# Advanced Smartphone-Based Identification of Transport Modes: Resilience under GNSS-Based Attacks
## 1 Introduction
Therefore, the spoofing attacks represent a major issue for the functioning of ticketing systems, since a faulty navigation signal can be transmitted to one or some smartphones. To do this, the receiver of the smartphone has to unlock from the legitimate navigation signal and lock to the faulty navigation signal. The unlock is usually forced through jamming [6]. The faulty navigation signal can be a real satellite signal recorded with a legitimate GNSS signal, e.g., a replay attack, or a created navigation signal. The replay attack is possible because the integrity and the authentication are checked for the complete message but not for the navigation signal [7]. The faulty navigation signals can be classified into three categories [8]:  
* The **signal simulator**, which uses GNSS signal simulator software connected to generate a signal undifferentiated from a legitimate signal but not necessarily synchronized with the satellite. The commercial GNSS receivers used in smartphones may be vulnerable to this attack if the power of the faulty navigation signal is higher than the legitimate navigation signal. * The **receiver-based spoofer**, which follows the above explained principle but takes the faulty navigation signal from a legitimate navigation signal in order to synchronize the attack. This attack is more complex and thus more difficult to detect. * The **sophisticated receiver-based spoofer**, which is the most complex and effective spoofing attack, since it allows a perfect synchronization between the faulty and the legitimate navigation signal by knowing the receiver position. Nevertheless, this attack is not possible if the exact position of the receiver is unknown, e.g., for moving receivers. In this work, we present two methods for smartphone-based transport mode identification that are resilient to spoofing attacks using the public transport modes subways, trans and buses and the individual transport modes bicycles and walking. The multisensor-based identification of transport modes relies on smartphones' embedded sensors to identify the transport mode, as well as on GNSS. The system-under-attack check uses in this case the discrepancies between both sources of information to detect the attack. The only-GNSSbased identification of transport modes relies only on GNSS to identify the transport modes, and the system-under-attack check uses the GNSS clock drift to detect the attack [9]. We present real measurements recorded with commercial smartphones in Munich (Germany) and Paris (France), to which we add a spoofing attack safely produced in an anechoic chamber. With this work, we therefore put in evidence the vulnerability of the ticketing system against spoofing attacks. The remaining sections are structured as follows. Section 2 explains the methodology followed to record the real-world measurements and to generate the attack in an anechoic chamber. Section 3 is devoted to the presentation of the two novel proposed resilient systems to identify transport modes with commercial smartphones. Section 4 discusses the results obtained with the two proposed systems to identify transport modes in terms of their resilience. Finally, Section 5 concludes the paper.