# Credible Navigation Algorithm for GNSS Attack Detection Using Auxiliary Sensor System
## 3 Credible Navigation Algorithm
### Algorithm Design  
According to the optimization theoretical model above, we designed the ACNA method to detect whether the GNSS was subjected to jump or slow-change attacks, based on whether the GNSS drift exceeds the credible verification threshold within the credible verification window. In order to maximize the accuracy of the algorithm and minimize the risk of algorithm integrity and availability, the updated model of the filter was selected adaptively to obtain the credible navigation prediction. At time \(k\), when the mobile terminal has a positioning requirement, it receives the GNSS signal and calculates the position of the mobile terminal as \(\rho_{k}^{\text{G}}\). At this time, the estimated position obtained from the auxiliary sensor system is \(\rho_{k}^{\text{DI}}\)  
\[ \begin{split}\rho_{k}^{\text{G}}&=[\epsilon_{k}^{ \text{G}},n_{k}^{\text{G}},u_{k}^{\text{G}}]\\ \rho_{k}^{\text{DI}}&=[\epsilon_{k}^{\text{DI}},n_{k}^ {\text{DI}},u_{k}^{\text{DI}}]\end{split}  \tag{25}\]  
After acquiring the GNSS signal in the current positioning time slot, ACNA enters the GNSS interruption verification stage in order to determine whether the GNSS signal acquired is valid. If the GNSS signal is invalid (\(\rho_{k}^{\text{G}}=\mathbf{V}\) and \(\mathbf{V}\) means the signal is invalid) at this time, it is concluded that the GNSS signal is interrupted, and the system sends a GNSS signal interruption alarm to the mobile terminal. Then, the auxiliary updated model is selected to filter and update the position prediction until the GNSS is determined to be valid (\(\rho_{k}^{\text{G}}\
eq\mathbf{V}\)). After that, the data of GNSS and auxiliary sensor system are extracted and processed, and the jump attack detection stage is entered. In the GNSS jump attack detection stage, the credibility of the GNSS positioning results can be verified through \(\Delta\rho_{k}\), \(n_{\text{j}}\), and \(Th_{\text{j}}\). For the consecutive positioning time slots \(n_{\text{j}}\), the GNSS drift \(\Delta\rho\) should be determined between each positioning time slot. The jump mark flag\({}_{\text{j}}\) tracks and records the GNSS signal jump, as  
\[\text{flag}_{\text{j}}(k)=\left\{ \begin{array}{ll}\text{flag}_{\text{j}}(k-1 )+1&\Delta\rho_{k}>Th_{\text{j}}\\ 0&\Delta\rho_{k}\leq Th_{\text{j}}\end{array} \right.. \tag{26}\]  
If \(\text{flag}_{\text{j}}(k)\geq n_{\text{j}}\), it is verified that a GNSS jump attack has occurred, as shown in Figure 3. At this time, GNSS is judged to be in the untrusted stage, and the auxiliary update model is selected for terminal position prediction, and a jump alarm was issued at the same time. If no GNSS jump attack occurs, the algorithm enters the GNSS slow-change verification stage, and the GNSS positioning result is verified based on \(\Delta\rho_{k}\), \(n_{s}\) and \(Th_{\text{s}}\). For the consecutive positioning time slots \(n_{s}\), the GNSS drift \(\Delta\rho\) in each slot should be tracked and recorded by the slow-change mark flag\({}_{\text{s}}\). At time \(k\), \(\text{flag}_{\text{s}}(k)\) represents the statistical average of GNSS drift from time \(k+1-n_{s}\) to \(k\), as  
\[\text{flag}_{\text{s}}(k)=\sum_{i=1}^{n_{s}}\Delta\rho_{k+i-n_{s}}/n_{s}\,. \tag{27}\]  
If \(\text{flag}_{\text{s}}(k)\geq Th_{\text{s}}\), it is verified that GNSS drift exceeds the threshold from time \(k-n_{s}\) to \(k\) during the slow-change verification window, which means a GNSS slow-change attack  
Figure 3: GNSS jump verification. may occur, as shown in Figure 4. At this time, GNSS is judged to be in an untrusted stage, and the auxiliary update model is selected for terminal position prediction, and at the same time, a slow-change alarm is issued. If there is no interruption or jump/slow-change attack on the GNSS signal, the GNSS is judged to be in a credible stage, and the credible update model is selected for the filtering update and position prediction. The algorithm flowchart is presented in Figure 5 and the logical flow of the algorithm is explained as follows:  
Step 1: Initialization.