Crowd-GPS-Sec: Leveraging Crowdsourcing to Detect and Localize GPS Spoofing Attacks

Transcription

1 Crowd-GPS-Se: Leveraging Crowdsouring to Detet and Loalize GPS Spoofing Attaks Kai Jansen, Matthias Shäfer, Daniel Moser, Vinent Lenders, Christina Pöpper and Jens Shmitt Ruhr-University Bohum, Germany, University of Kaiserslautern, Germany, {shaefer, ETH Zurih, Switzerland, armasuisse, Switzerland, New York University Abu Dhabi, United Arab Emirates, Abstrat The aviation industry s inreasing reliane on GPS to failitate navigation and air traffi monitoring opens new attak vetors with the purpose of hijaking UAVs or interfering with air safety. We propose Crowd-GPS-Se to detet and loalize GPS spoofing attaks on moving airborne targets suh as UAVs or ommerial airliners. Unlike previous attempts to seure GPS, Crowd-GPS-Se neither requires any updates of the GPS infrastruture nor of the airborne GPS reeivers, whih are both unlikely to happen in the near future. In ontrast, Crowd-GPS-Se leverages rowdsouring to monitor the air traffi from GPS-derived position advertisements that airraft periodially broadast for air traffi ontrol purposes. Spoofing attaks are deteted and loalized by an independent infrastruture on the ground whih ontinuously analyzes the ontents and the times of arrival of these advertisements. We evaluate our system with real-world data from a rowdsoured air traffi monitoring sensor network and by simulations. We show that Crowd-GPS-Se is able to globally detet GPS spoofing attaks in less than two seonds and to loalize the attaker up to an auray of 150 meters after 15 minutes of monitoring time. I. INTRODUCTION Today, more than a billion devies rely on the Global Positioning System (GPS) for various appliations that require aurate positioning or preise time synhronization. With its ubiquitous overage, GPS has beome the de fato standard means of navigation and traking servies in outdoor environments, where it ahieves an auray of up to three meters [1]. For navigation purposes, satellite systems suh as GPS are mission-ritial for Unmanned Aerial Vehiles (UAVs), ranging from onsumer-lass mini or miro drones to tatial and strategi UAVs. Although GPS is ommonly used in aviation, the system is not seure, i. e., ivilian (publi) GPS signals sent by the satellites are neither authentiated nor enrypted. As a onsequene, airraft and UAVs are vulnerable to GPS signal spoofing attaks, where a maliious transmitter emits signals similar to those from the satellites but at a higher power and, potentially, at slightly different time delays. The airraft s GPS reeiver will lok on to the spoofed signal as it arrives with a higher signal strength than the authenti signals. By seletively varying the time offsets of the spoofed satellite signals, attakers are able to mimi arbitrary positions. These kinds of spoofing attaks are well-known [2] [7] and have been shown to be feasible in the real-world [5], [8]. In fat, GPS spoofing has allegedly been used to hijak a CIA stealth drone (RQ-170) in Iran in 2011 [9] or luring ships off their ourse [4], [10]. Moreover, GPS spoofing has been used as a defense against GPS-ontrolled UAVs flying in the viinity of the Kremlin in Russia [11]. Over the years, the prie to perform GPS spoofing attaks has dramatially dropped. Mobile ommerial off-the-shelf GPS spoofing devies are available for less than $1,000 [4] and publily available software tools [12] allow the generation of arbitrary GPS signals. The prie fall and low-expertise requirements raise the risk for appliations relying on GPS for safety- or seurity-ritial deisions and proesses. The demoratization of GPS spoofing tehnologies has triggered the development of various ountermeasures, whih an be oarsely ategorized into three lasses: (i) ryptographi tehniques, (ii) detetion at signal level, and (iii) diretion of arrival sensing. Cryptographi tehniques [13] [16] aim at authentiating signals from satellites with additional signals that are unpreditable to users that do not own a seret key. However, these tehniques are not resistant to replay attaks and would require a ostly upgrade of the GPS infrastruture. Spoofing detetion at signal level are based either on anomaly heks in the physial signal waveform [17] [19] or on measuring the angle of arrival from whih the signal is originating [20], [21]. While these tehniques do not require a hange in the struture of GPS signals, they impose modifiations on existing reeivers and inrease the omplexity and omputational requirements of those devies. We onlude that existing ountermeasures are unlikely to be implemented in the near future sine they all require farreahing modifiations of either the GPS infrastruture or the reeiving devies. Driven by the inreasing threat and the lak of realisti short-term solutions, we propose Crowd-GPS-Se, a system that detets and loalizes GPS spoofing attaks on aerial vehiles without the need to update the struture of the GPS satellites signals nor the logi of the airborne GPS reeivers. Crowd-GPS-Se leverages rowdsouring to monitor the position advertisements derived from GPS that airraft and UAVs periodially broadast for air traffi surveillane. Using

2 those advertisements, we devise a GPS spoofing detetion and loalization solution that analyzes the ontents and the time of arrival of these surveillane messages as reeived by different sensors on the ground. We have evaluated Crowd-GPS-Se with simulations and real-world data from the OpenSky Network [22], a rowdsouring initiative whih maintains a network of more than 700 air traffi ommuniation sensors around the world. Our implementation of Crowd-GPS-Se is able to globally detet GPS spoofing attaks in less than two seonds and to loalize the attaker up to an auray of 150 meters after 15 minutes of monitoring time. While the problem addressed in this work is related to spoofing detetion and loalization in lassial diretion finding [20], [21] and multilateration systems [23], there is one fundamental differene and unique advantage. Instead of trying to detet and loalize the GPS spoofer through diret measurements of its own signals, we rely on indiret measurements from the position advertisements that the airraft are broadasting. This approah enables us to detet and loalize the spoofer even when there is no diret line-ofsight onnetion from a sensor to the spoofer. Maintaining a line-of-sight onnetion to the airraft is muh simpler and thus more effetive sine the airraft are in the sky and use high transmission power levels whih render the signals reeivable from the ground up to several hundred kilometers away. Another major advantage is that Crowd-GPS-Se relies on data from air traffi monitoring sensors that are already widely deployed around the world. Thus, the solution does not require a dediated GPS signal aquisition infrastruture for spoofing detetion and loalization. To the best of our knowledge, this paper is the first to propose a GPS spoofing ountermeasure whih takes advantage of onsidering indiret GPS-inferred data rather than raw GPS signals. In summary, this paper makes the following ontributions: We propose Crowd-GPS-Se and elaborate on the idea to provide seurity via an existing infrastruture of rowdsouring sensors. We present algorithms for the detetion of GPS spoofing attaks on airborne targets by using airraft reports and multilateration. We provide a novel tehnique for the loalization of GPS spoofers based on position differenes between pairs of spoofed airraft. We report on experiments with airraft transponders and assess the performane of Crowd-GPS-Se analyzing real-world air traffi ontrol data. II. THE GLOBAL POSITIONING SYSTEM The GPS infrastruture is a satellite-based navigation network of over 30 satellites loated in the medium Earth orbit, more than 20,000 km above the Earth s surfae. GPS-apable reeivers an determine their position and time by measuring the time of arrival (ToA) from at least four satellites. Based on the ToA and the transmission time embedded in the signals, reeivers an alulate distanes to eah satellite. Satellite-to-Airraft Airraft-to-Ground RADAR GPS ADS-B/Flarm Fig. 1. Shemati overview of urrently deployed tehnologies used to monitor air traffi inluding GPS, RADAR, and ADS-B/Flarm. Multilateration of those distanes yields the position and the loal time of the reeiver. The ToA measurements are affeted by a range of errors resulting in a typial loalization unertainty of σ = 4 m (mean error of about 7 m) [24] [27]. While ivilian (publi) GPS signals an be deoded by everyone, inluding airplanes, drones, and other UAVs, military GPS signals are proteted by (at least) seret spreading odes restriting their users to a seleted group with additional knowledge. We fous on ivilian GPS with non-authentiated signals, whih is the standard in ommerial and general aviation. A. GPS Usage in Aviation While in the past, radar and inertial systems used to be the two main loalization tehnologies in aviation, GPS is today often the preferred solution due to its superior auray. Modern airliners, smaller airraft, gliders, heliopters, or UAVs are almost all equipped with GPS reeivers. GPS is typially used by pilots or UAVs for self-loalization but the tehnology is also used for remote air-traffi surveillane and ollisionavoidane appliations. In the latter ases, aerial vehiles are required to periodially broadast position and veloity advertisements to inform neighboring airraft and ground ontrollers about their presene. Larger aerial vehiles generally transmit those messages over the Automati Dependent Surveillane Broadast (ADS-B) system while smaller and slower vehiles rely on the Flarm [28] system. Irrespetive of the used system, these advertisements ontain a position that is diretly derived from airborne GPS reeivers as depited in Figure 1. In this work, we propose to leverage the position advertisement messages of ADS-B and Flarm in order to detet and loalize GPS spoofers. While ADS-B and Flarm rely on different radio frequenies and message formats, the underlying onept is the same. On regular random intervals (around twie per seond), airraft broadast their urrent position together with their unique addresses. Neighboring aerial vehiles and ground stations reeive these messages to generate a reognized air piture. The advertisement messages an be reeived over long distanes. In ADS-B, messages an be reeived up to distanes

3 of 700 km when there is a diret line-of-sight onnetion between the transmitter and the reeiver. In Flarm, the range is smaller but reeption ranges of up to 100 km are possible. B. GPS Spoofing Attaks GPS spoofing attaks exploit the lak of enryption and authentiation of ivilian GPS signals by imitating the legitimate signals with the purpose of modifying the loalization or time result of a vitim [3], [7], [25]. Tehnially, spoofing attaks are based on fake GPS signals manipulating the ToAs of signals that otherwise use the same payload as real signals. In the past, inidents were reported [4], [9] [11] where spoofers suessfully interfered with the integrity of GPSdependent systems, thus rendering the spoofing threat far from being only of theoretial nature. As a result, urrently marketed drones, airraft, heliopters, or any kind of vehiles that rely on GPS are prone to spoofing attaks and lak effetive ountermeasures. Based on ommon assumptions on attaker apabilities and reent inidents, we assess the resulting threat model in this setion. First, we larify our onsidered adversary model. Seond, we reason about key assumptions that Crowd-GPS-Se is based on to detet and loalize spoofing attaks. 1) Threat Model: The attaker s motivation to interfere with the air safety by injeting false positioning information into UAVs or airraft an be manifold. An attaker may onsider hijaking the targeted vitim for an own benefit of aquiring goods or irumventing flying bans. Even more severe, an attaker may partiipate in terrorist attaks by manipulating the air-traffi ontrol or the ollision-avoidane systems, e. g., by spoofing fake position information to fool the safety logi of these systems. In our adversary model, the attaker is able to transmit speially rafted signals idential to those broadasted by GPS satellites but an ahieve a higher power at the target loation. The attaker aims at spoofing a moving airraft or a UAV from a position on the ground. In order to ondut a stealthy and unnotied attak, the spoofer may use a diretional antenna 1 direted towards the vitim in the sky. However, due to the target s movement, the attaker needs to transmit signals from a onsiderable distane, hundreds of meters to kilometers away. We note that typial operating altitudes of UAVs range from 60 m to 20,000 m and their mission radii vary from 5 km to 200 km and beyond [30]. Hene, if the route taken by the vitim is not preditable, the attaker will be fored to use antennas with wide-beam propagation patterns. This fores the attaker to transmit signals of suh a strength and propagation that the spoofing signals most likely will not only be reeived at a partiular primary target loation but also over a wider area, affeting other airraft and UAVs in the neighborhood. Sine the spoofer is targeting moving vehiles, we further assume that the spoofer is emulating a moving trak suh as a straight line or a urve with some potential aeleration. 1 We fous on the ommon assumption that the attaker uses a single antenna for transmitting the spoofing signals, but the proposed tehnique ould also be extended to multi-antenna attakers representing an emerging threat [29]. (a) PowerFLARM Core (b) PowerFLARM Portable Fig. 2. Two newest-generation Flarm transponder models. Both transponders have an integrated GPS reeiver but do not provide any protetion to GPS spoofing and advertise false positions when spoofed. 2) Validation of Assumptions: Crowd-GPS-Se relies on two key assumptions whih we validate in this setion. The first assumption is that whenever a GPS reeiver loks on to the spoofed signals, the position advertisements of the airraft and UAVs will ontain the spoofed GPS positions. While ommerial GPS reeivers are known to be vulnerable to spoofing attaks [2] [5], [8], [10], [31] [33], aviation transponders ould have additional plausibility heks to prevent that spoofed GPS positions propagate to the broadasted position advertisements. The seond assumption is that the spoofed signals will not only affet the target vitim of the spoofer but also neighboring airraft and UAVs. We validate these two assumptions with ontrolled lab experiments and simulations with real-world air traffi data from the OpenSky Network. GPS Spoofing Experiments. We perform GPS spoofing experiments with two Flarm transponders that are widely deployed. As we ould not get formal approval from our national offie of ommuniations to perform GPS spoofing experiments in the wild with real airraft, we rely on an isolated experimental setup inside a shielded lab environment. The goal of these experiments is to demonstrate that existing transponders do not perform any heks on the derived GPS position and that spoofers an preisely ontrol the position and speed of vitim reeivers. Our experimental setup onsists of two new-generation Flarm transponder models from Flarm Tehnology: a PowerFLARM Core and a PowerFLARM Portable both with an integrated GPS reeiver from u-blox, see Figure 2. More than 30,000 manned airraft, heliopters, and UAVs over the world are equipped today with these transponders [28]. As GPS spoofer, we rely on a USRP B200 from Ettus Researh and the software-defined GPS signal simulator gps-sdr-sim [12]. To monitor the reported Flarm position advertisements by the transponders, we use a Raspberry Pi with an RTL-SDR software-defined radio dongle and the flare open-soure Flarm deoder [34]. All devies are equipped with omnidiretional antennas.

4 CDF Speed in km/h Deviation in meters Fig. 3. Cumulative distribution funtion (CDF) of deviation between spoofed and reported position messages of the PowerFLARM Core transponder. We put all devies in viinity of eah other and spoof traks with speeds of 0, 6, 30, 100, 300, and 1,000 km/h, respetively. The differene between the fake target positions emitted by the spoofer and the reported positions in the Flarm advertisements is plotted in Figure 3. While the deviation beomes larger with inreasing speed, our experiments onfirm that an attaker an exatly ontrol the derived position and speed at the Flarm devies. Even for speeds up to 1,000 km/h, the deviation of both spoofed devies is always smaller than 160 m, and thus signifiantly smaller than the mandated separation minima in aviation [35]. These experiments also onfirm that suh ommerial transponders as deployed in aerial vehiles do not perform plausibility heks on the GPS signal input and simply report the spoofed GPS data in the advertisement messages. This result is inline with air traffi ommuniations not being proteted against wireless attaks [36]. GPS Spoofing Coverage Estimation. To validate the assumption that a GPS spoofer will affet the GPS reeivers of multiple aerial vehiles at the same time, we evaluate the reeption range of a spoofer using the free-spae path loss model and a typial airspae density model as observed by the OpenSky Network in the European airspae. Sine the power of GPS signals at the Earth s surfae is very low (approx. 160 dbw), the neessary power to reate adequate spoofing signals is aordingly low. We assume an attaker with standard equipment, who an reasonably ahieve a generated signal power of 15 dbm (USRP2 [37]) oupled with an exemplary antenna gain of 12 dbi in the main lobe. We also onsider an additional signal attenuation at airraft of approx. 30 db due to the fuselage and the downward diretion. Based on these estimations, we an alulate the reeption range with regard to the free-spae path loss [38]: L fs = log 10 (d km ) + 20 log 10 (f MHz ), (1) where d km is the distane between the soure of the signal and the reeiver in kilometers and f MHz is the signal frequeny given in megahertz; the onstant of depends on the Mean Affeted Airraft Beamwidth Inlination [ ] Fig. 4. The number of affeted airraft depends on the diretional antenna beamwidth and the inlination angle. The figure uses a realisti airspae density sampled from OpenSky Network data. utilized units. The resulting reeption range is based on the signal power impaired by all attenuation soures and the distane d from Equation (1): Power L fs (d) Attenuation 160 [dbw], whih results in a distane d of approx. 34 km. Considering our parameter estimations, all airraft within the main lobe loser than 34 km will reeive the spoofing signal with at least 160 dbw. In general, an attaker will be interested to exeed these power levels to ensure the takeover of the GPS lok at the intended targets. However, to remain as stealthy as possible, the attaker is likely to use an attak setup with diretional antennas to avoid a wide signal broadast detetable by, e. g., ground-based signal power sensors. A diretional antenna setup is haraterized by its beamwidth influening the signal spread and the inlination angle determining how the main lobe of the signal beam is targeted. Notably, an attak on moving targets requires to inrease the beamwidth and to use higher inlination angles, resulting in a ertain proliferation of the affeted area. Based on data from the OpenSky Network of the European airspae, we perform a onservative estimate of the average number of airraft affeted by a spoofing attak targeting a randomly seleted airraft, as shown in Figure 4. The baseline (0 beamwidth) is an attaker that an perfetly pinpoint a vitim, thus avoiding seondary targets. Suh a small beamwidth is however impossible to ahieve in pratie and would further be very sensitive to small orientation errors of the antenna. As we an see, already small beamwidths and inlination angles span enough spae to affet several airraft around the intended target, making it highly likely to hit several additional airraft. The assumption that our work relies on is therefore realisti for dense airspaes suh as found in Europe.

5 Airraft Spoofer Loalization MLAT Spoofer Position Spoofing Inident GPS Spoofer ADS-B/Flarm Sensors OpenSky Network Spoofing Detetion Crowd-GPS-Se Fig. 5. Worldwide overage of Crowd-GPS-Se as of Deember III. CROWD-GPS-SEC We propose Crowd-GPS-Se as an independent system infrastruture on the ground that ontinuously analyzes the ontents and the time of arrival of Flarm and ADS-B position advertisements. As its name suggests, Crowd-GPS-Se relies on rowdsouring to monitor those messages at global sale. The sensors used for Crowd-GPS-Se are part of the growing OpenSky Network [39], a rowdsouring initiative with the purpose to make air traffi ommuniation data available to the publi. The vast majority of the sensors are installed and operated by aviation enthusiasts and volunteers whih support the ause of the network. As of this writing, it ollets more than 200,000 messages per seond at peak times from over 700 sensors whih are distributed all over the world 2 as shown in Figure 5. Europe and the Amerian ontinent exhibit a partiular high density of sensors suh that individual position advertisement messages are most likely being reeived by more than four sensors. The goals of Crowd-GPS-Se are to detet GPS spoofing attaks on aerial vehiles as quikly as possible and to loalize the position of the spoofer(s). To ahieve these goals, Crowd-GPS-Se has three modules whih ontinuously proess all position advertisements that are reeived from the OpenSky Network, as shown in Figure 6. The multilateration (MLAT) module estimates the loation of the airraft based on the time differene of arrival (TDoA) of position advertisements between different sensors. This module is fundamental to Crowd-GPS-Se as it allows us to determine the true position of the airraft independently of the ontent of the advertised messages. The spoofing detetion module heks for inonsistenies between multilaterated positions and GPS-derived positions in the advertisement messages as well as for inonsistenies between position advertisements from different airraft (e. g., when two airraft advertise the same position at the same time). The spoofer loalization module, finally, is triggered only when the spoofing detetion module has deteted a GPS spoofer. It then estimates the position of the spoofer by analyzing time differenes between 2 See for more statistis. Fig. 6. Crowd-GPS-Se system overview. A GPS spoofer transmits fake GPS signals that are reeived by multiple airraft periodially broadasting ADS-B/Flarm position reports. Ground-based sensors reord these reports, whih are then proessed by Crowd-GPS-Se for spoofing detetion and spoofer loalization. reeived positions in advertisements from the airraft and the true position as estimated by MLAT. We desribe the modules in the next three subsetions. A. Multilateration (MLAT) The implementation of MLAT as an independent airraft loalization will serve as an auxiliary omponent for one of the spoofing detetion tests and the subsequent spoofer loalization. To implement suh a system, we make use of the fat that in regions with high sensor density position advertisement messages are reeived by multiple geographially distributed sensors. Eah message is timestamped at the reeiver on arrival and an be represented as a simplified tuple of the reported position and the time of arrival: ADS-B/Flarm Report := (â i, t s ), (2) where â i denotes the reported position of airraft i as derived by GPS and t s is the timestamp as generated by sensor s. Sine the sensors are geographially distributed, propagation distanes of the transmitted signals differ. Hene, the same broadasted message is timestamped differently at diverse sensors. If the sensors are synhronized to the same global lok, e. g., by GPS time synhronization, and are deployed at known positions, we an formulate relations between the propagation distanes and the differenes in the time of arrival (TDoA): dist(s i, A) dist(s j, A) = t i,j, (3) where s i, s j denotes the position of sensor i and sensor j. The TDoA of the same message from referene airraft A between these sensors is t i,j = t i t j, and is the speed of light. Equation (3) is fulfilled for all points that have the same distane differene to both onsidered sensors determined by the TDoA. By onstrution of at least four relations of this type, we perform multilateration to approximate the position of the targeted airraft. Geometrially, eah relation desribes a hyperbola in 2D and a hyperboloid in 3D. The interseting point of all relations indiates the airraft position. Figure 7 provides a visual interpretation of this multilateration proess.

6 Sensor 1 dist s 1, A dist s 2, A dist s i, A dist s j, A = t i,j Sensor 2 dist s 3, A Sensor 3 Fig. 7. Implementation of an independent airraft loalization sheme based on multilateration onsidering the TDoA of broadasted ADS-B/Flarm messages. B. GPS Spoofing Detetion Spoofing detetion is the first step in a mitigation strategy to ounter GPS spoofing attaks. The idea of Crowd-GPS-Se to detet GPS spoofing attaks is based on the broadasted ADS-B/Flarm reports ontaining potentially spoofed positioning information. We propose a verifiation proess onsisting of two omplementary heks. 1) Time Alignment of Transmissions: Sine ADS-B/Flarm messages are broadasted at variable transmission times, we need to time-align those reports in order to make them omparable. This is ahieved by inorporating the results from the MLAT omputation. To align the position reports to a referene global time, two steps are performed subsequently. The first step yields the transmission time t TX at whih the GPS-derived position was reported: t TX = t s dist(s, a), (4) with t s being the time at whih sensor s has timestamped the message, dist(s, a) representing the Eulidean distane between the onsidered sensor and airraft, and being the speed of light. The seond step is an interpolation to approximate the airraft position a REF at a global referene time t REF. We need to onsider the following three ases: a REF = a TX (t TX+1 t REF)+a TX+1 (t REF t TX) t TX+1 t TX a TX a TX (t REF t TX 1)+a TX 1 (t TX t REF) t TX t TX 1 t TX < t REF t TX = t REF t TX > t REF with a TX = â denoting the airraft position at transmission time, TX 1, TX, and TX+1 being the previous, urrent, and next transmission event, respetively. After this interpolation, all reported positions are time-aligned and an be ompared with respet to the same time basis. In the remainder of this paper, we assume time-aligned positions. 2) Test 1 (Cross-Cheks with MLAT): We propose the implementation of two omplementary tests. The first test performs a ross-hek between the reported positions and the estimated real positions from the previously desribed MLAT approah. We hek for eah inoming position report whether dist(a i, â i )? < T 1 (5) holds, where a i is the real position of airraft i determined by MLAT, â i is the position reported by airraft i using ADS-B/Flarm, dist() is the Eulidean distane funtion, and T 1 denotes a predefined threshold whih tolerates measurement errors in a i and â i. Choosing the right threshold T 1 depends on the auray of the underlying seondary loalization method (here MLAT). Smaller T 1 lead to higher false positive rates, while larger T 1 reate more room for undeteted manipulations. Complexity. Let n be the number of airraft. Equation (5) needs to be heked one for eah airraft, i. e., n times, resulting in a omplexity of O(n). For eah sampling time, we require the positioning information from ADS-B/Flarm and MLAT. The omparisons of both positioning soures an be parallelized, sine the heks for eah airraft are independent of all other airraft. As a result, the first test of GPS spoofing detetion sales linearly with the number of simultaneously traked airraft. 3) Test 2 (Multiple Airraft Comparison): The seond test makes use of the information provided by other airraft. In partiular, we perform a omparison between reported positions of multiple airraft. When multiple airraft reeive the signals from the same spoofer devie, they will appear at the same loation [7] sine the time differenes between individual satellites are emulated on the radio of the spoofer prior transmission. Due to mandatory separation minima [35], i. e., minimum required distanes between en-route airraft, similar positions are ritial and are aused either by a serious inident, e. g., near-ollision, or a GPS spoofing attak. Eventually, the multiple airraft omparison test is defined as: dist(â i, â j ) = d i,j? > T2, (6) where i and j denote two different airraft, â i and â j are the GPS-derived positions of airraft i and airraft j, dist() is the Eulidean distane funtion, and T 2 is a threshold tolerating the GPS positioning noise. Choosing an appropriate T 2 depends on the mandated separation minima in the onsidered airspae and the auray of the GPS information provided via position reports. However, as auray is one of the design goals of ADS-B and Flarm and the separation minima are usually in the order of kilometers, a threshold as small as a few hundreds of meters is appropriate. Complexity. Let n be the number of airraft. Sine Equation (6) onsiders pairs of airraft, a naive implementation would require ( ) n 2 = n 2 n 2 omparisons resulting in a omplexity of O(n 2 ). However, sine Test 2 onsiders spatial data only, the omplexity an be redued by implementing nearest neighbor searhes based on k-d trees and over trees.

7 TABLE I SPOOFING DETECTION TESTS COMPARISON Airraft 2 Feature Test 1 Test 2 Equation dist(a i, â i ) <? T 1 dist(â i, â j ) >? T 2 Complexity O(n) O(n log n) Requirement MLAT positioning Multiple airraft Advantages Single spoofed Independent of MLAT airraft detetion Separation of attaks Airraft 1 dist a 1, SP dist a 2, SP dist a 3, SP Airraft 3 In fat, sine Test 2 fails if there is any neighbor loser than T 2, solving the 1-nearest-neighbor problem for eah airraft is suffiient. Using the aforementioned data strutures, this an be aomplished at a omplexity of O(log n) for eah airraft [40], resulting in a global omplexity of O(n log n). 4) Complementary Design: We propose a omplementary design onsisting of both tests in parallel. Table I ontains a omparison of the spoofing detetion tests. While the first test based on the ross-hek of Equation (5) is independent of other flights, the seond test based on the omparison of multiple airraft of Equation (6) is independent of the MLAT positioning and an thus tolerate bad MLAT performane (e. g., when sensors have a bad geometri distribution leading to high dilution of preision). Furthermore, the seond test is able to separate multiple spoofing attaks ourring at the same time as there will be independent sets of oiniding airraft. The ombination of both tests an overome the pitfalls of the other and we an ahieve a more versatile and robust spoofing detetion. C. GPS Spoofer Loalization After spoofing detetion, Crowd-GPS-Se aims at loalizing spoofer devies. This is the next step in traing an attaker in order to take appropriate ation for shutting down an attak. We present a novel loalization approah to remotely pinpoint suh devies using already available ADS-B/Flarm reports broadasted by airraft. We start by desribing the high-level idea and then detail on the funtionality of the rowdsoured loalization system. 1) Loalization Model: If a maliious devie emits GPS spoofing signals, airraft within the effetive range will broadast spoofed positions as ontained in their ADS-B/Flarm reports. All airraft that reeive the same fake GPS signals will report positions on the same trak but timely shifted as a result of the propagation delay from different distanes to the spoofing soure [7]. In partiular, at the same global time, the airraft have different synhronizations on the spoofing signals based on how long it takes the signals to arrive at the airraft s GPS reeiver, i. e., airraft that reeive the fake signals earlier are ahead on the spoofed trak, whereas airraft that are further away from the spoofer reeive the signals at a later point in time and are thus behind on the trak. We extrat the resulting position differenes from the ADS-B/Flarm reports and baktrae these deviations to the loation of the spoofing devie. GPS Spoofer dist a i, SP dist a j, SP = d i,j v trak Fig. 8. Eah relation forms a hyperboloid representing all points with the same distane differenes. For the shown 2D projetion, we an onstrut three distint relations onsidering three different airraft. Our starting point is the identifiation of the urrently spoofed airraft, whih is the outome of the GPS spoofing detetion module. For those identified airraft, we forward related information to the spoofer loalization module. We further require the atual airraft positions a i, a j from MLAT and the mutual distanes d i,j with i, j {spoofed airraft}. As next step, we put the airraft distane into relation with the propagation distanes and the rate of position hange, i. e., the spoofed trak veloity. We an formulate this as follows: dist(a i, SP) dist(a j, SP) = d i,j, (7) v trak where a i, a j indiate the atual position of airraft i, j as given by MLAT, SP is the unknown spoofer loation, d i,j the respetive airraft distane, and v trak the veloity of the spoofed v trak GPS trak. The fator relates the position hange rate to the signal propagation speed (lose to the speed of light). We note that we need to assure v trak 0 and hene require a trak of hanging positions. Having related the reported positions to the spoofer loation, we solve eah equation towards this loation. In partiular, eah equation desribes all points that have the same mutual distane differenes. Geometri Interpretation. Considering the solutions of one relation of the type given by Equation (7), all potential solutions geometrially desribe a hyperbola in 2D and a hyperboloid in 3D with foi a i, a j and distane differene d i,j v trak. With two different relations, the possible solutions desribe a urve, whih is the intersetion between the hyperboloids. Eventually, three hyperboloids interset in at most two points, whereas four or more hyperboloids narrow down the loation of the spoofer to a single point. The general funtionality of this approah is depited in Figure 8 (2D projetion). Requirements. In order to get at least four different relations, we need to fulfill one of the ases shown in Table III. In partiular, we either require four or more different referene airraft or, in the ase we have less, we need to gather reports from the same referene airraft but from different loations on their traks. In other words, position reports sent by only two

8 TABLE II MLAT VS. SPOOFER LOCALIZATION Approah Senario Equation Referene Target Measure Saling Fator MLAT dist(s i, A) dist(s j, A) = t i,j Sensors Airraft Time Spoofer Loalization dist(a i, SP) dist(a j, SP) = d i,j v trak Airraft Spoofer Position v trak TABLE III LOCALIZATION REQUIREMENTS Affeted Airraft Possibility of Loalization 1 Loalization not possible 2 At least 4 different loations 3 At least 2 different loations 4+ Loalization possible airraft but from four different loations are already suffiient to perform spoofer loalization. Sine we onsider moving targets, the transmission origins will also hange likewise. Hene, we are able to trade the number of spoofed airraft with the required observation time, whih we an formulate as follows: ( ) m t s 4, (8) 2 where m is the number of spoofed airraft and t s denotes the number of observed samples from different airraft positions. The binomial oeffiient provides the number of possible relations. Equation (8) defines the minimum requirements for our spoofer loalization. If fulfilled, we an onstrut at least four equations and eventually determine a distint solution. Comparison with MLAT. The desribed loalization approah exhibits similarities to the MLAT proess of Setion III-A but is haraterized by deisive differenes as ompared in Table II. Our approah uses the position information inluded in the ADS-B/Flarm reports, whereas MLAT is based on differenes in the time of arrivals at multiple sensors. We want to highlight that it is not possible to trae the loation of spoofing devies with MLAT. In our approah, we thus exploit a harateristi that is attaker-ontrolled suh as the spoofed positions in the advertisements. As a result, we obtain a multilateration with swithed roles, i. e., the referenes are moving airraft as ompared to the stationary ADS-B/Flarm sensors. Sine the onsidered measure is shifted from time to positioning information, we need to adjust the saling fator with the veloity of the spoofed trak. As a benefiial side effet, this diminishes the fator with whih the unertainties in the GPS-derived positions are multiplied and onsequently minimizes the noise impat on the loalization auray. 2) Error Minimization: In ontrast to a definite analyti solution onsidering relations based on Equation (7), realworld signal reeption and measurements suffer from several error soures and hene prevent a distint solution for the spoofer position. Both the positions from MLAT as well as the reported spoofed GPS positions are affeted by noise. Notably, the interpolation proess for time-alignment indues even more noise into the system. Consequently, ompared to the theoretial analysis, the onstruted hyperboloids do not interset in a distint point but rather mark an area. In order to find the optimal solution for the spoofer position SP, we formulate the following error funtion E t ( ): E t (SP, i, j) = dist(a i, SP) dist(a j, SP) d i,j, (9) v trak where d i,j is the distane in the reported ADS-B/Flarm positions and t is the urrent sample time. The real airraft positions are denoted by a i, a j and is the speed of light. All resulting errors add up to the overall error, whih we try to minimize by omputing the root mean square error (RMSE). Eventually, our algorithm outputs the most likely spoofer position: m i 1 arg min t=1 i=1 j=1 E t(sp, i, j) 2 SP t (, (10) m 2 2 m) with t indiating the sample time orresponding to Equation (9). The inner two sums aggregate the errors of relations between all spoofed airraft, whereas the outer sum aggregates the errors over all sample times. The argument with the minimum error is alulated to be the best approximation for the spoofer position. When time progresses, the total number of relations onsidering different referenes inreases. This also affets the error minimization proess by expanding the system of equations that are simultaneously evaluated. However, the omplexity inrease is only linear and, as we will show, this proess stabilizes quikly. As all measurements are affeted by noise, more relations are benefiial to redue the system-intrinsi errors and the loalization is predited to gain preision. 3) Improved Filtering: For GPS spoofing targeting multiple airraft, we identify an additional optimization tehnique that helps to lower the impat of unertainty in the reported positions even further. As all affeted airraft reeive the same spoofing signals, they report positions on the same trak irrelevant of timing information. This allows to better predit the underlying trak by inorporating all available reports. Consequently, we an apply a subsequent filtering of the spoofed airraft positions.

9 Detetion Rate Test Method 1 only 1 and 2 2 only Cum. Probability Data Set All Test 1 Test Attaker Radius [km] Altitude [km] Fig. 9. Detetion rates and overage of Test 1 and Test 2 in the onsidered OpenSky Network data set depending on the attaker s range. Fig. 10. Comparison of the detetion rates of Test 1 and Test 2 in the OpenSky Network data set depending on the target s altitude. In partiular, we apply a projetion of the reported positions on the ombined estimated trak. Notably, with this projetion we annot orret timing inauraies, but we an better estimate the most likely position at the urrent measurement time. The (orthogonal) projetion provides the least error with respet to the estimated trak and an be desribed as: â i â i trak, (11) where â i is the noisy GPS position and â i is the projeted point with â i â i being orthogonal on the estimated trak. Moreover, we do not neessarily require a ontinuous straight line but the trak an also ontain separated segments, whih are then evaluated separately to apply the projetion. IV. EVALUATION To evaluate the appliability of Crowd-GPS-Se to realworld air traffi, we assess its performane in terms of spoofing detetion and auray of the spoofer loalization. In partiular, we have implemented Crowd-GPS-Se and applied it to real-world data from the OpenSky Network. Moreover, we have built a simulation framework to generate results with respet to spoofing senarios. A. Spoofing Detetion Performane We ompare our two spoofing detetion tests with regard to their overage, detetion delay, and detetion rate. The tests are applied to air traffi data of Central Europe as reeived by the OpenSky Network over a period of 1 h. The data set ontains 141,693 unique positions of 142 airraft. Coverage. We define the overage of a test as the perentage of airraft positions that is proteted by a test. Protetion means that a test indiates a spoofing attak if the airraft is indeed spoofed. For simpliity, we assume that the attaker is using an omnidiretional antenna and is positioned right underneath the target using exatly the required transmission power to have the target airraft lok on the spoofer. This results in an attak range in the form of a sphere with a radius of the altitude of the airraft. Note that this setup models an unrealistially optimal attaker sine in reality, the attaker may not be able to stay exatly underneath the target airraft as the airraft is moving and it may use higher transmission powers than the minimal required power. Sine both tests rely on different features, the sets of positions overed by one test is different from the one overed by the other test, but there are overlaps. We therefore analyze how many airraft in our data set are overed by whih test. Figure 9 shows the frations of airraft in the data set overed by Test 1, Test 2, or both depending on the target s altitude. The results show that Test 1 learly outperforms Test 2. Overall, 61.2 % of the airraft are overed only by Test 1 while 2.9 % are overed only by Test 2. In addition, 8.9 % are overed by both tests. This result is not surprising sine the reeiver density of the OpenSky Network is high (whih benefits Test 1), while the airraft density (whih Test 2 relies on) is limited due to separation minima. In total, we an summarize that if the spoofer s target is at an altitude above 11 km and the spoofer is diretly underneath the target, the detetion rate is about 75 % using both tests. If the spoofer uses higher transmission powers or if it is not diretly underneath the target, the detetion rate inreases quikly towards 100 % (not shown in the Figure). As mentioned above, Test 1 diretly depends on multilateration overage and should therefore work better at high altitudes where airraft are traked by more sensors. In ontrast, Test 2 benefits from dense airspaes sine lose airraft protet one another. To further investigate this effet, we onsidered the umulative distribution of the altitudes of all airraft and ompared it to those of the airraft proteted by either of the tests. The results are shown in Figure 10. As expeted, Test 2 has a distribution similar to all altitudes. The steep inlines in its distribution onfirm that it is most effetive at the ommon altitudes above 10 km (en route flights) and at around 1 km (approah areas). Most airraft deteted by Test 1, on the other hand, were higher than 10 km whih also omplies with the above hypothesis. Detetion Delay. We define the detetion delay as the delay between the point in time when the attak takes effet, i. e., when the airraft s GPS sensor loks on to the spoofed signal until the detetion test will detet the attak. As for Test 1, this orresponds to the delay between reeiving the ADS-B position and the MLAT position update. To evaluate this, we used the open-soure MLAT implementation [41] with the OpenSky Network s real-time data stream and measured the time between the reeption of an ADS-B position and the

10 Cumulative Probability Test Method Test 1 Test Time [s] Fig. 11. Comparison of the detetion times of Test 1 and Test 2 in the OpenSky Network data set. TABLE IV SIMULATION FRAMEWORK PARAMETERS Parameter Parameter Range Default Sensor Density [ ] [ (100 km) 2 OpenSky Airspae Density OpenSky ] 1 (100 km) 2 Flightpath random OpenSky Flight Altitude ,000 [m] OpenSky Airspeed ,000 [km/h] OpenSky Spoofer Position random random Spoofing Range [km] 100 km Spoofed Trak Veloity ,000 [km/h] 1,000 km/h GPS Noise (std) [m] 4 m MLAT Noise (std) [m] 10 m emission of the respetive position by the MLAT implementation. As for Test 2, the delay an be redued to the inter-arrival times between spoofed position reports. Figure 11 shows the distributions for the delays of the two tests. The delay of Test 1 is a result of the delay of the relatively long MLAT alulations. Test 2, on the other hand, an detet an attak as soon as a false position report is reeived from two different airraft. Note that the position broadast interval of ADS-B is random within an interval of 0.4 s to 0.6 s, explaining the average detetion delay lose to 0.5 s. Conlusion. The results of our evaluation show that with realisti air traffi and implementation harateristis, the two tests an reah a detetion rate of up to 75 % when the attaker is diretly underneath the target. While Test 1 performs muh better in terms of overage and detetion rate, the detetion delay is muh smaller for Test 2. These results enourage a omplementary implementation as proposed in Setion III-B4. B. Spoofer Loalization Performane To evaluate Crowd-GPS-Se in terms of GPS spoofer loalization auray, we have built a simulation framework in MATLAB, whih allows us to analyze spoofing senarios in a ontrolled environment without having to spoof real airraft. In partiular, we assess the impat of noise in the GPS-derived position reports, MLAT positioning noise, and spoofed trak veloity. Distane to Spoofer [m] Elapsed Time after Spoofing Attak [min] Fig. 12. The impat of GPS noise models ranging from σ GPS = 4 m to 0.01 m on the spoofer loalization, depited inluding standard deviation errorbars. The MLAT positioning auray is fixed to σ MLAT = 10 m. Simulation Framework. While we are interested in results from varying parameter sets, we otherwise inorporate realisti data observed by the sensor infrastruture of the OpenSky Network. Table IV ontains an overview of the utilized simulation parameters. In the default ase, our simulation samples airraft from the OpenSky Network inluding reported positions, altitudes, airspeeds, and headings. The spoofer is randomly positioned in an exemplary area of (400 km) 2 and its range is set to 100 km spoofing a trak of 1,000 km/h. On the other hand, we are able to simulate different airspae onstellations, attaker onfigurations, and noise impats of MLAT and GPS. In partiular, we onsider standard assumptions taken from speifiations [1] and tehnial reports [42] as well as more optimisti assumptions that ould be ahieved with more sophistiated equipment. To simulate the impat of GPS spoofing on airraft, we imitate position reports from already spoofed airraft by inorporating the attaker-ontrolled position and adding Gaussian noise aording to the onsidered noise model. Subsequently, we apply standard noise orretion tehniques based on a Kalman filter [43]. For the error minimization onsidering distane relations, we implement a numerial solver. To ope with an inreasing number of equations, we only evaluate the relations at disrete time intervals whih are defined as the time that has elapsed sine the spoofing attak was launhed, ranging from a few seonds up to 15 minutes. Metris. In order to quantify our results we define two metris. First, we onsider the distane between the atual spoofer position and our estimation. Seond, we onstrut a irle around our estimated position with a radius equal to the distane to the atual spoofer. We onsider this to be the searh spae to find the attaker and we ompare it to the observed area of (400 km) 2, on whih the spoofer was randomly positioned. For eah of the analyzed parameter sets, we performed 200 randomized simulation runs and averaged the results.

11 Distane to Spoofer [m] Elapsed Time after Spoofing Attak [min] Distane to Spoofer [m] Elapsed Time after Spoofing Attak [min] Fig. 13. The onsidered MLAT positioning noise models in the range of σ MLAT = 100 m to 1 m do not show any signifiant impat on the loalization auray. The results are based on a high GPS noise of σ GPS = 4 m. Fig. 14. The veloity of the spoofed trak is analyzed for speeds between v trak = 6 km/h to 1,000 km/h. The results onsider a GPS noise level of σ GPS = 1 m and an MLAT positioning auray error of σ MLAT = 10 m. 1) Impat of GPS Auray: Figure 12 depits the impat of high GPS noise (σ = 4 m) to low GPS noise (σ = 0.01 m) applied to the latitude and longitude diretion. We do not require altitude information for spoofer loalization and an therefore neglet altitude inauraies. We onlude that the extent of noise in the reported GPS positions is a dominating fator that an make the differene between a few kilometers and merely tens of meters in spoofer loalization. In partiular, we ahieve an average loalization auray of approx. 8.2 km for σ GPS = 4 m, approx. 1.7 km for σ GPS = 1 m, and approx. 149 m for σ GPS = 0.1 m, eah after 15 minutes. Considering the searh spae redution, we need to san approx % for σ GPS = 4 m, approx for σ GPS = 1 m, and approx for σ GPS = 0.1 m, again after 15 minutes. Furthermore, we an observe that the loalization auray inreases rapidly within the first few minutes, whereas after 5 min the auray only improves slowly. From 5 min to 15 min, the distane roughly halves. As a result, we an already give a good spoofer position estimation in a timely manner after the spoofing attak is launhed and narrow it down to a more exat position after a few minutes. 2) Impat of MLAT Auray: Another unertainty of our loalization approah is the auray of the MLAT positioning that we require to determine the atual (unspoofed) airraft positions. We hoose to vary the MLAT auray between high noise (σ MLAT = 100 m) and lower noise levels (σ MLAT = 1 m), eah representing the standard deviation in latitude, longitude, and altitude. Figure 13 ontains the impat on the loalization of different MLAT noise levels. In ontrast to the strong dependene on the GPS noise in the spoofed measurements, the MLAT noise has little impat on the auray of the spoofer loalization. As a result, our loalization approah does not rely on highly aurate MLAT measurements of the atual airraft position and an still perform deently on relatively noisy data. 3) Impat of Spoofed Trak Veloity: As the spoofed trak veloity v trak is part of the saling fator in the distane relations, we identify it to be another important parameter. The results for varying spoofed trak veloities are depited in Figure 14. For a spoofed trak veloity of v trak = 300 km/h, the auray dereases by nearly one fourth. The auray dereases further for a trak veloity of v trak = 100 km/h. Eventually, for trak speeds lower than v trak = 30 km/h, the spoofer loalization fails to narrow down a useful searh radius. However, onsidering less GPS noise, we expet to see better results even for lower trak veloities. The strong dependene on the trak veloity is due to the saling fator, whih relates the observed distanes to the spoofed trak veloity and the speed of light. Hene, low veloities result in smaller distane differenes among the spoofed airraft and are relatively more affeted by system-intrinsi noise. V. DISCUSSION Combined Error Effets. The spoofer loalization auray of Crowd-GPS-Se depends on the GPS error, the MLAT error, and the spoofed trak veloity. These three parameters are all omponents of the relations defined in Equation (7) and thus impat the auray. While the MLAT noise is less deisive, the GPS noise and the spoofed trak veloity are signifiantly affeting the ahievable auray. This is due to the small differenes in spoofed airraft positions with respet to the speed of light divided by the spoofed trak veloity. In general, we expose the following relationship between the loalization error E, the GPS noise σ GPS, and the spoofed trak veloity v trak : 2 σgps E, (12) v trak with σ GPS being saled with 2 due to the Eulidean distane based on two normally distributed points in spae. Hene, we