Detection of wireless data jamming and spoofing

A set of global navigation satellite system receivers is deployed in and moves about a region that may be occupied by a signal jammer or spoofer. The receivers collect truth data from spectral content of the broadcast satellite signal and, optionally, from a set of sensors associated with each receiver from which an independent determination of location can be derived. The truth data are compared with data acquired by the receivers and an alert is issued upon detection of an anomaly. The data from receivers in a region of influence of the jammer or spoofer are aggregated, integrated, and correlated to generate a two-dimensional representation of a region in which the offending signals are present.

BACKGROUND

The deliberate injection of interference signals in an operating region of a wireless information service is a common technique to interrupt the flow of data to a user, and can often have drastic consequences. For example, when signals of a global positioning system (GPS) are interfered with, such as by signal jamming or data spoofing, a user may find him- or herself out of position. In a battlefield scenario, proper positioning with respect to that of the enemy and that of friendly forces is often critical, and failure to comply with planned trajectories can result in damage to equipment, injury to personnel and even loss of life. Accordingly, such deliberate interference is a common element of modern warfare and has been for many decades.

As used herein, jamming refers to the generation of electromagnetic radiation with the purpose of deliberately disrupting the successful transmission of data on a communication link. Spoofing, on the other hand, refers to the generation of electromagnetic radiation that mimics a communication link with the purpose of conveying false information to a user. A simple jamming strategy for GPS is to place a jamming source at the receiver, where the GPS signal strength is around −150 dBm. A GPS jamming source needs a jammer-to-signal (J/S) ratio of at least +80 dB to jam an incoming GPS signal and introduce bit errors. By jamming a satellite's broadcast signal in the vicinity of the targeted receiver, a much smaller and less powerful jamming source is needed. Jammers exist that can be fitted into a hand-held device that can be placed essentially at will.

GPS spoofing has emerged as an ongoing threat in both military and civilian contexts. Portable GPS satellite simulators exist that can fit into the trunk of a car and are available as commercial of-the-shelf items. Again, the small size of this interference equipment affords its placement in a region at will and without the knowledge of targeted personnel. It becomes a challenge to detect the sudden appearance of jamming and spoofing efforts without deploying special equipment, which may hamper such detection in real time. In light of these challenges, the need has been felt for a technique to alert personnel, both at a local level and at a regional level, as to the presence of jamming and/or spoofing efforts.

SUMMARY

Described herein is a technique applicable to detection of service denial of an information service, i.e., a source of data that is carried over an electromagnetic carrier signal. A region of coverage of an information service transmitter is established having a spatial distribution of at least one transmitted signal parameter, such as signal power, that is known in the region of coverage. Such a distribution may be in accordance with range-squared divergence of radiation emitted by a remote transmitter, such as on a navigation satellite. At least one receiver is transported along a trajectory in the region of coverage to measure the signal parameter. A determination is made as to whether the measured spatial distribution of the signal parameter is that of the known distribution to within the degree of statistical significance. If such is not the case, an alert is generated at a local level and report data of such alerts are accumulated on a regional level. Independent measurements of position on the trajectory, such as by inertial navigation, may be implemented to determine whether the difference between the measured and known distributions is due to a jamming attempt or is due to a spoofing attempt.

The above and still further features and advantages of the present inventive concept will become apparent upon consideration of the following definitions, descriptions and descriptive figures of specific embodiments thereof. While these descriptions go into specific details of certain embodiments of the inventive concept, it is to be understood that variations may and do exist and will be apparent to those skilled in the art upon review of this disclosure.

DETAILED DESCRIPTION

The present inventive concept is best described through certain embodiments thereof, which are described in detail herein with reference to the accompanying drawings, wherein like reference numerals refer to like features throughout. It is to be understood that the term invention, when used herein, is intended to connote the inventive concept underlying the embodiments described below and not merely the embodiments themselves. It is to be understood further that the general inventive concept is not limited to the illustrative embodiments described below and the following descriptions should be read in such light.

The techniques described herein are directed to determining whether information-bearing signals of an information service are interfered with so as to disrupt the flow of data to a user of the information service. The exemplary embodiments described herein are directed to global navigation satellite systems (GNSS), such as the global navigation system (GPS) used in the United States, although the present invention is not so limited. Upon review of this disclosure and appreciation of the concepts disclosed herein, the ordinarily skilled artisan will recognize other information services to which the present inventive concept can be applied. The scope of the present invention is intended to encompass all such alternative implementations.

InFIG. 1A, there is illustrated an exemplary service denial detection system (SDDS)100by which the present invention may be embodied. One or more information service data sources, exemplified by satellites113,117, transmit and receive information service data over communication links112,114, respectively, to establish a region of coverage (ROC)110of an information service. As used herein, information service data refers to information-bearing data conveyed over a free-space electromagnetic carrier in accordance with specifications of a service provider. In the GNSS scenario exemplified herein, the information borne in the electromagnetic carrier is that by which geographical coordinates can be computed, as is known by those skilled in the satellite navigation arts, where such information may include satellite time data and ephemeris data of each satellite used in calculating position.

Exemplary SDDS100includes a plurality of transceivers, each specifically referred to as transceivers162,164and166, and generally referred to as transceiver(s)160, to process the GNSS data received thereat, and, optionally, to communicate with other system components, as will be described below. Transceivers160may be implemented by suitable GNSS locator devices that indicate respective geo-positional coordinates thereof within ROC110. Accordingly, each transceiver160establishes and maintains a communication link112,114with satellites113,117to, among other things, receive information from which such coordinates can be determined. It is to be understood that while only two satellites113,117are illustrated inFIG. 1, numerous satellites are typically deployed and may in fact be required to establish an ROC110over which geo-positional coordinates of an individual transceiver160can be determined with acceptable precision. It is to be understood, as well, that although ROC110is illustrated as being bounded by a circle, such is solely for purposes of illustration and may not reflect any actual boundary of ROC110.

ROC110may be characterized by signal power at receiver level, which is dictated by the transmitted power at the satellite, the range to the receiver from the satellite and divergence of the transmitted energy, which is proportional to R−2, where R is the range from the transmitter to the receiver. For long ranges Rf, such as is the case with satellite transmission illustrated inFIG. 1A, the signal power distribution over ROC110is substantially constant to a degree of statistical significance, such as a specified mean and variance of the signal power. However, such constant signal power is not necessary to the invention; any known distribution of a known signal characteristic in an ROC110will suffice.

A service denial device (SDD)153may be situated in ROC110to interfere with the GNSS data provisioning, such as by generating jamming and/or spoofing signals152, to establish a region of influence (ROI)150over which the GNSS service is denied. The bounds of ROI150are encompassed in ROC110and are determined by the effective range of SDD153, i.e., the range over which jamming and/or spoofing can be achieved.

In exemplary SDDS100, transceiver160is implemented with detection facilities to determine whether transceiver160is within ROI150. For example, given that the range Rfto a given satellite, say satellite113, is quite large, the power spectral density (PSD) of the electromagnetic carrier of communication link112in ROC110is known to within noise factors and is substantially constant over moderate spans. On the other hand, the range Rsto SDD153may be orders of magnitude smaller than Rfto the extent that the received power of electromagnetic radiation152emitted thereby is quite variable in ROC110. Thus, as transceiver162moves through, say, a trajectory163in ROI150to a new position162′, variation in received power over the trajectory may correspond to the range-squared divergence of signal152transmitted from SDD153. The difference in the spatial distributions between the measured signal power and the known signal power, e.g., the range-squared divergence of the carrier signals112,114may be indicative that an SDD153is within ROC110.

In certain implementations, numerous transceivers160are located in ROC110. As these transceivers160move throughout ROC110, electromagnetic signal power levels over ROC110may be collected and analyzed. At any moment in time, a set of transceivers160may be dispersed over ROC110in a first spatial distribution and electromagnetic field data may be collected at each transceiver160. The measured signal power from each transceiver160may be provided to a data aggregator/disseminator (DAD)180over wireless communication links182,184. In a subsequent moment, users of transceivers160moving in ROC110through respective trajectories may be dispersed in a spatial distribution different than the first and new electromagnetic signal power data may be provided to DAD180. At DAD180, measurements made by transceivers160in different spatial distributions thereof may be integrated with previous such measurements. Different moments in time may present different distributions of transceivers160in ROC110and each different distribution offers a new and distinct set of measurements of the electromagnetic signal power in ROC110. Over time, a full map of the electromagnetic field strength over ROC110may be computed in a manner resembling Monte Carlo integration methods.

As transceivers160move about ROC110, the footprint and power distribution over such footprint of ROI150may be estimated. For example, transceiver164may move through a trajectory165from a location at which high variability in power is detected to a new location165′ where the power profile is more constant. Such detection provides a measure of the spatial extent of ROI150. A transceiver166may follow a reverse trajectory167, i.e., where transceiver166begins outside ROI150and moves to a new location166′ inside ROI150. The crossing of the boundary will be indicated by changes in power levels, although the changes will not indicate a sharp boundary as is illustrated inFIG. 1A. As more data are collected by transceivers160, measurements of interference from jamming and/or spoofing may be processed locally and transmitted to DAD180. DAD180may collect, fuse, correlate and analyze the data from all transceivers in a particular region and a map of such measurements may be generated, such as that illustrated inFIG. 1B. The map inFIG. 1Bmay be that of an ROI of a GNSS spoofer having a footprint155, which is defined by detection of such spoofing by individual transceivers160. The shaded regions inFIG. 1Bindicate electromagnetic power beyond that expected from long range satellite transmission, darker shading indicating higher difference in signal power. As a result of such data aggregation and mapping, the location of the offending SDD153can be determined and the device may be targeted for removal or destruction.

The data aggregation and mapping discussed above may produce footprints whose size and shape may provide insight as to the type of jamming/spoofing that is taking place. For example, the footprint illustrated inFIG. 1Cmay be that of a small scale source deployed at ground level, and the footprint inFIG. 1Dmay be that of a medium scale ground- or sea-based jammer/spoofer. The oval shape of the footprint inFIG. 1Emay indicate medium scale jamming by an airborne source and that illustrated inFIG. 1Fmay indicate large scale jamming by an airborne source. It is to be understood that regular footprint shapes, such as those illustrated inFIGS. 1C-1Fmay be obtained from integrating many samples from transceivers160over suitable time intervals and performing a data fitting technique, such as a least-squares approximation of the data to a conic section.

In certain embodiments, SDDS100comprises two levels of processing: a local level performed on each transceiver160and a regional level performed by DAD180. At the local level, a user of a transceiver160may be notified of the presence of SDD153and to whether signal jamming or data spoofing is occurring. This information, as well as the data from which such information was derived at the local level, may be transmitted to DAD180for regional processing, such as to generate maps and other intelligence products which may be disseminated to the applicable community.

FIG. 2illustrates an exemplary local level transceiver (LLT)200by which a GNSS embodiment of the present invention may be implemented. The functional circuitry of exemplary LLT200may be contained in a housing205, which serves as a portable platform by which a user can transport the device over ROC110. A user interface210may be disposed on the housing to include, for example, a display212, on which various data, such as GNSS location data, and system control data may be displayed, and one or more user controls214, by which LLT200may be operated and controlled by a user. The present invention is not limited to a particular user interface configuration; numerous configurations may be used in conjunction with the present invention without departing from the spirit and intended scope of the present invention.

LLT200may include a wireless navigation receiver242coupled to an appropriately constructed antenna241to receive GNSS data broadcasted over an electromagnetic carrier signal213, such as by satellites113,117. Carrier signal212may be a radio-frequency (RF) signal at the GPS L1 frequency of 1575.42 MHz and, optionally, the GPS L2 frequency of 1227.60 MHz. The carrier signal may be down-converted by receiver242to an intermediate frequency (IF) signal246, by which, when provided to navigation processor234, the geographic longitude and latitude of the LLT200may be ascertained in a manner typical for such GNSS locator devices.

LLT200may include a plurality of sensors244to provide truth data. As used herein, truth data are collected and processed to provide independent verification and/or supplemental measurement of primary data, such as GNSS location data. For example, sensors244may provide truth data in the form of compass heading, barometric pressure, and distance traveled by which a truth data processor232may estimate the position of LLT200independently of the GNSS position computation. Truth data may also include carrier signal characteristics, such as to determine whether a received carrier signal is consistent with that from a GNSS transmitter. To that end, IF signal246may be provided to truth data processor232by which the signal characteristics, such as power spectral density, of GNSS carrier signal213may be analyzed.

Exemplary LLT200includes a local controller/processor (LCP)236by which the functional components thereof interoperate. For example, LCP236may format navigation data for display on user interface210and may execute functions responsive to user activation of a control214. Additionally, data from truth data analyzer232and navigation data processor234may be provided to LCP236, whereby the validity of the navigation data and/or the presence of a service denying device may be evaluated. LLT200may include a data logger235by which pertinent data items may sampled and stored in a storage unit237while the LLT200is being transported through ROC110.

Upon a determination that anomalies exist between the truth data acquired by sensors244and navigation data generated by navigation processor234, an alert may be generated and provided to a local user by, for example, an enunciator262, such as a light emitting diode or audible signal generator, or by a suitably formatted message on display212. Additionally, pertinent data that are logged by a data logger235and stored in a storage unit237, as well as data regarding the type of anomaly, may be formatted into a report by a report generator264and transmitted to remote location, such as to DAD180, by way of a transceiver252and antenna254.

Referring toFIGS. 3A-3B, there is illustrated a local level processor (LLP)300that may implement GPS navigation and truth processing in individual LLTs200. Exemplary LLP300includes a GPS processor310by which the geo-position of LLT200is ascertained. GPS processor may include a radio-frequency (RF) receiver315to receive the GPS carrier signal, a down-converter317by which the intermediate-frequency (IF) signal is extracted, a GPS demodulator319to generate a baseband digital signal in accordance with the IF signal, and a GPS data processor313, by which GPS coordinates are computed. The functional blocks of GPS processor310may be implemented through standard GPS receiver modules, although it is to be understood that the present invention is not limited to any particular configuration.

In certain embodiments, GPS processor310provides access to RF signal312and IF signal314, both of which may be provided to a signal analyzer320. Exemplary signal analyzer320performs truth data processing on the received GPS carrier signal. For example, when certain characteristics of the GPS carrier signal are known, signal analyzer320may determine whether signals received at LLT200are those from a recognized transmitter. RF signal312and IF signal314may be provided to GPS receiver data processor324, whereby various signal characteristics such as carrier-to-noise ratio (CNR), signal-to-noise ratio (SNR) and peak power at the carrier frequency are determined. Additionally, IF signal314may be provided to a fast Fourier transform (FFT) processor326, from which a frequency spectrum is produced for each sample of data clock322. The sample rate of clock322by which signal characteristics are determined and by which spectra are produced may be independent of the GPS satellite clock. The spectra from FFT processor326may be provided to a power spectral density (PSD) estimator328, from which power spectra are determined for each sample clock period. The signal parameters computed from GPS receiver data processor324and power spectra may be provided to a spectral analyzer332, by which spectral features are analyzed, as is discussed below.

Spectral data provided at the output of spectral analyzer332may be provided to an inverse square law (ISL) processor334. ISL processor334monitors the received signal strength for effects of range-squared divergence of electromagnetic transmissions. The variation in signal power due to inverse square law effects should be negligible for normal operation when the carrier signal is coming from actual GPS satellites and no other sources. However, locally positioned transmitters, such as local jamming devices, may be in closer proximity to the receiver and, as such, significant inverse square law effects will be apparent from the spatial distribution of signal power. Such range-squared divergence of a local jamming device may be determined by comparing a measurement made at a current location on a trajectory with a measurement of a previous location on the trajectory. By collectively examining multiple sequential moving average signal power estimates, an alert may be issued to the user upon an anomaly being detected. If no statistically significant difference in the spatial distribution of the signal power is observed, no alert is generated.

GPS processed data may be provided to a data validity analyzer330, which indicates whether valid GPS data are recoverable from the received carrier signal. If GPS data are not successfully extracted from the carrier signal, the spectral data generated by spectral analyzer332are analyzed to determine whether the GPS power level and SNR are adequate for data acquisition. If power levels are sufficient and the spectral envelope exhibits excessive spikes or other superfluous signal activity, the GPS signal is considered to be jammed and an alert to such may be issued. However, if the GPS signal levels are insufficient, the user may be alerted that the location of LLT200is within a spatial null, or otherwise outside the ROC.

Referring toFIG. 3B, exemplary data logger370maintains historical logs of pertinent system and processing data for purposes of report generation and internal processing. The present invention is not limited to the types of data that are logged, as such will vary on an implementation basis. In the example illustrated inFIG. 3B, GPS data, a data validity flag, ISL processed data and spectral data are logged for each time sample generated by data clock322. In certain embodiments, stored data may be purged when no longer needed, such as during periods where GPS operations are interference free.

In certain embodiments of the invention, an independent position measurement is made, such as through an inertial navigation processor350. To that end, LLT200may be provided with numerous sensors345, each providing a datum from which position may be derived. For example, an altimeter, a barometer, a hygrometer and thermometer may be used to determine altitude, such as by altitude estimator352, and a compass, pedometer and accelerometer may be used to determine a heading, distance traveled and velocity, such as by heading/distance estimator354. Numerous techniques to determine altitude, heading, distance and velocity from such sensor readings can be used in conjunction with the present invention without departing from the spirit and intended scope thereof. Detailed description of such estimation techniques are omitted for purposes of conciseness.

The altitude estimate and heading/distance estimate may be provided to a statistical position estimator (SPE)356by which a current position may be established. For example, SPE356may implement a dead reckoning computation of position, such as used in conventional inertial navigation techniques, whereby the current position is determined from knowledge of the previous position and distance and direction traveled therefrom.

Each sensor345may be coupled to a switch347, which may be activated through activity monitor344in an inertial measurement unit (IMU)342. The activity monitor344may be activated when IMU342detects motion and may be deactivated during periods of inactivity. Additionally, IMU342may generate a timestamp, such as by timestamper343, when activity monitor344is activated and such timestamp may be logged in data logger370.

Exemplary LLP300includes an analyzer360by which the presence and type of an SDD152in the vicinity of the corresponding LLT200is determined. To that end, analyzer360may receive truth data, such as independent position estimates and carrier signal characteristics, with which to compare and scrutinize GPS position reported by GPS data processor313. For example, analyzer360may compare the position computed from the inertial navigation processor350with that computed by GPS data processor313to determine whether there is a statistically significant difference therebetween. If so, the signal characteristics may be evaluated to determine whether uncharacteristic and/or abnormal power spectral features are present in the carrier signal. If a statistical difference in position is noted and spurious signal characteristics are also present, analyzer360may recognize such state as that of a spoofing attempt. If, as another example, data cannot be read from the GPS carrier signal and uncharacteristic or abnormal signal features are present in the carrier signal, analyzer360may recognize such state is that of a jamming attempt. The determination of spoofing and/or jamming is provided to an alert processor362, which provides an appropriate alert indication, e.g., whether spoofing of jamming is occurring, to alert enunciator366, by which the user of LLT200is made aware of the condition. Additionally, alert processor362may provide an indication of the type of alert, the time of the alert, etc., to report generator364. Report generator364may retrieve the pertinent logged data from data logger370and format a suitable report, which may be transmitted by a back-channel radio transmitter368.

InFIG. 4, an exemplary regional DAD400is illustrated. Upon an alert at any LLT200within the region for which DAD400has responsibility, a report410is generated and transmitted to DAD400where it is received by a back-channel receiver420. The present invention is neither limited to a particular file format for reports410nor to the report content. The reports410should contain sufficient information to provide the intelligence requested by the community for which DAD400serves. For purposes of description and not limitation, report file410may contain an LLT identification412, a timestamp414indicating a time of the alert, various signal parameters, alert codes, processing variables, etc.,416and power spectral data418. The reports410may be stored in a data repository425for further analysis and archiving. A data analysis processor430may retrieve data from data repository425and perform time series analyses and moving average processing for each data file within the time interval being analyzed. The processed data may be provided to a data fusion processor435by which data from individual LLT's are correlated in space and time. As described above, numerous LLT's may be within an ROC and may be constantly in motion therein. At any moment in time, there is a spatial distribution of such LLT's, each providing a unique sample of signals received thereat. These data may be provided in reports410and assembled by data fusion processing435to produce Monte Carlo-like samples of the ROC. These data are continuously updated, at each time interval a new Monte Carlo sample is provided and a moving average of the signals in ROC110may be provided to ROI footprint processor440. Footprint processor440may employ data fitting techniques, such as least-squares data fitting, to determine the extent and shape of the ROI of a particular SDD. The footprint may be provided to a raw intelligence report processor445, a map correlation processor450, and a geo-referenced intelligent report processor455. At any point in the reporting process, suitable reports may be provided to the community through distribution processor460.

FIG. 5Aillustrates exemplary local level data processing500andFIG. 6illustrates exemplary regional level data processing600. Although entry and exit points are illustrated in the flow charts ofFIG. 5AandFIG. 6, such is for descriptive purposes only. Processes500and600may be continuously performed, and exiting and/or reentry may only be necessary upon a change in operational state of the equipment, such as by the removal of power.

In local level process500, signal features of the carrier signal and intermediate frequency signal are extracted in operation502. Such may include the determination of, among others, CNR, SNR, power spectral density, spectral envelope, peak power and significant power in spectral regions outside the main lobe of carrier signal. In operation504, it is determined whether GPS data can be read from the carrier signal. If not, it is determined whether there is adequate signal-to-noise ratio for data acquisition, as illustrated at operation506. If there is insufficient signal strength, a signal null is reported indicating to the user that the LLT is located in a position where satellites cannot be tracked. If, at operation506, it is determined that there is significant or adequate signal strength, the spectral power at and around the carrier frequency is examined to determine the presence of a service denial device power signature. Such evaluation, illustrated at operation508, may include evaluating the signal strength at different locations on a trajectory to determine whether signal divergence is that of satellite or of a transmitter closer to LLT. Additionally, spectral power in different spectral regions may be evaluated to determine the presence of strong or significant spurious signals which may indicate the presence of a local transmitter that is different than that used on GPS satellite. If the power signature of an SDD is present, as determined in operation514, a jamming alert516is issued to the local user and a report of such is formatted and sent to regional process600.

Various of the signal features described above may be obtained through spectrographic analysis. InFIG. 5B, a spectrogram525is illustrated that represents temporally ordered frequency spectra. That is, for each time period ΔT, a frequency spectrum538is generated from RF and/or IF signals and the spectra are assembled in a temporal sequence to form spectrogram525. It is to be understood that while spectrogram525is graphically illustrated inFIG. 5Bfor purposes of description, the spectrogram may be stored as digital data in onboard storage237without being actually rendered as a graphic.

The signal of interest in the analysis described with reference toFIG. 5Bis that of the RF carrier frequency530, although similar analyses may performed on other signals of interest. The bandwidth531of carrier frequency530and an associated anticipated Doppler and multipath frequency spread533may be used to define an analysis band540centered on carrier frequency530. For purposes of analysis, temporal bounds in spectrogram525may be established to define analysis windows, illustrated inFIG. 5Bas long term estimator window526and short term estimator window527.

In certain embodiments, spectral envelopes are obtained from spectrogram525, which are analyzed to determine main lobe characteristics around the carrier frequency, using both a short term and a long term moving window average, and signal bandwidth using another set of short term and long term moving average windows. The spectral envelope characteristics may be used to determine the respective mean values and variances of average power, peak power and deviations in frequency for each of the four moving average windows. The ordinarily skilled artisan will appreciated that the characteristics of the GPS signal is known a priori, i.e., has fixed parameters that provide reliable characterizations of the true GPS signal in the frequency domain. For example, the spacing of the spectral nulls the spectral envelope of a true GPS signal is a function of the symbol rate, which is known, and of the duration of a single symbol, which is also known. Using the expected spectral envelope and the a priori interval of expectation for the peak power values, interfering sources can be identified in time, energy, and spectral location.

Returning toFIG. 5A, if GPS data are successfully read in operation504, inertial navigation data may be collected in operation510and the spectral power data may be evaluated in operation518in a manner similar to that in operation508. In operation518, it is determined whether the GPS data match the inertial navigation data and whether the power signature is that of an SDD.

FIG. 5Cis a conceptual diagram illustrating an exemplary determination of spoofing as might be conducted in operation518. In the illustrated scenario, a user of LLT595enters the ROI590and proceeds along a trajectory592, which can be tracked by an inertial navigation processor, e.g., inertial navigation processor350inFIG. 3. Meanwhile, however, the GPS data being acquired by LLT595may indicate a trajectory596. Inertial navigation processor350may estimate a location and heading, i.e., trajectory vector594, as LLT595proceeds along trajectory592. Trajectory vector594may be periodically compared to the GPS location and heading, i.e., GPS trajectory vector598, reported on LLT595. Trajectory vectors594,598may be computed at various locations along trajectory592and the difference between the vectors594,598can be determined from parameters defining each, e.g., position and heading. At some point593along trajectory592, analyzer360, for example, may determine that the inertial navigation data determined by SPE356, as characterized by vector594, differs from the GPS data, as characterized by vector598such that, to a statistical likelihood established by, for example, a predetermined difference threshold between statistical qualities, e.g., mean headings over a moving average window, trajectory596as indicated by the GPS data is not trajectory592followed by LLT595. Once such a statistically significant difference between the GPS data and the inertial navigation data has been determined, and the power signature is that of an SDD, as determined in operation518ofFIG. 5A, a spoofing alert520may be generated and provided to the local user as well as to the regional process600. If GPS data and inertial data match, the GPS data can be considered as valid and it is logged as such in operation522.

An exemplary regional data processing process600is illustrated inFIG. 6. Data files from individual LLTs are received in operation605and time series, moving average trajectory analyses are performed on individual files in operation610. In operation615, the trajectory data and individual signal characteristics on the trajectory from each LLT are assembled into a single regional signal profile in a manner similar to the Monte Carlo integration technique discussed above. By such, a map of the ROI, such as that illustrated inFIG. 1B, may be generated and is periodically updated to provide continuous monitoring of changing conditions in ROC. The fused data may be used to generate intelligence reports in operation620, correlated with geographical map data in operation625and geo-referenced intelligence reports may be generated in operation630. Intelligence reports may be distributed to those interested parties depending on the implementation.

FIG. 7illustrates exemplary intelligence collection, analysis and distribution. As illustrated in the figure, LLT710includes a processing system716that may include a processor, such as a microprocessor or microcontroller, memory and a user interface including user controls and a display device. Processing system716may be suitably configured to implement local level detection and analysis, such as that illustrated inFIG. 5as process500. DAD730may include a similar system732to perform, for example, process600.

As LLT710is moved in an ROC, spectral data714may be collected and analyzed as described above. Such analyses may indicate a spectral signature of an SDD, e.g., spatial variations in signal strength that are inconsistent with anticipated R−2signal strength. Additionally, LLT710may decode GPS data712, provided such decoding is not prevented by the presence of a jamming signal. GPS data712and spectral data714may be provided to processing system716, where the determination of jamming and/or spoofing may be determined, as described above. LLT710, as well as other LLTs710in communication with DAD730, generates report files720that include, among other things, information regarding jamming and/or spoofing events, as described above with reference toFIG. 4. Report files720may be stored on the LLT710from which they are generated, as well as being transmitted to DAD730. Report files720from multiple LLTs710are collected at DAD730and the events recorded therein may be analyzed and correlated in space and time to determine the locations and boundaries of ROIs in the ROC to which DAD730is assigned. The results of the analyses, representatively illustrated by report data736, may be disseminated in a variety of formats, each in accordance with the requirements of the destination platform. In certain embodiments, the report data may be geo-referenced in accordance with the trajectories traversed by LLTs710. The geo-referenced data may be overlaid onto map data734to produce situational awareness data740indicating relevant ROIs744, which may be distributed to the pertinent community. Additionally, situational awareness data740may be provided to LLTs710by which a user thereof is made aware of ROIs in surrounding regions. Report data720and situational awareness data740may be maintained on LLTs710for a period of time established by the user, such as a user-selected expiration time.

In certain embodiments, such as inFIG. 8andFIG. 9, individual LLTs may be distributed on a larger moving platform, such as an airplane800or a ship900. Referring toFIG. 8, LLTs806may be distributed in different octants810,820,830,840. Spoofing and/or jamming signatures, such as those described above, may be detected in separate octants as having different spatial distributions of signal power. Accordingly, the direction and type, i.e., airborne or ground-based, of SDD may be determined through an octant-by-octant analysis as the aircraft moves along its trajectory. A similar configuration may be applied to ship900, although the LLTs906may be distributed in different half-sections or quadrants, as opposed to octants.

When embodied in a distributed fashion, such as is illustrated inFIGS. 8 and 9, a determination can be made as to whether spoofing and/or jamming is being attempted from outside or inside the vehicle. When the origin of an attack is outside the vehicle800, the LLTs806in certain quadrants may detect attack signatures that are stronger than at the LLTs806in other quadrants. For example, as illustrated inFIG. 8, an attack850from beneath aircraft800would manifest itself as jamming/spoofing signals in quadrant820that are different from those measured in quadrant810. On the other hand, when the attack occurs inside aircraft800, such as is illustrated at attack860, the relative signal strength measured at LLTs806would be substantially equivalent.

The descriptions above are intended to illustrate possible implementations of the present inventive concept and are not restrictive. Many variations, modifications and alternatives will become apparent to the skilled artisan upon review of this disclosure. For example, components equivalent to those shown and described may be substituted therefore, elements and methods individually described may be combined, and elements described as discrete may be distributed across many components. The scope of the invention should therefore be determined not with reference to the description above, but with reference to the appended claims, along with their full range of equivalents.