KR102163698B1 - Method for detecting GPS SPOOFING signal of small UAVs and apparatus thereof - Google Patents

Abstract

According to an embodiment of the present invention, a data receiving step of receiving GPS data of a small unmanned aerial vehicle that satisfies a preset standard; A preprocessing step of preprocessing the received GPS data; A learning step of configuring the pre-processed GPS data into four channels for signal time and signal strength and inputting it to a neural network model to learn; A test input step of preprocessing and inputting new GPS data into the learned neural network model; And a signal discrimination step of determining whether the new GPS data is a spoof signal based on a result output from the learned neural network model.

Description

TECHNICAL FIELD [Method for detecting GPS SPOOFING signal of small UAVs and apparatus thereof]

The present invention relates to a method and apparatus for detecting a GPS deceptive signal of a small unmanned aerial vehicle, and more specifically, by detecting various deceptive attacks that may be performed by a small unmanned aerial vehicle, it is helpful to prevent the small unmanned aerial vehicle from falling or deviating from a predetermined path. It relates to a method and a device that can be given.

Unmanned Aerial Vehicle (UAV) is being used in various defense missions, including surveillance and reconnaissance missions, thanks to advances in flight control and autonomous algorithms, and its scope is gradually expanding. In line with this trend, most of the research on drones is focused on increasing the utility of drones. However, since the UAV does not have a separate pilot, it is vulnerable to attacks from the outside, and if it is attacked, it is difficult to adequately cope with it, so that it may be impossible to perform a normal mission as soon as it is attacked. A typical example is an attack on satellite navigation, such as GPS disturbance and deception attacks.

In order to cope with such an attack, it is necessary to be able to judge a satellite navigation attack. In the case of a GPS disturbance attack, it is not difficult to detect the attack because the GPS signal is not captured, and it can be dealt with by using an alternative navigation method.

On the other hand, in the case of a GPS deception attack, it is difficult to detect whether a deceptive signal is due to receiving a deceptive signal similar to a real signal. As a result, if the UAV uses the wrong navigation, it may cause the mission to fail. Therefore, it is essential to study the technology for detecting deceptive signals by drones.

In particular, in the case of a small unmanned aerial vehicle with a weight of about 30 kg represented by a quadcopter, a GPS deceptive device (GPS simulator) that can be obtained simply and easily can deceive GPS signals to manipulate location information. This is a great threat not only to civilians using small UAVs, but also to the military to operate drone bots in future battlefields.

However, in order to apply the existing deception detection technology to a small UAV, the cost is excessive because a certain amount of payload and energy consumption are required, such as attaching additional hardware, and physical numerical measurements are made for the stable flight of the small UAV. There is a problem to have to do it again.

1.U.S. Patent Publication No. 2019-0260768 (2019.08.22) 2. Korean Patent Application Publication No. 10-2019-0065037 (2019.06.11)

The technical problem to be solved by the present invention is a method of accurately detecting and responding to GPS deception signals without attaching additional hardware to a small UAV weighing 30kg or less, as a part of improving the deception detection technology of the existing small UAV. It is to provide an apparatus for implementing the method.

A method according to an embodiment of the present invention for solving the above technical problem includes a data receiving step of receiving GPS data of a small UAV that satisfies a preset standard; A preprocessing step of preprocessing the received GPS data; A learning step of configuring the pre-processed GPS data into four channels for signal time and signal strength and inputting it to a neural network model to learn; A test input step of preprocessing and inputting new GPS data into the learned neural network model; And a signal discrimination step of determining whether the new GPS data is a fraudulent signal as a result output from the learned neural network model.

An apparatus according to another embodiment of the present invention for solving the above technical problem includes: a data receiving unit for receiving GPS data of a small unmanned aerial vehicle that satisfies a preset standard; A data preprocessor preprocessing the received GPS data; A data learning unit that configures the preprocessed GPS data into four channels for signal time and signal strength, and inputs it to a neural network model for training; A data testing unit for preprocessing and inputting new GPS data into the learned neural network model; And a signal discriminating unit for determining whether the new GPS data is a spoofing signal as a result output from the learned neural network model.

An embodiment of the present invention discloses a computer-readable recording medium storing a program for executing the method.

According to the present invention, it is possible to accurately detect a GPS deceptive signal by analyzing GPS data without adding any hardware configuration to a small UAV.

In addition, according to the present invention, the small unmanned aerial vehicle does not stop accurately detecting the GPS deceptive signal, and is not affected by the detected GPS deceptive signal, thereby minimizing the frequency in which the small unmanned aerial vehicle deviates from a set route or falls to land. There will be.

1 is a block diagram showing an example of a fraudulent signal detection apparatus according to the present invention.
2 is a diagram intuitively illustrating a GPS deceptive attack scenario that can be applied to a small UAV.
3 schematically shows the process of pre-processing GPS deception detection learning data.
4 schematically shows an example of a process in which a data learning unit learns a one-dimensional convolutional neural network model according to the present invention.
5 schematically shows a process of inputting real-time GPS data to a learned one-dimensional convolutional neural network model.
6 is a flowchart showing an example of a method for detecting a spoof signal according to the present invention.

As for terms used in the embodiments, general terms that are currently widely used as possible are selected while considering functions in the present invention, but this may vary according to the intention or precedent of a technician working in the field, the emergence of new technologies, and the like. In addition, in certain cases, there are terms arbitrarily selected by the applicant, and in this case, the meaning of the terms will be described in detail in the description of the corresponding invention. Therefore, the terms used in the present invention should be defined based on the meaning of the term and the overall contents of the present invention, not a simple name of the term.

When a part of the specification is said to "include" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, terms such as "... unit" and "... module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. However, the present invention may be implemented in various forms and is not limited to the embodiments described herein.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the drawings.

1 is a block diagram showing an example of a fraudulent signal detection apparatus according to the present invention.

Referring to FIG. 1, a deception signal detection apparatus 10 according to the present invention includes a data receiving unit 110, a data preprocessing unit 130, a data learning unit 150, a data testing unit 170, and a signal discriminating unit 190. ). As described above, the spoofing signal detection apparatus 10 according to the present invention may be physically or logically included in a small unmanned aerial vehicle to perform its function. Hereinafter, after a comprehensive description of each component (block) constituting the spoofing signal detection apparatus 10, a function of each component will be described in detail with reference to FIGS. 2 to 5.

The data receiving unit 110 performs a function of receiving GPS data of a small unmanned aerial vehicle. Here, the small UAV is assumed to be an example of a general quadcopter (drone) as an unmanned aerial vehicle that is more than a certain weight or lighter than a certain amount of 30kg. Depending on the size of the unmanned aerial vehicle, there are also unmanned aerial vehicles of the same level as or higher than that of an aircraft capable of carrying hundreds of people, but in the present invention, in order to accurately use the characteristics of the GPS signal, for detecting a deceptive attack of a small unmanned aerial vehicle having a weight in the aforementioned range Suggest a method.

2 is a diagram intuitively illustrating a GPS deceptive attack scenario that can be applied to a small UAV.

Referring to FIG. 2, after a signal transmitted from a GPS satellite is received not only by a small unmanned aerial vehicle but also by a GPS deceptive, the deceptive signal generated from the GPS deceptive is transmitted to the small unmanned aerial vehicle through an RF transmitter. It will not work normally.

Meaconing and spoofing are the methods of deceptive attacks that can be applied to small UAVs. Meconing is an attack in which a satellite navigation signal is delayed for a certain time and then re-emitted using a device that collects and reproduces GPS raw data. Meconing transmission signals are classified as asynchronous attacks in the time domain, and when the receiver is in the signal tracking state, the receiver only tracks the synchronized signal, so to succeed in deception, jamming is used to induce re-signal acquisition. Should be.

On the other hand, spoofing is an attack in which a synchronized signal similar to a true signal is generated and emitted through a deceptive device based on an external reference receiver. The spoofed transmission signal is classified as a synchronous attack method in the time domain, and deception can succeed even when the receiver is in a signal tracking state. Of course, in order to succeed in deception, it is necessary to know the location of the small UAV within a specific error and synchronize it with the transmitted signal.

According to the present invention, it is possible to detect all the deception signals of the above-described meconing and spoofing attack methods, and a specific method will be described below.

The data preprocessor 130 preprocesses the received GPS data. More specifically, the data preprocessing unit 130 performs the main function of enabling the device according to the present invention to accurately detect fraud without adding additional hardware in an existing known system, and effectively performs deep learning to be described later. It performs the function of appropriately processing the received GPS data so that reasonable results can be obtained.

NMEA class data TPV Position, speed, time, and error SKY PRN ID, signal strength, satellite orbit, whether to use calculation

Table 1 shows data acquired in the NMEA-0183 interface format commonly used in small unmanned aerial vehicle GPS receivers. The present invention uses only a single antenna and a single receiver for GPS fraud detection, minimizing energy consumption and loading weight, which are factors that directly affect the flight time of a small UAV, while dramatically improving the fraud detection function, as shown in Table 1. Only data acquired in the GPS NMEA interface format is used.

The data preprocessor 130 pre-processes the data in the GPS NMEA format as learning data. In order to use the GPS data as learning data, the data preprocessor 130 extracts time from the TPV of the NMEA class and processes it as time_offset. The time_offset refers to the difference between the GPS time received from the satellites (atomic clocks located on satellites) and the UTC (universal time on computer) time of the embedded computer. When an unsynchronized signal such as MEKONING is received by the data receiving unit 110, the difference between the GPS time and the UTC time increases, so that the unsynchronized deceptive signal in the time domain can be detected through time_offset.

However, when the data receiving unit 110 receives a synchronized spoofing signal, such as spoofing, the spoofing signal cannot be detected by only time_offset. The data preprocessing unit 130 extracts signal strength (SNR) values of satellites used for GPS fix from SKY of the NMEA class, and processes them into snr_mean, snr_range1, and snr_range2, respectively.

Learning data time_offset: time(GPS)-time(UTC)
※ time(GPS): atomic clocks located on satellites
※ time(UTC): coordinated universal time on computer snr_mean: mean(snr)
snr_range1: max(snr)-min(snr)
snr_range2：standard_deviation(snr)
※ snr: list(snrs of GPS satellites used in fix)

Table 2 shows the results of the data preprocessing unit 130 processing the GPS NMEA interface format data received by the data receiving unit 110 into learning data. In Table 2, time_offset refers to the difference between the GPS time of the satellite and the UTC time of the embedded computer, as a component used to detect the Meaconing and Spunning spoofing signals, and is information about the signal time, snr_mean, snr_range1 and snr_range2 are elements used to detect spuning spoofing signals and mean information on signal strength.

In particular, snr_mean is the average signal strength of the satellite signal, snr_range1 is the difference between the maximum and minimum values of the satellite signal, and snr_range2 is the standard deviation of the strength of the satellite signal. The three factors above are that the spoofing spoofing signal generated by a general spoofing simulates the signal strength of each satellite more strongly than the true signal, and the characteristic that the pattern of the signal strength between satellites fluctuates according to the spoofing clock and software characteristics. As an element to reversely use having, it is possible to effectively detect a synchronized deception signal.

After extracting the four elements from the GPS signal as described above, the data preprocessor 130 additionally processes data to use a neural network model, which is a kind of deep learning.

3 schematically shows the process of pre-processing GPS deception detection learning data.

The left side of FIG. 3 is a diagram in which four elements processed and extracted by the data preprocessor 130 are arranged in a time series, and shows a process of window slicing with the same window width. The right side of FIG. 3 schematically shows a process in which the four elements, which have been window-sliced, are rearranged in the L direction, which is the data length, according to the temporal order.

When four elements related to the signal time and signal strength of GPS data are extracted by the data preprocessor 130 as shown in Table 2, the data preprocessor 130 stores time_offset, snr_mean, snr_range1 and snr_range2, and more than four learning data. Each of them is cut in chronological order by a specific window width through window slicing, and the corresponding data is labeled as '0' if it is a true signal and as '1' if it is a deception signal. The training data labeled above is classified as a channel in the learning process and input to the neural network model. Referring to FIG. 3, for example, the elements extracted by the data preprocessor 130 are rearranged for each element after being cut to the width of the window (sliced) to form a channel, so an input value input to the neural network model (learning data ) Are data consisting of four channels labeled with a number of 0s or 1s.

Here, the wider the window width is, the more data can be used to determine whether to be deceived, but there is a disadvantage in that the detection time becomes longer. An appropriate window width can be selected by integrating the above three, the performance of the processor installed in the small UAV, the operation method, and the countermeasure after fraud detection. As an example, if the present invention aims to detect deception within 3 seconds in the operation of a small UAV, a window width that can include 6 to 9 ticks based on 2 to 3 pps (pulse per second) GPS data Can be selected. In addition to the above example, it will be apparent that a person skilled in the art can variously set the window width in order to induce reasonable results.

After the data preprocessing unit 130 processes the GPS data into preprocessed training data through the process as shown in FIG. 3, the data learning unit 150 inputs the preprocessed data to the neural network model to learn the data.

4 schematically shows an example of a process in which a data learning unit learns a one-dimensional convolutional neural network model according to the present invention.

In the present invention, the GPS deception detection algorithm is learned by a 1-dimension convolution neural network model. In general, a convolutional neural network is mainly used to classify images in two dimensions, but in the present invention, the convolutional neural network is used to analyze time series data by lowering the dimension of the convolutional neural network.

Referring to FIG. 4, it can be seen that time_offset, snr_mean, snr_range1, and snr_range2 each have a length equal to the window width through a preprocessing process as shown in FIG. 3. This multivariate fraud detection time series data is input to a one-dimensional convolutional neural network through four channels, and features are learned by a multi-filter in the convolution layer. When a feature is learned, the kernel extracts a feature vector while moving the input data in one direction, and this process is independently performed for each channel. In the present invention, since data input to a one-dimensional convolutional neural network is composed of four channels for signal time and signal strength, a process of independently extracting feature vectors from each of the four channels is performed.

Thereafter, the feature vectors extracted for each channel go through a pooling layer that reduces the data size. The process of going through the convolutional layer and the pooling layer can be repeated or transformed to increase model accuracy, and the subsequent learning model model is a general neural network model, flattened, fully connected layer, and classification. ), and the learning process usually proceeds.

The data learning unit 150 performs the function of learning the one-dimensional convolutional neural network model described in FIG. 4, and the neural network model that has been trained is the same time point as the GPS data or the training data received at a different time point than the training data. By receiving the GPS data received by the GPS satellite, it is possible to determine whether the received GPS data signal is a deceptive signal or a true signal.

5 schematically shows a process of inputting real-time GPS data to a learned one-dimensional convolutional neural network model.

The learned one-dimensional convolutional neural network model is mounted on an embedded computer of a small unmanned aerial vehicle, and GPS deception is detected through an inference process as shown in FIG. 5. The real-time GPS data obtained from the data receiving unit 110 is processed into time_offset, snr_mean, snr_range1 and snr_range2 in an embedded computer, and the processed data is input to a one-dimensional convolutional neural network model that has been trained. In this process, it will be apparent to those of ordinary skill in the art that the newly received GPS data before being input to the 1D convolutional neural network model can be preprocessed by the data preprocessor 130 described above. That is, the deception signal detection device 10 described in FIG. 1 may be physically or logically mounted on the embedded computer of a small unmanned aerial vehicle, and the learned one-dimensional convolutional neural network model additionally learns GPS data accumulated over time. You may.

The data testing unit 170 controls the kernels corresponding to the multiple filters within the window from the learned one-dimensional convolutional neural network model to move in one direction to extract features of the input data, and the extracted features are used for neural network classification. They are classified into signals and deceptive signals. At this time, the learned one-dimensional convolutional neural network model has the same window as when the training was performed, and the features of the new GPS data input to the learned one-dimensional convolutional neural network model are extracted by receiving a command from the data testing unit 170 Make it possible.

Finally, the signal determination unit 190 receives the result output from the data testing unit 170 and undergoes an inference process, and through the inference process, the small UAV determines whether the signal being received by the GPS receiver is a true signal or a deceptive signal. can do. 5, the signal discrimination unit 190 extracts features of input data while the kernels corresponding to the multiple filters in the window move in one direction, and the result of the neural network classification is “0000111100”, the data receiving unit It can be determined that the true signal is continuously being received at (110), the deceptive signal is received for a while, and then the true signal is continuously received.

As in the present invention, if GPS deception detection is learned based on the learning data in Table 2 and the learning model in FIG. 4, it is possible to implement a data-based deception detection algorithm without mathematical modeling. In addition, through the convolutional layer and the pooling layer in the learning model, it is possible to learn the shape characteristics of the input signal in the neural network model and reduce the variability of the spatial position. Thus, according to the present invention, it is possible to detect a deceptive signal by classifying a nonlinear pattern of a signal with high accuracy.

6 is a flowchart showing an example of a method for detecting a spoof signal according to the present invention.

Since the method according to FIG. 6 can be implemented by the deceptive signal detection apparatus 10 according to FIG. 1, it will be described below with reference to FIG. 1, and a description overlapping with the content described in FIG. 1 will be omitted. do.

First, the data receiving unit 110 receives GPS data (S610).

The data preprocessing unit 130 preprocesses the received GPS data to be used as learning data (S620).

The data learning unit 150 controls the pre-processed data to be inputted to the 1D convolutional neural network model through 4 channels to be trained (S630).

The data testing unit 170 controls to input new GPS data separate from the learned GPS data into the learned deception detection model, and when the input GPS data features are extracted, the extracted features are transmitted to the signal discrimination unit 190 Do (S640).

The signal determining unit 190 receives the output of the data testing unit 170 and finally determines whether the new GPS data signal is a true signal or a deceptive signal (S650).

The present invention detects GPS fraud based on data obtained in a GPS NMEA interface format without the use of a single antenna and a single receiver and additional modification of receiver hardware and firmware. Through this, GPS deception detection technology can be applied to small unmanned aerial vehicles as it is not affected by energy consumption and loading weight over a certain amount required by the existing deception detection method.

In addition, by processing the obtained GPS NMEA data into time_offset, snr_mean, snr_range1, and snr_range2, which are GPS fraud detection learning data, both unsynchronized fraudulent signals such as Meaconing and synchronized spoofing signals can be detected.

In addition, by learning a deception detection algorithm with GPS deception learning data, it is possible to implement a data-based deception detection algorithm without mathematical modeling.

In addition, by designing a one-dimensional convolutional neural network structure in the GPS deceptive detection learning model, learning the shape features of the input signal through the convolutional layer and the pooling layer, and mitigating the variability of the spatial position, with high accuracy even for nonlinear patterns of signals. It can be classified to detect deceptive signals.

The embodiment according to the present invention described above may be implemented in the form of a computer program that can be executed through various components on a computer, and such a computer program may be recorded in a computer-readable medium. In this case, the medium is a magnetic medium such as a hard disk, a floppy disk, and a magnetic tape, an optical recording medium such as a CD-ROM and a DVD, a magneto-optical medium such as a floptical disk, and a ROM. A hardware device specially configured to store and execute program instructions, such as, RAM, flash memory, and the like.

Meanwhile, the computer program may be specially designed and configured for the present invention, or may be known and usable to those skilled in the computer software field. Examples of the computer program may include not only machine language codes produced by a compiler but also high-level language codes that can be executed by a computer using an interpreter or the like.

The specific implementations described in the present invention are examples, and do not limit the scope of the present invention in any way. For brevity of the specification, descriptions of conventional electronic configurations, control systems, software, and other functional aspects of the systems may be omitted. In addition, the connection or connection members of the lines between the components shown in the drawings exemplarily represent functional connections and/or physical or circuit connections. It may be referred to as a connection, or circuit connections. In addition, if there is no specific mention such as “essential” or “importantly”, it may not be an essential component for the application of the present invention.

In the specification of the present invention (especially in the claims), the use of the term “above” and a similar reference term may correspond to both the singular and the plural. In addition, when a range is described in the present invention, the invention to which an individual value falling within the range is applied (unless otherwise stated), and each individual value constituting the range is described in the detailed description of the invention. Same as Finally, if there is no explicit order or contrary to the steps constituting the method according to the present invention, the steps may be performed in a suitable order. The present invention is not necessarily limited according to the order of description of the steps. The use of all examples or illustrative terms (for example, etc.) in the present invention is merely for describing the present invention in detail, and the scope of the present invention is limited by the above examples or illustrative terms unless limited by the claims. It does not become. In addition, those skilled in the art can recognize that various modifications, combinations, and changes may be configured according to design conditions and factors within the scope of the appended claims or their equivalents.

Claims (9)

A data receiving step of receiving GPS data of a small unmanned aerial vehicle that satisfies a preset standard;
A preprocessing step of preprocessing the received GPS data;
A learning step of configuring the pre-processed GPS data into four channels for signal time and signal strength and inputting it to a neural network model to learn;
A test input step of preprocessing and inputting new GPS data into the learned neural network model; And
Including; a signal discrimination step of determining whether the new GPS data is a deceptive signal as a result output from the learned neural network model,
The four channels,
It includes one channel composed of the difference between the GPS time received from the satellite and the UTC time of the computer and three channels composed of information processed based on the signal strength of the satellites,
The data of the four channels input to the neural network model,
A method for detecting a GPS spoof signal of a small unmanned aerial vehicle, characterized in that it is sliced to a width of a window including 6 to 9 ticks for each channel and input to the neural network model. The method of claim 1,
The neural network model,
GPS deceptive signal detection method of a small unmanned aerial vehicle, characterized in that it is a 1-dimension convolution neural network. The method of claim 1,
The GPS data,
GPS deceptive signal detection method of a small unmanned aerial vehicle, characterized in that the GPS NMEA interface format data. delete A computer-readable recording medium storing a program for executing the method according to any one of claims 1 to 3. A data receiving unit for receiving GPS data of a small unmanned aerial vehicle that satisfies a preset standard;
A data preprocessor preprocessing the received GPS data;
A data learning unit that configures the preprocessed GPS data into four channels for signal time and signal strength, and inputs it to a neural network model for training;
A data testing unit for preprocessing and inputting new GPS data into the learned neural network model; And
Including; a signal discrimination unit for determining whether the new GPS data is a deceptive signal as a result output from the learned neural network model,
The four channels,
It includes one channel composed of the difference between the GPS time received from the satellite and the UTC time of the computer and three channels composed of information processed based on the signal strength of the satellites,
The data learning unit,
GPS deceptive signal detection apparatus for a small unmanned aerial vehicle, characterized in that the data of the four channels are sliced to the width of a window including 6 to 9 ticks for each channel and input to the neural network model. . The method of claim 6,
The neural network model,
GPS deceptive signal detection device for a small unmanned aerial vehicle, characterized in that it is a 1-dimension convolution neural network. The method of claim 6,
The GPS data,
GPS deception signal detection device of a small unmanned aerial vehicle, characterized in that the data in a GPS NMEA interface format. delete

Images