Detection and Mitigation of GNSS Spoofing Attacks in Maritime Environments Using a Genetic Algorithm

Abstract

Due to the high reliance of daily activities on the Global Navigation Satellite System (GNSS), its security is one of the major concerns for research and industry. Most navigation and mobile-driven location-based services use GNSS to render services. Due to the low power and easy access of GNSS signals, these signals are vulnerable to spoofing and other types of attacks. Recently many GNSS spoofing attacks have been identified in road- and maritime-based environments. This study provides a technique to detect and counter the GNSS spoofing attack in the maritime environment. This technique uses the Receiver Autonomous Integrity Monitoring (RAIM) model with Least Square Estimation (LSE) and Proportional Integral Derivative (PID) Control to detect the spoofing attack. The proposed technique is based on the concept of a genetic algorithm and navigation devices, such as inertial sensors and pilot options for the ship. A case study using the AIS dataset and simulation using MATLAB and NS3 is provided to validate the performance of the proposed approach. Nine different voyages from the AIS dataset were considered to check the accuracy and performance of the proposed algorithm. The accuracy of the proposed technique was analyzed using the correctly identified attack. The result shows that the proposed technique identifies spoofing attacks with an average value of 90 percent. For result analysis the considered nine routes were traversed multiple times. Root mean square error is used to calculate the positional mismatch (error rate). Based on the combined results analysis, the average value of RMSE is 0.28. In a best-case scenario, the proposed approach provides an RMSE value of 0.009.

I. Introduction

Maritime transport (also termed a blue economy) has a huge impact on economic and social life: sea routes not only provide space for trade but also create opportunities for tourism, transport, and sailing. Coastal regions benefit greatly in economic development and Gross Domestic Product (GDP) growth from the increasing use of maritime transport. Maritime ships highly depend on digitization and informational and operational technologies for navigation purposes, and these supporting technologies are highly dependent on the internet, which makes them a potential target for cyber-attacks. According to the World Economic Forum's Global Risks Report 2020 and 2021, cyber risk is among the top ten risks, and the security of ships and associated risks ranked fifth in the 2020 report. According to a Maritime Insight report, cyber-attacks on ships increased 900 times in the last three years, and denial of operational technology is the primary risk associated with any cyber-attack intended for maritime machinery.

Due to weak GNSS signals, a small interference source can easily spoof GNSS signals with false data. Deliberate failure of the GNSS signal by replacing it with a false signal is known as spoofing. GNSS spoofing and jamming are among the operational technology attacks that ships have faced for years: spoofed signals cause the wrong estimation of position and subsequently take the shipping vessel onto the wrong path, and GNSS spoofing can have severe consequences, even economic losses. In recent years there have been many spoofing and jamming attacks on maritime transport, such as the Black Sea and Malacca Strait attacks. Most existing spoofing detection and mitigation techniques are based on signal characteristics and cryptography, which are totally based on hardware devices, so their performance was directly dependent on the associated hardware and signal characteristics, and hardware-based spoofing detection techniques may become obsolete with time and technological upgrades.

Due to the low power and easy access of GNSS signals, these signals are vulnerable to spoofing and other types of attacks, and most detection and mitigation algorithms in maritime environments use the concept of cryptography, signal interference, and hardware devices, while very few studies are based on software-based solutions. In this study, an attempt was made to detect and mitigate a GNSS spoofing attack using genetic algorithms: a software-based approach to detect and correct any spoofing attack could potentially help in mitigating spoofing attacks, and software-based solutions are much easier to upgrade, fine-tune, and customize than any hardwired system. We propose an approach that uses an auxiliary navigation component with Receiver Autonomous Integrity Monitoring and a genetic algorithm to detect and mitigate the GNSS spoofing attack. The novel contributions of this study are: GNSS spoofing detection using RAIM and PID, GNSS spoofing mitigation using a genetic algorithm, and use of the Dynamic Time Warping (DTW) algorithm with sensor reading and rudder angle for the fitness function.

II. Literature Survey

GNSS spoofing and security gained attention due to the increased dependence of human activities on GNSS: low power, public accessibility, and easy usage of GNSS signals make it possible for low-power interface devices to easily jam or spoof GNSS signals. Warner and Johnson undertook the first experiment to detect GNSS spoofing using the GS720 satellite in on-road navigation [13], and subsequently many techniques were designed to detect and counter spoofing attacks. Spoofing detection techniques are categorized into four parts: cryptographic approaches using the Pseudo-Random Noise (PRN) code and secret keys [14–16], signal-feature-based approaches such as signal strength, components, phase alignment, nulling, and the correlation function with clock bias or Automatic Gain Control (AGC) values [17–19], auxiliary-navigation-based approaches using Position, Velocity and Time (PVT) with Wi-Fi, inertial sensors, and cellular systems [20–23], and spatial- and geometrical-based approaches such as the number of satellites, signal direction and count, or angle of arrival [24–26]. Alongside additional hardware, signal encryption, spectrum security, and authentication methods, GNSS signal interference was identified using signal strength, distance correlation matrix, and frequency modulation techniques [15, 16] — all hardware-, frequency-, and transition-mode-based techniques.

Anomalies in ship movement were identified using trajectory data and patterns: ship trajectories were considered a predictor of wrong vessel movement and anomalies in ship-selected routes were recorded [24], and ship type, number of stoppages, speed, and movement pattern were also used to identify trajectory anomalies [28]. Maritime authorities use AIS to manage ship movements and identify locations based on transmitted information (such as speed, type, and number), and due to the open, self-reporting nature of AIS, many ship spoofing activities were based on the AIS system, so the research community developed many AIS-based spoofing detection techniques based on RADAR data, distance calculation, AIS position estimation, speed, and AIS data emission patterns [29–34]. The key challenges and research gaps are: differentiating a true GNSS spoofing attack from diversion from the actual path due to calculation errors, the reliance of most techniques on signal behaviors, geometrical/spatial features, and cryptography, and the auxiliary-navigation-component approach using additional navigation devices such as cellular networks, Wi-Fi, and inertial sensors. In this experiment, GNSS spoofing detection and mitigation were done with two procedures: detection using RAIM and inertial sensors, and mitigation using AIS data, the current system state, and a genetic algorithm.

III. Proposed Approach

The proposed approach uses an auxiliary navigation component with Receiver Autonomous Integrity Monitoring (RAIM) and a genetic algorithm to detect and mitigate the GNSS spoofing attack. The steps begin with data preparation: Automatic Identification System (AIS) data, sensor readings, ship data, and source and destination points. AIS data provides the details of available ship tracks in maritime environments, and ships have integrated bridge systems for navigation, routing, and surveillance at sea, comprising pilot options, data sources, sensors, and inertial data sources. Data sources comprise spatial elements like GPS, Automatic Radar Plotting Aid (ARPA), and AIS: GPS provides the real-time location of the ship, ARPA processes radar data to avoid collisions, and AIS provides a map to the ship and lets it adjust speed, heading, and rudder angle. Sensor data includes the compass, gyroscope, inertial sensor, and dead reckoning: compass and gyroscope identify direction and position from longitude and latitude information, inertial sensors and dead reckoning identify the ship's relative position and provide position estimation in the absence of GPS, while climate sensors provide weather and climate information.

Spoofing detection uses the RAIM model with PID control. The RAIM model assesses the integrity of the GNSS signal in maritime and aviation environments, using the pseudo-range measurement of GNSS signals received from different satellites to identify faults. The model computes various position fixes corresponding to available GNSS signals and, based on these fixes and the pseudo-range, identifies faulty GNSS signals; it needs a minimum of five satellite signals to check GNSS signal integrity. PID is a loop- and feedback-based control mechanism used to identify the error rate by continuously monitoring the measured and desired values of the parameters, and based on the identified error rate it controls the error and changes the system using proportional, derivative, and integral gain.

Spoofing mitigation uses the proposed algorithm based on the concept of genetic algorithms, whose core is the fitness function: it uses the location of the spoofing detection point, the location of the recent GNSS receiver set point, route information, the Dynamic Time Warping (DTW) algorithm, and rudder and heading information. The genetic algorithm was originally developed for optimality problems, but it can provide the correct route after detecting the spoofing attack. DTW compares two time-variant data series, finding the distance between all points of the two series; a cost function identifies the similarity between two points, and an accumulative matrix calculates the global cost of the two time series, where a lower global cost signifies greater similarity. For the spoofing scenario, the ship trajectory and the planned route act as the data series, with each location in both series acting as data points for the DTW.

IV. System Description and Methodology

Ships have integrated bridge systems for navigation, routing, and surveillance in maritime environments, comprising pilot options, data sources (GPS, ARPA, AIS), sensors (compass, gyroscope, climate sensor, inertial sensor, dead reckoning), and inertial data sources. Ship dynamic model and track information are very important for spoofing detection, and the Nomoto model was considered to model the ship's dynamics for position estimation and anomaly detection. According to the simple Nomoto model, ship dynamics (Equation 1) are described with variables such as the ship time constant (Sc), turn rate in radians per second (Tr), helm rudder gain (Rg), rudder angle (θ), and environmental disturbances (EN). Equation (2) describes environmental disturbances as a Poisson process, where n is a random variable for events in time interval T and λ is the rate parameter. Ship headings follow the kinematics in Equations (3)–(5), where h is the heading in radians, Tr the turn rate, N and M the north and east positions, V the velocity in meters per second, and EN, EM the drift errors from environmental conditions, water flow, and other disturbances. The ship is directed in autopilot mode to control heading and course: autopilot uses the PID law to maintain the required heading angle (hr), and Equation (6) suppresses noise and controls the rudder angle θt at time t. With ηc as the Nomoto constant, η the natural frequency, ξ the relative damping ratio, and Sc the ship time constant, Equations (7)–(9) calculate the integral (Ai), proportional (Ap), and derivative (Ad) gains for ship motion.

Course and track can be managed by direct human or mechanical methods using the course autopilot in the outer control loop. The ship's position at sea relative to the global position is estimated from heading angle, start position, and distance covered, and Equations (10) and (11) calculate the along-track (ATP) and cross-track (CTP) positions, where N0 and M0 are the global start position, M and N the ship's current position, and θ0 the rudder angle with respect to N0 and M0. CTP readings together with GNSS readings feed the PID feedback mechanism for position estimation. Using Equation (12), the required heading angle (hr) is optimized with PID, GNSS, and CTP(t) at time t, where hr(t) is the optimized required heading angle, Ai′ the integral gain, e(τ) the GNSS readings, d(τ) the derivative variable, and A′p the PID proportional gain. Under the least square estimation algorithm, the state vector and mapped GNSS fix depend on CTP(t), so CTP(t) is further used to identify spoofing detection.

The GNSS spoofing detection technique uses the stated terms and cumulative values of inertial sensors, pilot options, and GNSS receiver output to identify the spoofing attack. Deviation from the actual route cannot always be a spoofing attack — it may stem from calculation and processing errors. Detection rests on two hypotheses: H0 (null) means normal operation of the routing algorithms, where minor path deviation may come from position estimation error; H1 (alternate) means routing behavior differs strongly from normal operating conditions, where deviation is not due to position estimation error but to other causes — considered a spoofing attack. The attacker is assumed to divert the ship with a minor CTP shift at limited speed and rudder angle to mislead it. After time t, a spoofing detection test runs on LSE RAIM readings: at t = 0 the null hypothesis holds, but over time an attacker may launch the attack and shift the situation from H0 to H1. Under LSE RAIM, spoofing is identified with the residual vector (RV) and attack statistic q (Equations 13–14). RV depends on inertial sensor and GNSS readings, and the weighted position estimate uses CTP readings. If Tδ is the threshold for identifying the spoofing attack against q, then Tδ < q keeps H0 true and Tδ ≥ q makes H1 true. The GNSS receiver continuously provides location readings and state information over time interval t: H0 is centrally chi-square distributed under non-spoofing conditions, while H1 is inverse non-centrally chi-square distributed under both spoofing and non-spoofing conditions.

V. Simulation and Result Analysis

This section gives the experimental details of the proposed GNSS spoofing detection and mitigation algorithm. MATLAB and the Network Simulator (NS-3) simulated GNSS spoofing, maritime traffic, and routing. The Simulink tool with MATLAB modeled the ship's environment, plus MATLAB's Sensor Fusion and Tracking Toolbox for inertial sensors and GNSS. Sea Clutter Simulation set the physical sea environment variables, including wave speed, slope and height, wind speed, and more. Spoofing attack and detection calculations were simulated with Monte Carlo simulations. Signal carrier and baseband frequencies were 2.4 GHz with biases of 400 Hz and 1.5 kHz respectively. Ship speed was kept at 1–15 knots. Sea disturbances were generated by Monte Carlo simulation on a Poisson distribution from 3 km/h to 100 km/h. Sensor and GNSS readings established the Nomoto ship movement model, RAIM environment, and cross-track spoofing attack. The complete MATLAB simulated environment was integrated with NS-3 for ship movement. A ship course was created using the AIS dataset, with route nodes based on AIS course data. MATLAB-produced sea environment data was read as data files in NS-3 for sea conditions and location information. Nine different voyages (Table 3) from the AIS dataset tested the proposed algorithm. AIS details were processed with the JOSM tool to set map-specific variables.

Accuracy depends on factors like positional accuracy of ship position, error attribution to normal vs. spoofed conditions, diversion error from the predefined route, spoofing detection, and mitigation. The following metrics analyzed correctly identified attacks and mitigation: the Ratio of Correct Detection (RCD) — correctly identified attacks over total launched attacks (Equation 15), where I is correctly identified attacks and N total launched attacks; Average Positional Error (APE) — the average difference between the proposed route and the obtained route after mitigation (Equation 16), where SV are points on the proposed route and OP points on the obtained route; positional accuracy via Root Mean Square Error (RMSE), Normalized Mean Square Error (NMSE), Mean Error (ME), and Per Point Positional Error (PPPE); PPPE — the difference between the obtained and actual ship positions for the selected course (Equation 17); ME, RMSE, and NMSE for trajectory T (Equations 18–20); and the covariance matrix, giving the covariance between two random variables, here used to separate true error from spoofed error.

Nine AIS-based routes tested the proposed approach. Spoofing attacks were launched with the Monte Carlo technique and simulated with NS-3 and MATLAB; RCD and APE scores per route are in Table 4. RCD measures true-attack detection efficiency: its maximum is 1 (100 percent detection). Across the nine routes, traversal ran in simulation with random attacks launched; the minimum RCD was 0.75 and the average 0.90 — on average 90 percent of attacks were correctly identified. APE measures the difference between the actual route and the post-mitigation route, and the genetic-based approach gives the best path with an average error of 1605.3 m given traffic and sea environment, with 3816 m deviation in the worst case. For positional accuracy, mapping the ship's location on a digital map was analyzed with mean error, RMSE, and NMSE. Maximum RMSE was 0.7, minimum 0.009, and the cumulative average RMSE 0.28, with peak positional error under high environmental disturbance volumes. NMSE showed that repeated traversal barely improves the error rate — error rates are independent of traversal time and depend entirely on positional parameters. The covariance matrix identified route deviation caused by spoofing, cleanly separating spoofing error from true positional error via the error-bound parameter (Equation 21) under both high- and low-intensity attacks. Table 5 compares the technique with the state of the art: the MFMC receiver (best/worst RMSE 0.5 m and 13.27 m), orthogonal matching pursuit (maximum DOA RMSE of 1 degree), modified MUSIC (no qualitative detection-accuracy metrics), the DOA/elevation/azimuth method (identifies spoofing but with high detection time), and the proposed genetic-algorithm technique (cumulative RMSE 0.28, best-case 0.009). The main limitation is the lack of real environmental variables and weather conditions: although variables were added via a Markov process, they remain far from the real situation.

VI. Conclusions

We presented a GNSS spoofing detection and mitigation technique using the concept of genetic programming. The technique uses an auxiliary navigation component with Receiver Autonomous Integrity Monitoring and a genetic algorithm to detect and mitigate the GNSS spoofing attack. Spoofing is detected using RAIM and inertial sensors. Along-track and off-track points checked diversion from the actual route. The techniques also follow the PID concept to differentiate spoofing from normal diversion. This counter-spoofing technique uses AIS data, the current system state, and a genetic algorithm to provide the correct route. Genetic algorithms solved the optimality problem, and here the genetic algorithm optimally selects the complete optimal path. MATLAB and NS-3 validated the technique by simulating GNSS spoofing; Sea Clutter and Simulink with MATLAB modeled the ship's environment. A ship course was created with the AIS dataset, and nine different routes tested the proposed algorithm. On average the technique gives 90 percent spoofing-detection accuracy. Route mapping error via RMSE averages 0.28, with 0.009 in the best case. Average positional error was 1605.3 m. The effect of spoofing intensity was analyzed with the covariance matrix, and the approach handles both low- and high-intensity attacks. A genetic algorithm with sensor data can mitigate GNSS spoofing attacks in the maritime environment.

In the future, this technique can be implemented in real-time situations. Additionally, the detection technique can be improved by using only along-track points.