GPS Multi-Receiver Joint Direct Time Estimation and Spoofer Localization

Transcription

1 GPS Multi-Receiver Joint Direct Time Estimation and Spoofer Localization Sriramya Bhamidipati and Grace Xingxin Gao, Senior Member, IEEE Abstract We propose a novel algorithm on joint estimation of spoofer location (LS) and GPS time using Multi-Receiver Direct Time Estimation (MRDTE). To achieve this, we utilize the geometry and known positions of multiple static GPS receivers distributed within the power substation. DTE computes the most likely clock parameters by evaluating a range of multi-peak vector correlations, each of which is constructed via different pregenerated clock candidates. Next, we compare the time-delayed similarity in the identified peaks across the receivers to detect and distinguish the spoofing signals. Later, we localize the spoofer and estimate the GPS time using our joint Particle and Kalman Filter. Furthermore, we characterize the probability of spoofing detection and false alarm using Neyman Pearson decision rule. Later, we formulate the theoretical Cramér Rao lower bound for estimating the localization accuracy of the spoofer. We validate the robustness of our LS-MRDTE by subjecting the authentic, open-sky GPS signals to various simulated spoofing attack scenarios. Our experimental results demonstrate precise localization of the spoofer while simultaneously estimating the GPS time to within the accuracy specified by the power community (IEEE C Standard for Synchrophasors). makes the signals susceptible to jamming and spoofing [14]- [15]. In addition, the GPS civil signals are unencrypted, with their pseudo-random codes explicitly described in publicly available documents [16]. This allows spoofing attacks to be successful [17]-[19]. (a) Meaconing attack (b) Data-level spoofing attack Keywords Spoofing Detection, Localization, Multi-Peak Vector Correlation, Cramér Rao Lower Bound I. INTRODUCTION In power grid, Wide Area Monitoring System (WAMS) [1] [3] depends on time-synchronized phasor (voltage and current) measurements obtained from distributed Phasor Measurement Units (PMUs) [4]. These PMU measurements are crucial for high-resolution monitoring and early-stage detection of grid destabilizing conditions. A. Precise timing for PMUs PMUs maintain network-wide synchronization by timetagging the recorded phasor values using time sources [5] such as GNSS, external clocks, Network Time Protocol (NTP) [6], Precise Time Protocol (PTP) [7] and so on. Sources such as external clocks [8], NTP and PTP, even though capable of providing microsecond time accuracy, experience clock drift over time [9] and are prone to de-synchronization attacks [10]. GNSS signals such as GPS, have global satellite coverage, extensive ground station infrastructure and are therefore capable of providing ±100 ns time accuracy [11]. By utilizing standalone GNSS or sources such as external clock, NTP and PTP in conjunction with GNSS, network-wide stability monitoring of the power grid is efficiently achieved [1]. Therefore, GNSS is an invaluable tool in obtaining timesynchronized PMU measurements for future power systems. However, the power of received GNSS signals is as low as W, which is below the thermal noise floor [13]. This (c) Signal-level spoofing attack Fig. 1: Types of spoofing attacks: (a) meaconing attack involves replay of GNSS signals to delay the victim s computed time solution; (b) data-level spoofing transmits incorrect navigation message; (c) one scenario of intelligent signal-level spoofing generates spoofing signals to trick the receiver into tracking the spoofing peak. B. Impact of spoofing attacks The susceptibility of GNSS signals to spoofing leads to potential threats in the power system. Spoofing involves broadcasting counterfeit look-alike GNSS signals to mislead the PMU with incorrect time and thereby disrupt the power grid stability. A spoofer aims to maximize the time error induced while minimizing the probability of being detected. Various spoofing attacks defined by the GNSS community are summarized as follows: 1) Meaconing: A spoofer executing meaconing attack as seen in Fig. 1(a), is either a repeater or a record-andreplay, that delays the target receiver s computed time as compared to the true time [0]. To execute this attack, the spoofer doesn t require the knowledge of encryption codes and is thereby capable to spoof even the receivers 1

2 that utilize military signals with unknown encryption codes. ) Data-level spoofing: In data-level spoofing, a spoofer modifies the content of navigation message [1] such that the satellites are shifted in position along their Lineof-Sight (LOS) to the target receiver as in Fig. 1(b). This causes the receiver to estimate the correct location but wrong time thereby covertly manipulating the PMUs. 3) Signal-level spoofing: One scenario of a sophisticated signal-level spoofing is a three-stage attack as shown in Fig. 1(c). At first, a spoofer, in general a signal simulator, generates and broadcasts counterfeit GNSS signals identical to the authentic signals received at the target receiver []-[3]. In the second stage, the power of these malicious signals is slowly increased to mislead the target receiver to lock onto these counterfeit signals. Once locked, the spoofer manipulates the receiver time by changing the time of signal transmission slowly away from the correct value. Since there is no sudden change in the GNSS timing output, this method cannot easily be detected by traditional methods. In this context, the IEEE C describes certain standardized measures to evaluate the power grid stability based on Total Vector Error (TVE), Frequency Error (FE) and Rate of Change of Frequency (ROCOF) [4]. The spoofer aims to manipulates the GPS time in variety of ways ranging from gradual attacks such as signal-level spoofing to sudden jumps caused by meaconing. Given this, we consider 1% TVE equivalent to a timing error of 6.5 µs, as a benchmark in our power grid stability analysis [5]-[6]. Researchers have demonstrated the hazardous threats of spoofing by successfully hijacking the GPS on-board critical infrastructure such as an $80 million yacht [7] and an unmanned aerial vehicle [8] using a $1000 equipment. Furthermore, tests have been conducted to demonstrate the vulnerability of GPS timing provided to PMUs in the presence of spoofing attacks [19]. In addition, a mass-spoofing incident which occurred near the Russian port of Novorossiysk in the Black Sea has recently gained worldwide attention. During this attack by unknown sources, the GPS systems of more than 0 ships reported approximately the same wrong location that is around 5 nautical miles off [9]-[30]. This real-world incident has demonstrated that spoofing is indeed a real danger to critical infrastructure that relies on GPS for its safe operation. C. Related Work Prior research [31] analyzes the requirements to perform successful spoofing attacks and theoretically identifies the location and precision with which the attacker needs to generate the corresponding spoofing signals. Another work [3] outlines the characteristics of spoofing attacks and describes their spatial as well as the temporal effect on the receivers. Papers summarizing various existing countermeasures of spoofing based on signal processing, encryption, drift monitoring, multiple antennas, signal geometry have been described in [33]-[35]. A simple spoofing detector has been proposed in [36] which analyzes the position data against a pre-defined threshold based on Neyman-Pearson decision rule. Another probabilistic countermeasure has been proposed in [37] that leverages the underlying correlation between the errors at co-located receiver positions to detect the presence of spoofing attacks. The increase in complexity of placing a successful spoofing attack has been demonstrated by observing the L1 carrier differences between multiple receivers in [38]. A spoofing resistant GPS receiver known as SPREE has been proposed in [39], that detects the spoofing signals using auxiliary peak tracking technique and analyzes its theoretical and practical bounds within which it successfully tracks the malicious signals. Different signal quality monitoring techniques have also been proposed to tackle the varying complexity of spoofing attacks on civilian GPS signals. Some of the state-of-the-art techniques deal with analyzing the physical characteristics of the signal such as carrier-to-noise ratio C/N 0 monitoring [40] and automatic gain control [41]-[43]. Sophisticated spoofing detector based on multi-hypothesis Bayesian classifier [44] has been developed which simultaneously monitors the receiver power and distortion of the complex correlation function. Other spatial processing approaches utilize antenna arrays [45]-[48] to detect external spoofing attacks based on the phase delay measurements and the direction of angle-of-arrival of the incoming satellite signals. In addition, several signal authentication-based countermeasures have been developed to authenticate the received GNSS signals. One such technique includes ensuring the presence of strong cross-correlation between the encrypted military signals received at the target and a secure reference receiver [49]- [51]. In modern GNSS civilian signals namely GPS L1C and Galileo E1-B Open Service [5], navigation message authentication mechanisms [53]-[54] based on cryptographic bits such as delayed-symmetric-key spread spectrum security code and asymmetric private-key/public-key are being explored to harden these signals against spoofing attacks. In addition to detection, spoofing mitigation and localization algorithms are advantageous in securing the GNSS timing in power systems. While detection techniques are effective in raising an alert, mitigation approaches enable continued robust operation of the power system even during GNSS spoofing outrage. In addition, localization techniques pinpoint the source of spoofing signals, which is communicated to the relevant authorities for further action. In [55] researchers analyze the security of GPS timing in PMUs against spoofing attacks by detecting and localizing the attack source using time-difference-of-arrival and multi-lateration techniques. In our prior work, we propose our novel Direct Time Estimation (DTE) algorithm to improve the robustness of the GPS timing supplied to the PMUs [56]. We extend our work to Multi-Receiver Direct Time Estimation (MRDTE) that utilizes the known location of the spatially dispersed receivers to further improve the GPS timing robustness against external attacks [57]. In this work, we validate the improved attackresilience of our MRDTE-based timing as compared to the scalar tracking-based timing.

3 D. Our contributions To address civil GNSS spoofing which is a complex and sophisticated external timing attack, we develop a joint estimation algorithm of spoofer location (LS) and receiver time using MRDTE. We perform multi-peak vector correlation to detect the spoofing signals and later localize the spoofer using joint Particle and Kalman Filter. In our prior work [57], we describe the framework of MRDTE and in [58] we demonstrate the preliminary results of our LS-MRDTE. In this paper, we present our new contributions in the following aspects: 1) To analyze the localization accuracy of the spoofer obtained using our LS-MRDTE, we theoretically estimate the Cramér Rao Lower Bound (CRLB) [59] as a function of the MRDTE-based measurements, geometry and positions of multiple receiver setup. Furthermore, we derive the covariance of the MRDTE-based measurements computed via multi-peak vector correlation. ) We also characterize the probability of spoofing detection and false alarm using likelihood ratio test and Neyman-Pearson decision rule [60]. 3) Considering the geometry constraints of an actual power substation, we conduct extensive experiments to validate the accuracy of the GPS time and spoofer location subjected to different scenarios of simulated spoofing attacks such as meaconing and data-level spoofing. As compared to the prior research on spoofing detection and localization, the key advantage of LS-MRDTE is due to its underlying DTE framework, which is based on the concept of Direct Position Estimation (DPE) [61]. DTE computes the most likely clock parameters by directly correlating the received signal with a range of signal replicas, each of which is constructed via different pre-generated clock candidates [6]. Instead of discarding the information obtained from weak satellite signals, DTE aids the correlation manifold of weak satellites with those with strong signal strengths to concur on the most likely clock parameters [63]. The variance of our one-step direct estimator, i.e., DTE is less than or equal to the variance obtained via two-step estimator [64]. Therefore, our LS-MRDTE ensures an increased accuracy in estimating the spoofer location and GPS time as compared to multi-lateration-based localization techniques that utilize time difference of arrival or received signal strength measurements. Our LS-MRDTE which combines the DTE framework with multiple receiver setup can efficiently operate under various spoofing attack scenarios. Unlike many existing works described in Section I-C that either focus on spoofing detection or localization, our LS-MRDTE can perform detection, mitigation as well as localization. This enables continued reliable operation of PMUs even during the presence of external spoofing attacks. The rest of the paper is organized as follows: Section II describes our LS-MRDTE in detail, estimates the CRLB of our spoofer localization, and computes the probability of spoofer detection and false alarm. Section III validates the accuracy of our LS-MRDTE in locating the spoofer and estimating the GPS time, when subjected to simulated spoofing attacks. Section IV concludes the paper. II. JOINT ESTIMATION OF SPOOFER LOCATION AND GPS TIME USING MRDTE We propose our LS-MRDTE to simultaneously localize the spoofer and provide attack-resilient GPS timing to PMUs. In this work, we formulate our algorithm for L1 C/A GPS signals, but same architecture can be applied to other civil GNSS signals. A. GPS signal model We aim to estimate the GPS receiver clock bias cδt and clock drift cδṫ, which are used to compute the Universal Time Coordinated (UTC) time that is later provided to PMUs. We leverage the static infrastructure of the power substation to precompute the position (X k = [x, y, z] k ) and velocity (Ẋk = [ẋ, ẏ, ż] k ) of L (> 3) widely dispersed receivers [65] and use this information for aiding our LS-MRDTE algorithm. In addition, all the receivers in our setup are synchronized using the 1P P S signal obtained from a common external clock. The GPS signal replica Y, given by Eq. (1), is composed of a low-rate navigation bit sequence D i ( ), a unique L1 C/A code sequence C i ( ) and a sinusoidal carrier sequence exp{ }. The superscript i indexes the N satellites in view. As seen in Eq. (), the i th satellite signal depends on 4 parameters that include carrier properties denoted by the frequency fcarr i and phase φ i carr and C/A code properties denoted by frequency fcode i and phase φi code. with Y (t) = N D i (t) C i (fcodet i + φ i code) i=1 f i code = f C/A + f C/A φ i code = f C/A c f i carr = f IF + f i D, { } exp jπ(fcarrt i + φ i carr), f L1 f i D ( X k X i s + (cδt T i s) where c = m/s is the velocity of light, f L1 = MHz represents the nominal carrier frequency and f C/A = 1.03 MHz is the nominal C/A chipping rate of the transmitted L1 GPS signals. f IF denotes the intermediate frequency after down-conversion. Xs, i Ẋs i denotes the position and velocity of the i th satellite. Ts i and T s i denotes the i th satellite clock corrections. fd i denotes the carrier Doppler frequency of the i th satellite given by fd i = f ( L1 (X k X i ) s) c X k Xs i (Ẋk Ẋi s) + (cδṫ T s) i. ) (1) () B. Overview of DTE and MRDTE The underlying principle of our LS-MRDTE depends on our novel DTE technique, which evaluates the most likely clock bias and clock drift from a pre-generated set of M clock candidates. To achieve this, we compute the cumulative satellite 3

4 vector correlation of the received GPS signal s R with the signal replica Y (g j ) as in Eq. (3) for each grid point g j = [cδt j, cδṫ j ]. The details of our DTE algorithm are explained in our prior work [56]. Λ j (g j ) : Vector correlation for the j th grid point N = R(s R, Y i (g j )), j = 1,..., M i=1 [cδt, cδṫ] = arg M max j=1 Λ j where R(.,.) denotes the correlation function. In our MRDTE algorithm, at each k th receiver, we execute cumulative vector correlation across the pre-generated clock candidates and later compute the joint correlation manifold across the receivers. Therefore, we leverage the information redundancy and geometrical diversity of the receivers to improve the robustness of GPS timing provided to the PMUs. Detailed specifics regarding our MRDTE algorithm and its comparison with other existing receiver algorithms is found in our prior work [57]. (3) the receivers to categorize them as either authentic or spoofed. This is seen in Fig. 3. 4) In our multi-receiver setup, we designate one of the receivers as master and the rest as slaves. Thereafter, we calculate the shift in the detected malicious peak across each master-slave pair and for authentic peaks, we compute the non-coherent summation across the satellites for each receiver. 5) Lastly, we execute our Joint Filter module which consists of a Particle Filter that localizes the spoofer; and a Kalman Filter that collectively processes the most likely clock parameters obtained from different receivers to estimate the GPS time. D. Our LS-MRDTE Algorithm In our algorithm, we consider a single spoofer to be present in the direct LOS of our multi-receiver setup and therefore, affects all the satellites and receivers. We also assume that the spoofing signals follow free space path loss model [66]. In this subsection, we will briefly describe our LS-MRDTE algorithm whose detailed explanation is provided in our prior work [58]. Fig. : High level architecture of our LS-MRDTE: First, we perform multi-peak vector correlation to detect significant peaks in the considered search space. Later we compare the time-delayed similarity of detected peaks across the receivers to distinguish the authentic peaks from that of malicious peaks. Thereafter, we execute our Joint Filter module consisting of Particle Filter that localizes the spoofer and Kalman Filter that estimates the authentic GPS time. C. Architecture of LS-MRDTE As shown in Fig., our proposed LS-MRDTE addresses the spoofing attacks as follows: 1) At each k th receiver, we generate a -dimensional (D) search space consisting of plausible candidates of clock bias and clock drift. ) Next, we execute multi-peak vector correlation at each receiver, to detect significant peaks in the considered search space. 3) For each satellite, we compare the time-delayed similarity in the occurrence of the above-detected peaks across Fig. 3: In our LS-MRDTE, time-delayed similarity in the signals received by multiple receivers are utilized to detect and localize the spoofer. 1) Spoofer detection module: By utilizing the known 3D position and velocity of the satellites and receivers, we generate a combined satellite signal replica corresponding to each of the grid points g j as in Fig. 4. At the individual receiver level, multi-peak vector correlation computes the correlation amplitude, which depends on clock bias candidate cδt j as in Eq. () and spectrum magnitude, which depends on clock drift candidates cδṫ j. For computational efficiency, we separate our calculations into two independent threads as cδt cδṫ 1 : : T cδt = cδt j 0 and T = : : cδṫ 0 cδṫ j cδt M 0 0 cδṫ M Under spoofing attack, we observe multiple (>= 1) significant peaks in the correlation amplitude plotted against the clock bias candidates as in Fig. 5 as opposed to single 4

5 clear peak in authentic scenarios as seen in Fig. 4. Across the satellites, we observe that the peaks occur consistently at approximately the same clock candidates where red, dotted line passes through the malicious peak and the green, dotted line passes through the authentic peak. Fig. 4: Detailed flow of vector correlation. Refer to [56]. A similar comparison conducted across the spatially dispersed receivers as in Fig. 5(b), shows that the malicious peaks are shifted in clock candidates based on their proximity to the spoofer. After this non-coherent summation across the satellites is carried out at the individual receiver level to obtain weights that correspond to the likelihood of each grid point g j. Here, the non-coherent summation is carried out so as to ensure early-stage detection of spoofing attacks, i.e., at satellite level. For authentic signals, principle of MLE is carried out to obtain the most likely clock parameters. (a) Across satellites (b) Across receivers Fig. 5: Under spoofing, multiple peaks are detected in the multi-peak vector correlation. The clock bias candidate that correspond to malicious peak and which passes through the red, dotted line is consistently the same across satellites and shows a significant shift across receivers. The green, dotted line passes through the authentic peak detected is consistently the same across both satellites and receivers. For spoofing signals, one of the receivers is designated as master (k = 1) and the others as slaves (k =,.., L). We compute the shift in the malicious peak for each master-slave pair which is equivalent to the difference in the range of receivers from the spoofer as seen in Eq. (4). Therefore, we not only detect the counterfeit signals but also distinguish them from that of authentic signals. ( ) ζ 1k = m 1k X sp = X 1 X sp X k X sp ( ) ( ) = r 1 X sp r k X sp ζ = ζ 1 : ζ 1k ζ 1L = cδt MP1 cδt MP : cδt MP1 cδt MPk cδt MP1 cδt MPL where m 1k denotes the receiver-spoofer measurement model given by the difference in distance between the master-spoofer and slave-spoofer. In addition, m(.) = [m 1,..., m 1L ] stacks the measurement function m 1k across each master-slave pair. Given the known positions of receivers, the unknown variable is X sp which denotes the spoofer location to be estimated using our LS-MRDTE. cδt MPk represents the clock candidate (in m) that corresponds to the malicious peak MP k found in the k th receiver as seen in Fig. 5. By utilizing the time-delayed similarity depicted in Fig. 3 the difference in malicious peaks across master-slave pair ζ 1k obtained from our multi-peak vector correlation module serves as measurement for Particle Filter. ζ vector stacks these difference in malicious peak measurements for each master-slave receiver pair. ) Joint Particle and Kalman Filter module: Based on position aiding and measurements from the spoofer detection module, the unknown spoofer is localized using Particle Filter branch of the Joint Filter module. Simultaneously, the Kalman Filter branch of the Joint Filter collectively processes the maximum likely clock parameters obtained from different receivers to estimate the corrected clock bias and clock drift parameters. Particle Filter In Particle Filter, we generate α particles ˆXn,sp, n = 1,..., α around the initial guess which is assumed to be the centroid of our multi-receiver setup. The geographical area to be spanned, distribution and number of particles are considered based on the receiver setup during the initialization phase. P wn = 1 { (ζ ˆζn,sp ) } exp πσ Σ P wn P wn = α n=1 P w n ˆζ n,sp = m( ˆX n,sp ) In Eq. (5), Σ represents the measurement covariance matrix, which is formulated in Section II-F. ˆζ n,sp denotes the predicted measurement vector ζ corresponding to ˆX n,sp, obtained from the measurement model given in Eq. (4). P wn denotes the (4) (5) 5

6 Gaussian-based weight distribution of random variable w n representing the associated weight of each particle n. First, we update the weights of all the α particles using Eq. (5). After obtaining the weights, we randomly re-sample new set of particles from the cumulative distribution of the weights P wn. Later, the mean of these particles is assigned as the estimate of the spoofer at that particular instant. Finally, the state of the particles are predicted for the next instant based on the uniform velocity state transition matrix and process noise covariance matrix Q sp. The coefficients of Q sp are determined from a least squares fit to acceleration time data of a generic vehicle and Allan deviation [67] of a generic receiver clock. Kalman Filter In Kalman Filter, we process the the measurement error vector e t, as seen in Eq. (6), obtained from the most likely clock parameters of the authentic peak. Based on this, we obtain the corrected clock parameters T t. In Eq. (6), ˆTt, ˆPt denotes the predicted state and the predicted state error covariance matrix, R t denotes the measurement noise covariance matrix, K t denotes the Kalman gain matrix and H represents the corresponding measurement model. e t = T t,1 ˆT t : T t,k ˆT t T t,l ˆT t T t = ˆT t + K t e t P t = (I K t H) ˆP t K t = ˆP t H T (H ˆP t H T + R t ) 1 [ H = Later, we linearly propagate the clock parameters based on the first order state transition matrix F to predict the common clock parameters for the next time instant t + 1 as [ ] 1 T F = 0 1 [ ] (7) 0 T Q t = F 0 (cσ τ ) F T where T is the update time interval, Q t represents the process noise covariance matrix and σ τ denotes the Allan deviation of the front-end oscillator. E. Under-constrained spoofer localization conditions In Section II-D, we describe our algorithm by assuming that the spoofer is in the field-of-view of all L receivers in our multi-receiver setup and that the spoofing signals follow the free space path loss model. However, in practical conditions, a spoofer can affect L number of receivers. This may occur due to the presence of obstructions such as buildings, trees, ] T (6) vehicles and so on or due to a negligible effect of spoofer on a receiver based on their geographic separation. In such conditions, our multi-peak vector correlation detects multiple peaks in receivers affected by spoofing and single peak in those not attacked by spoofing. Thereafter, by comparing the time-delayed similarity of detected peaks across the receivers, as explained in Section II-D1, we can still accurately detect and distinguish the authentic and spoofed signals. In our Joint Filter module, we utilize all the receivers to compute GPS time whereas to estimate the spoofer location, we only utilize the receivers that observe spoofing. However, if the number of receivers affected by the spoofer fall below four, our Particle Filter-based spoofer localization becomes under-constrained and can no longer pinpoint to the 3D location of spoofer. However, we can still gather partial statistics regarding the spoofer location such as the bounded area within which the spoofer lies. In other practical scenarios, for certain receivers, the authentic peaks are significantly lower in magnitude than the spoofed peaks and therefore indistinguishable from the noise floor. In such conditions, only spoofed peaks are detected by our multi-peak vector correlation. By utilizing our spoofing detection module as explained in Section II-D1, we can still detect the presence of spoofing attacks. If authentic peaks are observed in 1 receivers, we can utilize our Kalman Filter to estimate the GPS time. However, if none of the receivers detect authentic peaks, then the GPS time is propagated via time update step of our Kalman Filter. F. Localization accuracy using CRLB The factors related to receiver setup such as number of receivers, their spatial geometry, distance between receiver and spoofer affect the accuracy of spoofer localization. In addition, localization accuracy also depends on the covariance of our LS-MRDTE-based measurements, i.e., most likely clock candidates that correspond to malicious peaks as referenced in Eq. (4). To assess the impact of these factors, we evaluate CRLB metric, a measure of the localization accuracy attained based on the incoming GPS signal. The CRLB gives a lower bound on the achievable asymptotic covariance using any unbiased estimator (in our case maximum likelihood estimation). This lower bound, described in Eq. (8), is computed as the inverse of Fisher Information (FI) seen in Eq. (9). The CRLB is formulated as follows: ] E [(X sp χ)(x sp χ) T = J 1 (8) and J = E [ χ lnp ( ζ χ )( χ lnp ( ζ χ )) ] T, (9) where E [. ] denotes the expectation operator, J represents the FI matrix, X sp is the estimate of the spoofer from our LS- MRDTE and spoofer location χ is our parameter of interest. In our LS-MRDTE algorithm, we consider a pre-determined receiver positions and their geometry based on the constraints 6

7 of power substation. Assuming additive Gaussian measurement noise, ) the ( ) variance ( ) of the spoofing ( ) signals is given by σ1k( χ = σ 1 χ + σ k χ, where σ k χ, k = 1,..., L is the variance of measurements estimated using our LS-MRDTE. Based on this assumption, the likelihood function is expressed as L ( χ ζ ) = p ( ζ χ ) { exp 1 (ζ m ( χ )) T ( Σ 1 χ )( ζ m ( χ ))} = πσ ( χ ), (10) and taking logarithm gives ln (p ( ζ χ )) = 1 (πσ ln ( χ )) 1 (ζ m ( χ )) T Σ 1( χ )( ζ m ( χ )) (11), where σ1 + σ σ1... σ 1 Σ ( χ ) σ1 σ1 + σ3... σ1 ( ) =..... χ... σ1 σ1... σ1 + σl Substituting Eq. (11) into Eq. (9), we obtain the FI matrix J in terms of receiver geometry and measurement covariance of size 3 3 for 3-dimensional (3D). Based on [68], for i, j = 1,, 3, representing the dimensionality of 3D spoofer position χ, elements of the FI matrix are represented as: ( ( )) m χ T J ij = Σ 1( χ )( m ( χ ) ) + 1 tr χ i χ j (Σ 1( χ ) Σ( χ ) Σ 1( χ ) Σ ( ) χ χ i χ j where ( ) m 1 χ m ( χ ) χ ( i ) m 13 χ = χ i = χ i. ( ) m 1L χ χ i r 1,i r 1,i r 1,i r 1 ), w (1) + r,i r 1 r + r 3,i r 1 r r L,i r L Based on Eq. (1), we denote J = J wdop +J Σ where J wdop, m ( χ ) depends on the geometry of multi-receiver, i.e., and χ i J Σ represents the dependency of LS-MRDTE covariance Σ on the spoofer location. In Eq. (1), we define the inverse of first part of J, i.e., J 1 wdop as the Weighted Dilution Of Precision (WDOP). WDOP characterizes the spoofer-receiver geometry. Lower the value of WDOP, lower is the error e sp given in Eq. (13), thereby, better is the estimate of our spoofer location. σ sp,x = ( J wdop ) 1 11, σ sp,y = ( J wdop ) 1, σ sp,z = ( J wdop ) 1 33 e sp = σ sp,x + σ sp,y + σ sp,z = W DOP, (13) where σsp,x, σsp,y and σsp,z are the respective x, y, z covariances. e sp is the 3D root-mean-square error in the spoofer location that is attained for the given configuration of receiver geometry and measurements. The inverse of second part of J, i.e., J 1 Σ depicts the influence of our LS-MRDTE-based covariance in determining the accuracy of spoofer location. Therefore, we estimate the covariance of the measurements given by Σ ( χ ) ) i.e., σk( χ to obtain a bound on the localization accuracy given by J 1. Our LS-MRDTE is based on DTE, which estimates the most likely clock parameter from a pre-generated set of considered clock candidates. Since MLE is asymptotically efficient i.e., unbiased estimator, the measurement covariance of spoofing peak is equal to the inverse of its corresponding FI matrix [?]. σ k ( ( ) N { ( ( ( ) T }) 1 p sr,k µ i cδtmpk = k) p sr,k µ k) i E, cδt i=1 MPk cδt MPk (14) where µ i k = [ φ i code, f ] code i denotes the code phase and code k frequency of GPS spoofing signal corresponding to the clock candidate cδt MPk and is calculated using Eq. (). For k th receiver, the probability of incoming GPS signal s R,k given C/A code-based parameters φ i code, f code i, i.e., p ( s R,k µ i), follows a Gaussian distribution with covariance σµ and is expressed as i and p ( s R,k µ i) = 1 { exp πσ 1 (s i µ σ R,k Y ( µ i)) } i µ i k (15) p ( s R,k µ i) ( ) T ( µ i p sr,k µ = k) i (16) cδt cδt µ i Thereafter, we write the Eq. (14) as σk ( ) ( ) χ = σ k cδtmpk [ N {( ) T ( p sr,k µ k) i = E i=1 µ i k cδt MPk µ i ( ( ) T p sr,k µ k) i µ i k µ i k cδt MPk }] 1 7

8 = [ N ( i=1 µ i k cδt MPk µ i k ) T E ] 1 { ( ( ( ) T } p sr,k µ k) i p sr,k µ k) i µ i cδt MPk [ N ( ) T ] 1 µ i k = J R,k(µ i µ i k cδt k), MPk cδt MPk i=1 µ i k (17) where J R,k (µ i k ) is the FI matrix of µi k corresponding to kth receiver and is calculated from Eq. (15) and Eq. (16). From Eq. (), we calculate the derivative of our code phase and carrier frequency with respect to the clock candidate as: µ i [ = f T C/A 0] (18) cδt MP c Substituting ) Eq. (18) in Eq. (17), we obtain the covariance σk( χ as ( ) [ σk ( ) c N [ ( ) ] 1 χ = J R µ i k (19) 11] f C/A i=1 The above expression for σ k( χ ) is substituted in Eq. (1) to obtain the lower bound of the localization accuracy for a given configuration of multiple receivers. In addition, the value of J 1 can be minimized to compute the optimum locations for the placement of multiple receivers. Thus, we provide mathematical insights into choosing the parameters related to multi-receiver setup by analyzing the corresponding CRLB of localization accuracy attained. G. Receiver Operating Characteristic (ROC) Based on Eq. (19), the spoofing peak detected using our multi-peak vector correlation follows a Gaussian distribution given by ( ) H 0 : Γ 1k = N 0, σ 1k H 1 : Γ 1k = ζ 1k + N ( 0, σ 1k ), (0) where the observations are represented by Γ 1k, H 0 denotes the null hypothesis that spoofing is not detected whereas H 1 represents the alternate hypothesis that indicates the detection of a spoofing attack. Therefore, the conditional probability for the observation Γ 1k is given by 1 { } p 0 (γ) = exp γ πσ 1k p 1 (γ) = 1 { exp πσ 1k σ 1k ( γ ζ1k ) σ 1k where γ R. p 0 (γ) denotes the conditional probability under null-hypothesis H 0 and p 1 (γ) denotes the conditional }, probability under alternate hypothesis H 1. Based on this, the likelihood ratio is computed as L(γ) = p { 1(γ) p 0 (γ) = exp ζ ( 1k σ1k γ ζ )} 1k Using Neyman Pearson detection rule [60], δ NP (γ) = { 1 if γ κ 0 if γ < κ (1) () where κ is the Neyman Pearson decision threshold on the random variable Γ 1k. Then, the probability of false alarm and detection are given as follows: ( P F (δ NP ) = P 0 Γ1k κ ) ( κ ) = 1 Φ σ 1k ( P D (δ NP ) = P 1 Γ1k κ ) ( κ ζ1k ) (3) = 1 Φ σ 1k where Φ denotes the cumulative density function of N (0, 1) random variable. A plot of P D (δ NP ) and P F (δ NP ) = α known as the ROC curve is obtained as follows: κ = σ 1k Φ 1 (1 α) (4) where Φ 1 : 0, 1 R is the inverse of Φ distribution. Thereafter, the probability of detection expressed in terms of α is given by ( κ ζ1k ) ( ) P D (δ NP ) = 1 Φ = 1 Φ Φ 1 (1 α) d σ 1k ζ 1k (5) where d = σ 1k denotes weighted LS-MRDTE-based measurements indicating confidence in the detected malicious peaks MP 1 and MP k. Based on this, the ROC curve for spoofing detection is plotted in log10 scale as seen in Fig. 6. We observe that as the value of performance metric d increases, for a given false alarm probability, we achieve higher probability of spoofing detection. For instance, in Fig. 6, given α = 10 6 indicated by black, dotted line, for d = 3, P D = 0.048, d = 4, P D = 0.3, d = 5, P D = 0.606, d = 6, P D = and d = 7, P D =

9 OctoClock CDA-990. Each USRP-N10 is equipped with a DBSRX daughter board which is capable of receiving RF signals within the frequency range of GHz. We collect the authentic GPS data at a sampling rate of.5 MHz and each raw sample is a 3-bit complex, with the real and imaginary parts occupying 16 bits each. The collected raw GPS signals are post-processed using our software defined radio platform PyGNSS [69] which is a python-based object oriented framework. Fig. 6: ROC curve for our Gaussian hypothesis testing based LS-MRDTE. As the value of performance metric d increases, we achieve higher probability of spoofing detection and for a given false alarm α, i.e., for α = 10 6 indicated by black, dotted line and d = 3, P D = 0.048, d = 4, P D = 0.3, d = 5, P D = 0.606, d = 6, P D = and d = 7, P D = III. IMPLEMENTATION AND EXPERIMENTAL ANALYSIS In this section, we describe extensive experiments conducted to evaluate our LS-MRDTE algorithm by incorporating the geometric constraints of an actual power substation in our multi-receiver setup. Fig. 7: Our data collection experiments involve 4 USRPs, a CSAC and a laptop for storing data. ) Generating simulated spoofing data: Using our PyGNSS software, we simulate spoofing signals, originating from a virtual location, at a sampling rate of.5 MHz. Similar to authentic signals, each raw sample of the simulated spoofing data is a 3-bit complex. We simulate meaconed signals by considering the authentic data collected at one of the receivers and delaying them to induce the required timing error. Furthermore, we generate data-level spoofing signals using our SDR-based GPS signal simulator. In addition, for each receiver, we add independent additive Gaussian white noise to these generated malicious signals. During post-processing, we incorporate these simulated spoofing attacks to the collected authentic data. We execute this by performing weighted summation of raw samples obtained from the authentic and malicious data. Before summing, we add relative delay to the malicious data samples based on the relative distance between the corresponding spoofer and receiver location. These weights indicate the increased power levels of the simulated malicious signals as compared to the authentic signals. 3) Processing the data collected using software: We set the signal integration time T for our vector correlation to be 0 ms. The correlation threshold of our multi-peak vector correlation module is set to 0.4. In our Kalman Filter, our measurement noise covariance matrix R t is estimated by computing the covariance of past 0 measurement error vector values. The position and velocity of multiple static receivers are pre-determined using Multi-Receiver Vector Tracking [70]. We initialized our Particle Filter using 1000 random particles following a uniform distribution. A. Implementation details The details of our implementation are sub-divided into three parts as follows: collecting authentic GPS data using hardware, generating simulated spoofing data and processing the data collected using software. 1) Collecting authentic GPS data using hardware: Our data collection setup consists of four right-hand circularly polarized, omnidirectional AntCom 3GNSSA4-XT- 1 GNSS antennas, which are connected to four Universal Software Radio Peripherals (USRP-N10), respectively, as shown in Fig. 7. All the USRPs are connected to a common external clock namely Microsemi Quantum SA.45s CSAC and synchronized using an timing distribution system namely Ettus Fig. 8: Experimental setup considering the geometric constraints of Ameren Illinois power substation, Kansas, IL. Orange markers indicate the placement of our GPS antennas. After demonstrating the preliminary results in our prior work [58], we investigated the geometric constraints of the multi-receiver setup based on an actual power substation, i.e., 9

10 Ameren Illinois power substation in Kansas, IL. Thereafter, we replicated the conditions of this power substation by collecting data from four GPS antennas placed in open-sky conditions as described in Section III-A1 and separated by distances marked in Fig. 8. Later, we added simulated spoofing attacks to the collected authentic data as explained in Section III-A to validate our LS-MRDTE algorithm. B. Fixed vs adaptive clock candidate distribution To investigate the convergence rate and the accuracy of estimated GPS time using our LS-MRDTE, we analyzed different clock candidate distributions. Specifically, we compared the fixed uniform distribution in Fig. 9(a) with respect to an adaptive Gaussian distribution as can be seen in Fig. 9(b). Clock candidates following an adaptive Gaussian distribution are generated using the predicted covariance values, estimated during the time update step of the Kalman Filter. C. Timing robustness during data-level spoofing Given the static infrastructure of power grid, position of the GPS receiver is easily known to the attacker with an accuracy of < 500 m. Utilizing this, we simulate a data-level spoofing attack by transmitting incorrect navigation message such that the 3D position of all satellites-in-view are shifted 18 km further away from the receiver along the LOS vector. To simulate data-level spoofing, we first calculate the corresponding LOS vectors to each satellite from an assumed position of the receiver, in this case the centroid of power substation. Thereafter, we manipulate the parameters of the ephemeris sub-frame, i.e., argument of periapsis which changes the orientation of ellipse in orbital plane, true anomaly at epoch M 0 which alters the position of satellite at time t oe, square root of the semi-major axis and eccentricity which changes the size of orbital plane. The ephemeris parameters are accordingly updated in the next frame (after 30 s) to induce a constant timing error of 60 µs (=18e3/c). Between the updates of ephemeris parameters in the navigation message, the direction cosines of the LOS vectors are assumed to be constant. Manipulating the parameters transmitted in the navigation message to successfully induce data-level spoofing has been cited in prior literature [71]. In addition, the experimental results in [7], indicate that the IEEE-C threshold can be violated within a short period of a minute or two after the spoofer has completely taken over the receiver. (a) X-direction (b) Y-direction Fig. 9: Clock candidate distributions: (a) fixed uniform distribution; (b) adaptive Gaussian distribution for higher accuracy. In Fig. 10, the residuals of clock bias and clock drift are compared for both above-mentioned candidate distributions. We observed that the clock bias residuals are within 1 µs using adaptive Gaussian and within 3 µs using fixed uniform distribution. Similarly, in the case of clock drift, the computed residuals are within 0.5 ns/s using adaptive Gaussian and within 1.5 ns/s using fixed uniform. Thus, more precise timing is obtained by implementing an adaptive Gaussian clock candidate distribution. (a) PRN (b) PRN 5 (c) PRN 9 (d) PRN 5 (a) Clock bias residuals (b) Clock drift residuals Fig. 10: Clock residuals: (a) clock bias residuals; (b) clock drift residuals. Red line corresponds to the fixed uniform distribution and blue line corresponds to the adaptive Gaussian distribution. The adaptive Gaussian distribution shows a higher accuracy in the clock parameters as compared to the fixed uniform distribution. Fig. 11: For master receiver, under simulated data-level spoofing causing 60 µs timing delay and having 1.6 db higher power than authentic signals, correlation amplitude plots of 4 out of the 7 visible satellites: (a) shows that the correlation peak that corresponds to spoofing ( m) is lower in amplitude than the authentic peak (0 m). Therefore, scalar tracking channel for PRN accurately tracks the authentic peak. However, (b)-(d) shows that the correlation peak that corresponds to spoofing is greater in amplitude than the authentic peak. Therefore, scalar tracking for PRN 5, 9, 5 tracks the malicious signals. For a static infrastructure such as power grid, executing the above-mentioned data-level spoofing is easier than sophisticated spoofing attacks described in Section I-B because 10

11 it only requires manipulating the ephemeris data files fed as input to the GPS simulator. Unlike meaconing, data-level spoofing attack doesn t require additional hardware to record the authentic GPS satellite signals. Furthermore, in practical conditions, signals broadcast during meaconing attack are recorded at an else-where location and therefore relatively easier to detect by executing position checks [36]. (a) Clock bias residuals is of higher magnitude as compared to the authentic peak. Therefore, scalar tracking incorrectly locks to the malicious peak and continues to track the spoofed signals. To summarize, scalar tracking accurately tracks authentic and 5 spoofed satellite signals. Therefore, the timing error observed is less than the intended 60 µs, i.e., 48.3 µs, indicated by red in Fig. 1. By implementing LS-MRDTE, our multi-peak vector correlation module detects both the authentic and malicious peak across all satellites. Later, we utilize the geographical separation of our multiple receiver setup to accurately detect and distinguish the spoofing signals. In Fig. 1, we compared the computed clock residuals using our LS-MRDTE with that of scalar tracking subjected to data-level spoofing attack. We observed that the scalar tracking violates the IEEE-C Standard for Synchrophasors whereas the Kalman Filter of our LS-MRDTE, indicated in blue, maintains a clock bias residual of 1 µs. D. Spoofer localization during meaconing We demonstrated the robustness of our LS-MRDTE in computing the spoofer location by adding simulating meaconing signals with a db higher power and inducing a delay of 30 µs to our multi-receiver setup. This violates the IEEE.C standards, according to which the timing error between PMUs should not exceed 6.5 µs. (b) Clock drift residuals Fig. 1: Under 1.6 db of added data-level spoofing attack: (a) clock bias residuals; (b) clock drift residuals. Red line depicts scalar tracking whereas blue line depicts our LS- MRDTE. The black, dotted line in (a) indicates the IEEE- C threshold, i.e., 6.5 µs. Scalar tracking shows a clock bias residual of 48.3 µs, thereby violating IEEE-C standards whereas our LS-MRDTE shows a significantly lower timing error of 1 µs. (a) Time: 0 s (b) Time: 1 s Our PyGNSS-based software-defined receiver continuously decodes the navigation message and updates the ephemeris and ionospheric corrections every 30 s. These malicious signals are transmitted with a 1.6 db higher power than the incoming authentic signals to overpower them. During the 60 s duration of our experiment, a total of 7 satellites are present in the fieldof-view of our multi-receiver setup. Under these simulated data-level spoofing conditions, for the master receiver, the correlation amplitude plots against the pre-generated clock bias candidates for 4 satellites are shown in Fig. 11. The clock bias candidate at 0 m corresponds to an authentic clock bias error of 0 µs whereas the clock bias candidate at m corresponds to a malicious clock bias error of 60 µs intended by the spoofer. In Fig. 11(a), the correlation peak that corresponds to spoofing is lower in magnitude than that of the authentic peak. Therefore, the scalar tracking accurately locks to the authentic signals. However, in Fig. 11(b)-11(d), the correlation peak that corresponds to data-level spoofing (c) Time: 1.5 s (d) Time: 1.8 s Fig. 13: Convergence rate of our LS-MRDTE using Particle Filter: (a)-(d) show the sequential snapshots of the spoofer location estimated by our Particle Filter. Red markers denotes the actual location of the spoofer while blue markers corresponds to the location of our multi-receiver setup. Green markers depicts the estimate of the spoofer at that time instant. We observe that our LS-MRDTE based Particle Filter converges to within.5 m of the true spoofer. 11

12 Fig. 13 shows the time series convergence of our Particle Filter starting with the initial guess of the spoofer location to be same as the centroid of our multi-receiver setup. We observed that our LS-MRDTE converges to within.5 m of the true location of the spoofer in 1.8 s, thereby demonstrating the fast convergence rate of our algorithm. Fig. 14: Spoofer localization error with respect to the increase in the distance of the spoofer for a given geometry. (a) db added meaconing the distance of the spoofer from our multi-receiver setup. In Fig. 14, we observed that till a range of approximately 1 km, our localization algorithm converged to the true spoofer accurately within 3 5 m of error. Later, as the distance of the spoofer increases, the error and variance in localization increases, which is based to the number of receivers considered in our multi-receiver setup and their geometric constraints. In Fig. 15, we validated the increased robustness of our LS-MRDTE as compared to the conventional scalar tracking. Under the absence of meaconing, we observe that both scalar tracking and our LS-MRDTE shows µs time accuracy. Under db added meaconing, the scalar tracking locks to the meaconed signals in all satellite channels and therefore estimates an error in the clock residuals of around 30 µs which is equivalent to the meaconed delay intended by the spoofer. However, our LS-MRDTE accurately detects these spoofing signals and estimates the GPS time with 1.5 µs time accuracy. IV. CONCLUSIONS In conclusion, we proposed our joint estimation of GPS time and spoofer location for PMUs using LS-MRDTE. We utilized the geometry of spatially distributed receivers and performed multi-peak vector correlation to detect and distinguish spoofing attacks. Later, using our Joint Particle and Kalman Filter module, we localized the spoofer and estimated the GPS time. In addition, we theoretically estimated the CRLB of the localization accuracy for a given configuration of the multireceiver setup. In addition, we also computed the probability of spoofing detection and false alarm using the likelihood ratio test and Neyman Pearson decision rule. Based on the confidence in our LS-MRDTE detected malicious peaks (for d = 6), we theoretically estimated probability of spoofing detection for a given 10 6 probability of false alarm. During meaconing, the experimental results obtained from our Joint Filter demonstrated the spoofer localization accuracy of within.5 m and the GPS timing error of 1.5 µs. This is compliant with the IEEE.C standards specified by the power community. Similarly, during data-level spoofing, our LS-MRDTE accurately estimated the GPS time to within 1 µs accuracy whereas the scalar tracking showed large timing errors of 48.3 µs. (b) Authentic conditions Fig. 15: Comparison of clock bias residuals: (a) under db of added meaconing that induces a delay of 30 µs; (b) under authentic conditions, the red line corresponds to scalar tracking and the blue line corresponds to our LS-MRDTE. Our LS- MRDTE estimates the GPS time with an accuracy of 1.5 µs while the scalar tracking shows an error in the clock bias residuals of 30 µs thereby violating IEEE.C shown by black, dotted line. In accordance with our CRLB discussion in Section II-F, we also studied the convergence of our LS-MRDTE by varying ACKNOWLEDGMENT The authors would like to thank their lab members at the University of Illinois at Urbana-Champaign: Arthur Chu, Shubhendra Chauhan and James Kok for helping with the experimental data collection. This material is based upon work supported by the Department of Energy under Award Number DE-OE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would 1

13 not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof. REFERENCES [1] J. Hazra, R. K. Reddi, K. Das, P. Seetharam, Power Grid Transient Stability Prediction Using Wide Area Synchrophasor Measurements, 3rd IEEE PES Innovative Smart Grid Technologies, 01. [] M. Zima, M. Larsson, P. Korba, C. Rehtanz, G. Andersson, Design aspects for wide-area monitoring and control systems, Proceedings of the IEEE. 005 May;93(5): [3] V. V. Terzija, G. Valverd, D. Cai, P. Regulski, V. Madani, J. Fitch, S. Skok, M. Begovic, A. G. Phadke, Wide-area monitoring, protection, and control of future electric power networks, Proceedings of the IEEE. 011 Jan 1;99(1): [4] Schweitzer Engineering Laboratories, Improve Data Analysis by TimeStamping Your Data, The Synchrophasor Report, May 009, vol. 1, no. 3. Retrieved June 14, 015 from [5] N. C. Seeley, C. Craig, T. Rainey, Advances in power generator control: Precise control of power systems islands using timesynchronized measurements, In IEEE Industry Applications Magazine. 014 Mar;0():44-5. [6] K. A. Salunkhe, G. Gajjar, S. A. Soman, A. M. Kulkarni, Implementation and applications of a wide area frequency measurement system synchronized using network time protocol, In PES General Meeting Conference & Exposition, 014 IEEE 014 Jul 7 (pp. 1-5). IEEE. [7] IEEE standard for use of IEEE 1588 precision time protocol in power system applications, IEEE Std. C (Revision of IEEE Std C ), 017. [8] E. Fernández, D. Calero, M. E. Parés, CSAC Characterization and Its Impact on GNSS Clock Augmentation Performance, Sensors. 017 Feb 14;17():370. [9] C. Kelley, J. Pellegrino, E. Taylor, Time Distribution Alternatives for the Smart Grid, NIST Special Publication [10] Q. Yang, D. An, W. Yu, On time desynchronization attack against IEEE 1588 protocol in power grid systems, In Energytech, 013 IEEE 013 May 1 (pp. 1-5). IEEE. [11] P. Vyskocil, J. Sebesta, Relative timing characteristics of GPS timing modules for time synchronization application, In Satellite and Space Communications, 009. IWSSC 009. International Workshop on 009 Sep 9 (pp ). IEEE. [1] M. G. Petovello, C. O Driscoll, G. Lachapelle, D. Borio, H. Murtaza, Architecture and benefits of an advanced GNSS software receiver, Journal of Global Positioning Systems. 008;7(): [13] P. Misra, P. Enge, Global positioning system: Signals, measurements and performance, second edition. Massachusetts: Ganga-Jamuna Press [14] R. T. Ioannides, T. Pany, G. Gibbons, Known vulnerabilities of global navigation satellite systems, status, and potential mitigation techniques, Proceedings of the IEEE. 016 Jun;104(6): GBAS Working Group Meeting (I-GWG-1), Atlantic City, New Jersey, 011. [15] A. G. Dempster, E. Cetin, Interference localization for satellite navigation systems, Proceedings of the IEEE. 016 Jun;104(6): [16] GPS Wing, Interface Specification IS-GPS-00E, Jun [17] Y. Fan, Z. Zhang, M. Trinkle, A. D. Dimitrovski, J. B. Song, H. Li, A cross-layer defense mechanism against GPS spoofing attacks on PMUs in smart grids, IEEE Transactions on Smart Grid. 015 Nov;6(6): [18] J. S. Warner, R. G. Johnston, GPS spoofing countermeasures, Homeland Security Journal. 003 Dec 1;5():19-7. [19] D. P. Shepard and T. E. Humphreys, Evaluation of the Vulnerability of Phasor Measurement Units to GPS Spoofing Attacks, in International Journal of Critical Infrastructure Protection, 5(3-4), [0] L. Heng, J. Makela, A. Dominguez-Garcia, R. Bobba, W. Sanders, and G. X. Gao, Reliable GPS-based Timing for Power System Applications: A Multi-Layered Multi-Receiver Approach, in Proceedings of the 014 IEEE Power and Energy Conference at Illinois (IEEE PECI 014), Champaign, IL, Feb 014. [1] D. Chou, Y. Ng, and G. X. Gao, Robust GPS-Based Timing for PMUs Based on Multi-Receiver Position-Information-Aided Vector Tracking, ION International Technical Meeting 015, Dana Point, California, January 015. [] T. E. Humphreys, B. M. Ledvina, M. L. Psiaki, B. W. O Hanlon, P. M. Kintner Jr, Assessing the spoofing threat: Development of a portable GPS civilian spoofer, In Proceedings of the ION GNSS international technical meeting of the satellite division 008 Sep 16 (Vol. 55, p. 56). [3] B. M. Ledvina, W. J. Bencze, B. Galusha, I Miller, An in-line antispoofing device for legacy civil GPS receivers, In Proceedings of the 010 international technical meeting of the Institute of Navigation 001 Oct 1 (pp ). [4] IEEE Standard for Synchrophasors for Power Systems, IEEE Std C (Revision of IEEE Std ), vol., no., pp , 006. [5] K. E Martin, D. Hamai, M. G. Adamiak, S. Anderson, M. Begovic, G. Benmouyal, G. Brunello, J. Burger, J. Y. Cai, B. Dickerson, V. Ghapure, B. Kennedy, D. Karlsson, A. G. Phadke, J. Salj, V. Skendizic, J. Sperr, Y. Song, C. Huntley, B. Kastenny and E. Price, Exploring the IEEE Standard C Synchrophasors for Power Systems, IEEE Trans. on Power Del.,Vol. 3, no. 4, pp , Oct, 008. [6] M. Lixia, C. Muscas, and S. Sulis, On the accuracy specifications of phasor measurement units, in Proc. IEEE IMTC, May 010, pp [7] J. Bhatti, T. Humphreys, Hostile control of ships via false GPS signals: Demonstration and detection, Navigation, 016. [8] A. J. Kerns, D. P. Shepard, J. A. Bhatti, T. E. Humphreys, Unmanned aircraft capture and control via GPS spoofing, Journal of Field Robotics. 014 Jul;31(4): [9] D. Goward, Mass GPS Spoofing Attack in Black Sea, The Maritime Executive, July, 017. [30] M. Jones, Spoofing in the Black Sea: What really happened?, GPS World, October, 017. [31] M. L. Psiaki, T. E. Humphreys, GNSS Spoofing and Detection, Proceedings of the IEEE. 016 Jun 1;104(6): [3] N. O. Tippenhauer, C. Pöpper, K.B. Rasmussen, S. Capkun, On the requirements for successful GPS spoofing attacks, In Proceedings of the ACM Conference on Computer and Communications Security (pp ), 011, Chicago, IL. Association for Computing Machinery. [33] C. Günther, A Survey of Spoofing and Counter-Measures, Navigation: Journal of the Institute of Navigation. 014 Sep;61(3): [34] A. Jafarnia-Jahromi, A. Broumandan, J. Nielsen, G. Lachapelle, GPS vulnerability to spoofing threats and a review of antispoofing techniques, International Journal of Navigation and Observation. 01;01. [35] D. Schmidt, K. Radke, S. Camtepe, E. Foo, M. Ren, A survey and analysis of the GNSS spoofing threat and countermeasures, ACM Computing Surveys (CSUR). 016 May ;48(4):64. [36] P. F. Swaszek, R. J. Hartnett, M. V. Kempe and G. W. Johnson, Analysis of a simple, multiple receiver GPS spoof detector, in proceedings of ION NTM, San Diego, CA, Jan [37] K. Jansen, N. O. Tippenhauer, C. Pöpper, Multi-receiver GPS spoofing detection: error models and realization, Proceedings of the 3nd Annual Conference on Computer Security Applications, December 05-08, 016, Los Angeles, California 13

14 [38] P. Y. Montgomery, T. E. Humphreys, and B. M. Ledvina, Receiverautonomous spoofing detection: experimental results of a multi-antenna receiver defense against a portable civil GPS spoofer, in Proceedings of the Institute of Navigation International Technical Meeting (ITM 09), pp , Anaheim, Calif, USA, January 009. [39] A. Ranganathan, H. Ólafsdóttir, S. Capkun, SPREE: a spoofing resistant GPS receiver, Proceedings of the nd Annual International Conference on Mobile Computing and Networking, Oct, 016, New York City, New York. [40] M. S. Sharawi, D. M. Akos, D. N. Aloi, GPS C/N/sub 0/estimation in the presence of interference and limited quantization levels, IEEE transactions on aerospace and electronic systems. 007 Jan;43(1). [41] D. M. Akos, Who s afraid of the spoofer? GPS/GNSS spoofing detection via automatic gain control (AGC), Navigation: Journal of the Institute of Navigation. 01 Dec;59(4): [4] H. Borowski, O. Isoz, F. M. Eklöf, S. Lo, D. Akos, Detecting False Signals, GPS World. 01 Apr. [43] F. Bastide, D. Akos, C. Macabiau, B. Roturier, Automatic gain control (AGC) as an interference assessment tool, In ION GPS/GNSS 003, 16th International Technical Meeting of the Satellite Division of The Institute of Navigation 003 Sep 9 (pp. pp-04). [44] K. D. Wesson, J. N. Gross, T. E. Humphreys, and B. L. Evans, GNSS signal authentication via power and distortion monitoring, IEEE Transactions on Aerospace and Electronic Systems, vol. PP, no. 99, pp. 1 1, 017. [45] P. Y. Montgomery, T. E. Humphreys, B. M. Ledvina, A multi-antenna defense: Receiver-autonomous GPS spoofing detection, Inside GNSS. 009 Mar;4():40-6. [46] A. Konovaltsev, S. Caizzone, M. Cuntz, M. Meurer, Autonomous spoofing detection and mitigation with a miniaturized adaptive antenna array, In Proceedings of the 7th International Technical Meeting of the Satellite Division of the Insitute of Navigation, ION GNSS 014 Sep (pp. 8-1). [47] S. Daneshmand, A. Jafarnia-Jahromi, A. Broumandan, G. Lachapelle, A low-complexity GPS anti-spoofing method using a multi-antenna array, a a. 01;:. [48] C. Fernández-Prades, J. Arribas, P. Closas, Robust GNSS receivers by array signal processing: theory and implementation, Proceedings of the IEEE. 016 Jun;104(6): [49] S. Lo, D. Lorenzo, P. Enge, D. Akos and P. Bradley, Signal authentication: A secure civil GNSS for today, Inside GNSS, Sept 009. [50] B. W. O Hanlon, M. L. Psiaki, J. A. Bhatti, D. P. Shepard, T. E. Humphreys, Real-Time GPS Spoofing Detection via Correlation of Encrypted Signals, Navigation. 013 Dec 1;60(4): [51] L. Heng, D. B. Work, G. X. Gao, GPS signal authentication from cooperative peers, IEEE Transactions on Intelligent Transportation Systems. 015 Aug;16(4): [5] D. Gebre-Egziabher, S. Gleason, GNSS applications and methods, Artech House; 009. [53] C. J. Wullems, A spoofing detection method for civilian L1 GPS and the E1-B Galileo safety of life service, IEEE Transactions on Aerospace and Electronic Systems. 01 Oct;48(4): [54] L. Scott, Anti-spoofing & authenticated signal architectures for civil navigation systems, In Proceedings of the 16th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS/GNSS 003) 001 Mar 9 (pp ). [55] D. Yu et al., Short paper: detection of GPS spoofing attacks in power grids, Proceedings of the 014 ACM conference on Security and privacy in wireless and mobile networks, 014. [56] Y. Ng and G. X. Gao, Robust GPS-Based Direct Time Estimation for PMUs, in Proceedings of the IEEE/ION PLANS conference, Savannah, 016. [57] S. Bhamidipati, Y. Ng and G. X. Gao, Multi-Receiver GPS-based Direct Time Estimation for PMUs, in Proceedings of the ION GNSS+ conference, Portland, 016. [58] S. Bhamidipati and G. X. Gao, GPS Spoofer Localization for PMUs using Multi-Receiver Direct Time Estimation, In Proceedings of the Institute of Navigation GNSS+ conference (ION GNSS+ 017), Portland OR, Sep 017. [59] B. Yang, J. Scheuing, Cramer-Rao bound and optimum sensor array for source localization from time differences of arrival, In Acoustics, Speech, and Signal Processing, 005. Proceedings.(ICASSP 05). IEEE International Conference on 005 Mar 18 (Vol. 4, pp. iv-961). IEEE. [60] R. Christensen, Testing fisher, neyman, pearson, and bayes, The American Statistician. 005 May 1;59():11-6. [61] J. Liu, H. Yin, X. Cui, M. Lu, Z. Feng, A direct position tracking loop for GNSS receivers, In Proceedings of 4th ION GNSS, Portland, OR, USA. 011 Sep 19: [6] P. Closas, C. Fernandez-Prades, and J. Fernandez-Rubio, On the maximum likelihood estimation of position, in Proceedings of the 19th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 006), Fort Worth, TX, 006, pp [63] P. Axelrad, B. K. Bradley, J. Donna, M. Mitchell, and S. Mohiuddin, Collective detection and direct positioning using multiple GNSS satellites, NAVIGATION, Journal of The Institute of Navigation, vol. 58, no. 4, pp , 011. [64] P. Closas, C. Fernandez-Prades, and J. Fernandez-Rubio, Direct position estimation approach outperforms conventional two-steps positioning, in Proceedings of 17th European Signal Processing Conference, Aug 009, pp [65] L. Heng and G. X. Gao, Accuracy of Range-Based Cooperative Positioning: A Lower Bound Analysis, IEEE Transactions on Aerospace and Electronic Systems. vol. 53, no. 5, pp , Oct 017. [66] W. Debus, L. Axonn, RF path loss & transmission distance calculations, Axonn, LLC. 006 Aug 4. [67] N. Ashby, Relativity and the global positioning system, Physics Today. 00 May 1;55(5):41-7. [68] R. Kaune, J. Hörst, W. Koch, Accuracy analysis for TDOA localization in sensor networks, In Information Fusion (FUSION), 011 Proceedings of the 14th International Conference on 011 Jul 5 (pp. 1-8). IEEE. [69] E. Wycoff, Y. Ng and G. X. Gao, Python GNSS Receiver: An Object- Oriented Software Platform Suitable for Multiple Receivers, GPS World Magazine, Feburary 015. [70] Y. Ng and G. X. Gao, GNSS Multi-Receiver Vector Tracking, IEEE Transactions on Aerospace and Electronic Systems. vol. PP, no.99, doi: /TAES , May 017. [71] T. Nighswander, B. Ledvina, J. Diamond, R. Brumley, D. Brumley, GPS software attacks, In Proceedings of the 01 ACM conference on Computer and communications security 01 Oct 16 (pp ). ACM. [7] F. Zhu, A. Youssef, W. Hamouda, Detection techniques for data-level spoofing in GPS-based phasor measurement units, In Selected Topics in Mobile & Wireless Networking (MoWNeT), 016 International Conference on 016 Apr 11 (pp. 1-8). IEEE. 14

15 Sriramya Bhamidipati is a graduate student under Prof. Grace Gao in the Department of Aerospace Engineering at the University of Illinois at Urbana- Champaign. She received her M.S degree in Aerospace Engineering from University of Illinois at Urbana-Champaign in 017. She received her B.Tech. with honors in Aerospace Engineering and minor in Systems and Controls Engineering from Indian Institute of Technology Bombay, India in 015. Her research interests include GPS, power and control systems, computer vision and UAVs. Grace Xingxin Gao received the B.S. degree in mechanical engineering and the M.S. degree in electrical engineering from Tsinghua University, Beijing, China in 001 and 003. She received the PhD degree in electrical engineering from Stanford University in 008. From 008 to 01, she was a research associate at Stanford University. Since 01, she has been with University of Illinois at Urbana- Champaign, where she is presently an assistant professor in the Aerospace Engineering Department. 15