in Equations (9) and (14), respectively. The simulated jamming power, with the two different signal waveforms described in Section 4.1, was set to increase at a constant rate (in logarithmic scale) by simulating movement of the receiver, moving toward the transmitter with a constant speed. The measured AGC values along with smoothed AGC levels and average CNIR levels, as reported by the phone in dB (or dB-Hz), are shown in Figure 4, with Figure 4(a) and Figure 4(b) showing the resulting levels with the continuous wave jamming waveform and with the white Gaussian noise jamming waveform, respectively. The plots show that the AGC and CNIR levels behave similarly with regard to the jamming power, which agrees with the similarities in the two likelihood functions (Equations (15) and (17)). The plots also show that the relationships between jamming power and measured AGC or CNIR levels are approximately linear (in decibels) for the majority of the interval, which also matches our assumed model.

Figure 4

Measured AGC, smoothed AGC, and mean CNIR in relation to jamming power, for two different jamming waveforms. (a) Reported measurements using a continuous wave jamming waveform, (b) Reported measurements using a white Gaussian noise jamming waveform.

When comparing the different jamming waveforms, it is seen that differences arise in the reported CNIR values, with the white Gaussian noise giving CNIR levels that are slightly lower. This difference should not have a significant impact on localization performance, as the proposed algorithm exploits relative rather than absolute numbers from the observations. The AGC levels are similar for the two waveforms.

Some artifacts can be seen in the plots in Figure 4, which may affect the performance of the algorithm. For instance, there is a step in AGC level at a jamming-to-signal ratio (J/S) of approximately 35 dB and 42 dB for the continuous wave signal in Figure 4(a), which is not in line with the expected behavior. These artifacts are likely caused by a hardware issue in the phone’s GNSS receiver, and it would be of interest to investigate this issue with another phone. However, at the time of this test, no additional Android phone was available for testing. Similar behavior has not been observed for the same scenario in other, more advanced, GNSS receivers or in a spectrum analyzer.

5 NUMERICAL RESULTS

The proposed algorithm is evaluated using data provided from the hardware simulations and compared against two other methods, presented by Ahmed and Sokolova (2020) and Borio et al. (2016). Borio et al. (2016) presented a method that estimates the jammer position as the mean position of the receivers detecting the interference. The detection threshold used here is the same as the one used by Borio et al. (2016). Furthermore, the solution given by the method of Borio et al. (2016) is equivalent to the initial position in our proposed estimation process. The method presented by Ahmed and Sokolova (2020) is based on a least-squares estimation method that requires calibration for each receiver, with a known jamming power at a known distance. This method also assumes a free space path loss, i.e., a constant α_i = 2 for all receivers.

The proposed algorithm is evaluated using either AGC, CNIR, or a combination of both measurements. When both measurements are used, either AGC or CNIR is chosen at random, with equal probability, for each receiver. Different path loss exponents are also tested, with α_i set to 2 or randomly set to a value of 2, 2.22, or 2.5. Different numbers of receivers are tested for all evaluations, testing all combinations from the 8 generated receiver paths, using 4-8 receivers. This gives a total of 70, 56, 28, 8, and 1 different combinations when using 4, 5, 6, 7, or 8 receivers, respectively. Two jamming waveforms are used: a continuous wave centered at GPS L1 and a wave with white Gaussian noise with a 2-MHz bandwidth.

5.1 Free Line of Sight

Figure 5 shows the results of the tested methods when α = 2, i.e., when a free line of sight is assumed, for the continuous wave jamming signal. The free space path loss model used by Ahmed and Sokolova (2020) is perfectly suited for this case. In the box plots of the estimated jammer position error, colors indicate which measurement has been used in the evaluation and the texture indicates the method used. The median error is marked by a horizontal line and is also written above the boxes. The boxes span from the first to the third quartile, while the whiskers extend to the farthest data point within 1.5 times the interquartile range. Circles denotes outliers. Note that there are more outliers for 6 receivers than for 7 receivers, which explains why the box is smaller for 6 receivers. For the case in which all 8 receivers are considered, only one evaluation is performed, and consequently, only one estimated jammer position error is produced; therefore, no boxes are shown, only the error. When CNIR measurements are used, indicated by the red boxes in Figure 5, the proposed method performs best, achieving a median error of approximately 50-60 m when using 6-8 receivers. The median error for the least-squares method presented by Ahmed and Sokolova (2020) is similar to that of the proposed method. However, the least-squares method only finds a solution for a total of 5 times out of the 154 runs when using 4-6 receivers. When 7 or 8 receivers are used, no solution is found at all. This limitation is, clearly, a major drawback of the least-squares method. Thus, this method is omitted from the box plots, to increase readability. As expected, the error of the mean position method decreases with an increasing number of receivers, but does not decrease below 600 s with the use of all 8 receivers.

Figure 5

Box plot of estimated position errors obtained by using different numbers of receivers with a free line of sight and a continuous wave jamming signal.

When all 8 receivers are used, only one value is produced.

An additional run of the estimation process is performed, as mentioned in Section 3.2, in which the jammer position is initialized with the mean position of only the receivers with an estimated α_i < 2.3, to increase the convergence ratio. With this approach, the algorithm converges more often than without the additional run. The total number of estimation solutions that converged is presented in Table 1. Even if the error does not change significantly, this additional run is an effective way to increase the overall performance of the algorithm.

View this table:

TABLE 1

Total Number of Converged Evaluations

If AGC measurements are used instead of CNIR measurements, the least-squares method is not able to find a solution at all, for any combination of receivers. The proposed method is also less stable, especially when a small number of receivers is used. When 7 or 8 receivers are used, the median error is below 100 m and clearly lower than the mean position error. This result is shown in Figure 5, represented by blue boxes. It is reasonable that the proposed method performs worse with AGC measurements because the raw measurements are very noisy, while the smoothing might remove information from the signal. Even though the result with AGC measurements is worse than that with CNIR measurments, AGC measurements have some advantages. For instance, CNIR measurements cannot distinguish between weak satellite signal power and jamming, as both result in reduced CNIR levels; in contrast, AGC can distinguish between these two scenarios. Additionally, if the receiver is the target of a spoofing attack, the CNIR values can be spoofed and report high numbers, whereas the AGC will still be affected by the signal power from the spoofer.

Using a combination of the two different measurements, where either AGC or CNIR measurements are selected with equal probability for each receiver, gives the result indicated by the green boxes in Figure 5. The performance of the proposed method for combined measurements falls between that of the two separate models, with the error fluctuating more than that of the CNIR model but still performing better than the AGC model, especially when fewer receivers are used. The least-squares method does not find a solution for any number of receivers.

In Figure 6, the results from the tests with the other jammer signal, a wave with white Gaussian noise with a 2-MHz bandwidth, are shown. While the error is unchanged for the mean position method of Borio et al. (2016), the error for the proposed method is much lower for this test, especially when using only CNIR measurements, shown as red dotted boxes in Figure 6. The median error rapidly decreases to approximately 40-60 m, and the third quartile is never higher than 500 m. As previously shown in Figure 4, the different waveforms have a varying effect on the CNIR measurements, and therefore on the positioning performance.

Figure 6

Box plot of errors when using different numbers of receivers, for a free line-of-sight and white Gaussian noise jamming signal.

When all 8 receivers are used, only one value is produced.

When AGC measurements are used with the white Gaussian noise jamming signal, the results are slightly different, as shown by the blue boxes in Figure 6. While the robustness increases significantly, with a smaller difference between the first and third quartiles, the median error never decreases below 500 m, even when 7 or 8 receivers are used. However, the error is lower when a smaller number of receivers is used. Similar to the results obtained when using CNIR measurements, this trend might again indicate that the white Gaussian noise jamming signal fits the model better. Using a combination of AGC and CNIR gives an intermediate performance, as shown by the green boxes in Figure 6, that is substantially better than the performance obtained when using only AGC measurements.

5.2 Varying Path Loss Values

Figure 7 shows the results obtained when the path loss exponents can be equal to a value other than 2, or to be more exact, when the path loss exponent can take a value of 2, 2.22, or 2.5. The method presented by Ahmed and Sokolova (2020) does not find a solution for any of the tested measurement models. For a varying path loss, the performance of the proposed model becomes worse. Although the median error is always lower than the median error of the method presented by Borio et al. (2016) when using the CNIR, the error shows more fluctuations. The same trend is also observed when using AGC or a combination of AGC and CNIR measurements.

Figure 7

Box plot of errors obtained when using different numbers of receivers with varying path loss and a continuous wave jamming signal.

When all 8 receivers are used, only one value is produced.

One reason for the reduced performance might be that when the path loss takes higher values, e.g., 2.5, these receivers are neglected in the joint estimation if the path loss is estimated correctly. Thus, fewer receivers are used in the estimation, which decreases performance. At the same time, higher values for α_i might increase the performance of the mean position method. With a higher path loss exponent, the interference level will be lower, and for receivers placed farther away, the interference level might fall below the detection threshold. Moreover, Figure 4 shows that the curves become slightly more flat at lower jamming levels, which can reduce the sensitivity in terms of jamming impact on the measurements. With a higher probability that receivers far from the transmitter will be neglected, the mean position will be closer to the jammer position. This trend can be seen for the green boxes in Figures 5 and 7, where the median error decreases from approximately 600 m to under 500 m, when all 8 receivers are used. However, this situation requires that the receivers be placed close to the jammer, which might not always be the case. Figure 8 shows the results for the 2-MHz jamming signal. Much like the results observed for a free line of sight, the results are better than those for the other jamming signal; in particular, the first and third quartiles are lower.

Figure 8

Box plot of errors obtained when using different numbers of receivers, with varying path loss and a white Gaussian noise jamming signal.

When all 8 receivers are used, only one value is produced.

6 FIELD TESTS

To further evaluate and test the algorithms, outdoor field tests were performed with three different commercially available mobile phones. In addition to the aforementioned Samsung Galaxy S20+, a Sony Xperia 10 III and a Xiaomi Mi 10T Pro were used to gather AGC and CNIR measurements on an open field, where a hand-held jammer was placed. These measurements, along with the estimated positions for each phone used as p_i[n], were logged by GnssLogger (van Diggelen et al., 2020).

The tests were executed in a manner similar to that of the previous software and hardware simulations. The data acquisition started with the jammer turned off, in order to obtain a good position fix and baseline AGC and CNIR levels. After approximately 2 min, the jammer was turned on and the phones began to move. The phones were moved along the trajectories shown in Figure 10(b) and Figure 11(b) by the operators, who were walking while holding the phone in their hand.

Figure 9

Measurements reported by the three different receivers and used for jammer localization. (a) Reported AGC level for each receiver, (b) Average CNIR values reported from each receiver, (c) Smoothed measurements used in the proposed algorithm.

The jammer is turned on at approximately 120 s.

Figure 10

Results from field tests in which the receivers move in a triangular motion around the jammer. (a) Box plot of errors obtained when using different numbers of samples, (b) Map showing the receivers’ paths, the jammer position, and the solutions from the two methods.

Figure 11

Results from field tests in which the receivers move in straight lines to the right of the jammer. (a) Box plot of errors obtained when using different numbers of samples, (b) Map showing the receivers’ paths, the jammer position, and the solutions from the two methods.

The AGC and CNIR levels from one scenario, where each phone moves in a triangular motion around the jammer, are shown in Figures 9(a) and 9(b), respectively. It can be seen that the reported AGC level from the Sony is not usable, reporting a value of zero most of the time. The Samsung reports noisy AGC levels, much like it did in the previous hardware tests, but the Xiaomi provides more reliable measurements. The CNIR values from all three receivers appear to be reasonable, albeit a bit noisy. To remove some noise, the smoothing method described in Section 4.2 was used. In the evaluation, CNIR values from the Samsung and Sony phones and AGC levels from the Xiaomi were used. These smoothed measurements are shown in Figure 9(c). These measurements show the usefulness of combining AGC and CNIR data in the proposed algorithm, depending on the ability of each individual type of phone.

The full scenario is divided into shorter time periods for evaluating the algorithms. Different sizes of these time frames, or windows, are tested, and for each window size, 20 different parts of the scenario are used in the evaluation. To represent movement from more receivers, one part from the beginning of the movement and one non-overlapping part from the end of the movement are used, giving a maximum of six receivers being used in the solution. The errors and the estimated jammer positions are shown in Figures 10 and 11, together with each receiver’s reported position. The proposed method is again compared with the method presented by Borio et al. (2016).

As shown in Figure 10, the proposed method performs fairly well, with a median error of a couple of meters. The method presented by Borio et al. (2016) performs better; however, the scenario is very favorable, with the receivers being spread around the jammer such that the mean receiver position is close to the jammer position. The small spread of mean positions also indicates that the receiver movement was favorable as well, with the three receivers never being on the same side of the jammer at the same time. In contrast, Figure 11 shows a scenario in which each receiver is moving on one side of the jammer. This scenario shows the problem that arises when taking the mean position as the solution, as all solutions will be placed to the right of the jammer. While the solutions obtained by the proposed method are not perfect, the solutions are not limited by the trajectories and there are no assumptions on the jammer or receiver placement. Altogether, the field test results show that the proposed algorithm works in reality, although there is certainly room for improvement and further evaluation in different setups and environments.

7 CONCLUDING REMARKS

We extended the participatory jamming detection and localization algorithm presented by Olsson et al. (2022) and Olsson et al. (2023) by using a combination of AGC and C/N₀ estimates, which was made possible by preprocessing raw AGC measurements. Furthermore, a modification to the algorithm improved the convergence rate by running the algorithm an additional time, initiating the gradient descent using only a subset of the receivers.

Hardware tests using a commercial mobile phone, a Samsung 20+, acting as the connected GNSS receiver in a participatory sensing scenario, and generating a signal with a Spirent GSS9000 GNSS simulator showed that the proposed algorithm performs better than other state-of-the-art algorithms. Hardware tests showed that the measured AGC and CNIR levels match the assumptions made for the observation model. For the presented scenario, using 6 or more receivers and C/N₀ estimates yields an error of approximately 50-60 m when there is a path loss corresponding to a free line of sight. With a varying path loss between receivers, the performance becomes worse, but the error remains well below 500 m most of the time. For receivers placed up to over 5000 m from the transmitter, the algorithm is deemed to be effective in narrowing down the search area. Using AGC measurements makes the algorithm slightly less stable, but using a combination of the two measurements gives valuable results. Two different types of jamming waveforms were tested, and the localization algorithm performed well for both types of jamming.

Field tests were conducted, showing that the proposed algorithm works in real life, although not as well as in the simulated tests. It was also shown that the measurements supplied by different models of mobile phones can be used, even if the measurements are slightly more noisy than desired and the reported positions are far from perfect. The flexibility of the proposed algorithm in using either AGC or CNIR data, depending on the type of phone, increases the potential of the algorithm for participatory jammer localization.

A topic for future work would be to further investigate the possibility of using the joint likelihood of the AGC and CNIR in individual receivers, as well as to investigate the anomalies in the AGC levels mentioned in Section 4.3. Another extension could be to develop improved observation error models for different types of jamming waveforms, as the CNIR and AGC observables behave differently depending on the jamming waveform. The models could be improved, for example, by using better fitted distributions than the Gaussian distribution and by improving the variance (and potentially higher-order moment) estimation. This work has not considered the security and privacy concerns of participatory contributors, which can be addressed by architectures such as those presented by Gisdakis et al. (2015, 2016).

HOW TO CITE THIS ARTICLE:

Olsson, G.K., Nilsson, S., Axell, E., Larsson, E.G., & Papadimitratos, P. (2026). Participatory detection and localization of a GNSS jammer. NAVIGATION, 73. https://doi.org/10.33012/navi.747

This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

REFERENCES

↵
Ahmed, N., & Sokolova, N. (2020). RFI localization in a collaborative navigation environment. CEUR Workshop Proc., 2626. https://ceur-ws.org/Vol-2626/paper1.pdf
Google Scholar
↵
Ahmed, N., Winter, A., & Sokolova, N. (2021). Low cost collaborative jammer localization using a network of UAVs. In 2021 IEEE Aerospace Conference (50100), 1-8. https://doi.org/10.1109/AER050100.2021.9438441
Google Scholar
↵
Blay, R. C., & Akos, D. M. (2018). GNSS RFI localization using a hybrid TDOA/PDOA approach. In Proc. of the 2018 International Technical Meeting of the Institute of Navigation, Reston, Virginia, 703-712. https://doi.org/10.33012/2018.15554
Google Scholar
↵
Borio, D., Gioia, C., Stern, A., Dimc, F., & Baldini, G. (2016). Jammer localization: From crowdsourcing to synthetic detection. In Proc. of the 29th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, Oregon, 3107-3116. https://doi.org/10.33012/2016.14689
Google Scholar
↵
Eryonucu, C., & Papadimitratos, P. (2022). Sybil-based attacks on Google Maps or how to forge the image of city life. In Proc. of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 73-84. https://doi.org/10.1145/3507657.3528538
Google Scholar
↵
Eryonucu, C., & Papadimitratos, P. (2024b). Detecting mobile crowdsensing sybil attackers via presence verification. In Proc. of the Sixth Workshop on CPS&IoT Security and Privacy, 118-124. https://doi.org/10.1145/3690134.3694826
Google Scholar
↵
Eryonucu, C., & Papadimitratos, P. (2024a). Security and privacy for mobile crowdsensing: Improving user relevance and privacy. In Computer Security. ESORICS 2023 International Workshops, 474-493. https://doi.org/10.1007/978-3-031-54204-6_28
Google Scholar
↵
Gisdakis, S., Giannetsos, T., & Papadimitratos, P. (2015). SHIELD: A data verification framework for participatory sensing systems. In Proc. of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks, 16:1-16:12. https://doi.org/10.1145/2766498.2766503
Google Scholar
↵
Gisdakis, S., Giannetsos, T., & Papadimitratos, P. (2016). Security, privacy, and incentive provision for mobile crowd sensing systems. IEEE Internet of Things Journal, 3(5), 839-853. https://doi.org/10.1109/JI0T.2016.2560768
Google Scholar
↵
Goward, D. (2023, April 11). Increasing GNSS interference: UK and EU warn aviation. GPS World. Retrieved January 23, 2024, from https://www.gpsworld.com/increasing-gnss-interference-uk-and-eu-warn-aviation/
Google Scholar
↵
Kraemer, I., Dykta, P., Bauernfeind, R., & Eissfeller, B. (2012). Android GPS jammer localizer application based on C/N0 measurements and pedestrian dead reckoning. In Proc. of the 25th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, TN, 3154-3162. https://www.ion.org/publications/abstract.cfm?articleID=10494
Google Scholar
↵
Liu, J., Xie, J., Zhang, X., & Wang, J. (2020). Jammer localization approach based on crowdsourcing carrier-to-noise density power ratio fusion. In China Satellite Navigation Conference, CSNC 2020 Proceedings: Volume III, 604-612. https://doi.org/10.1007/978-981-15-3715-8_54
Google Scholar
↵
Olsson, G. K., Axell, E., Larsson, E. G., & Papadimitratos, P. (2022). Participatory sensing for localization of a GNSS jammer. In 2022 International Conference on Localization and GNSS (ICL-GNSS), 1-7. https://doi.org/10.1109/ICL-GNSS54081.2022.9797031
Google Scholar
↵
Olsson, G. K., Nilsson, S., Axell, E., Larsson, E. G., & Papadimitratos, P. (2023). Using mobile phones for participatory detection and localization of a GNSS jammer. In Proc. of the 2023 IEEE/ION Position, Location and Navigation Symposium (PLANS), Monterey, CA, 536-541. https://doi.org/10.1109/PLANS53410.2023.10140088
Google Scholar
↵
Spens, N., Lee, D.-K., Nedelkov, F., & Akos, D. (2022). Detecting GNSS jamming and spoofing on Android devices. NAVIGATION, 69(3). https://doi.org/10.33012/navi.537
Google Scholar
↵
Strizic, L., Akos, D., & Lo, S. (2018). Crowdsourcing GNSS jammer detection and localization. In Proc. of the 2018 International Technical Meeting of the Institute of Navigation, Reston, VA, 626-641. https://doi.org/10.33012/2018.15546
Google Scholar
↵
Tucker, J. A., Puskar, C., Lee, C., & Akos, D. (2020). GPS/GNSS interference power difference of arrival (PDOA) localization weighted via nearest neighbors. In Proc. of the 33rd International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2020), 3550-3560. https://doi.org/10.33012/2020.17672
Google Scholar
↵
van Diggelen, F., Khider, M., Chavan, S., & Fu, M. (2020, May 27). Updated Google tools: Logging and analyzing GNSS measurements [PowerPoint slides]. The European Global Navigation Satellite Systems Agency. Retrieved January 27, 2023, from https://www.euspa.europa.eu/sites/default/files/expo/1.1_frank_van_diggelen_-_google.pdf
Google Scholar
↵
Wang, P., & Morton, Y. T. (2020). Efficient weighted centroid technique for crowdsourcing GNSS RFI localization using differential RSS. IEEE Transactions on Aerospace and Electronic Systems, 56(3), 2471-2477. https://doi.org/10.1109/TAES.2019.2917577
Google Scholar

PDF

Abstract

1 INTRODUCTION