現今越來越多應用裝置使用全球定位系統(GNSSs) 來達到定位功能的服務，
在當中大部分的應用裝置使用的是GPS 的民用訊號頻段。然而此民用頻段並無任
何抵抗GPS 欺騙攻擊的手段，導致這類型的裝置暴露在此風險之中。再者現在已
經可以使用簡易的軟體定義無線電裝置(SDR) 來發起GPS 欺騙攻擊，這些SDR
裝置價格便宜且容易取得，更加導致GPS 欺騙攻擊的氾濫。一個擁有SDR 裝置
的惡意使用者，可以輕易的欺騙受害者的應用裝置，並將其導向危險的位置，或
是隨意使用SDR 裝置任意竄改應用裝置的數據。
在本篇論文中，我們建立了一個系統使用一般智慧型裝置常見的加速度器和
磁力計來偵測GPS 欺騙攻擊，且在使用者受到攻擊時，此系統能夠藉由使用者
的動作來推測使用者的約略位置，以達到減少受害者遭受攻擊者傷害的風險。我
們也在此論文中，實際發起GPS 欺騙攻擊，並測試我們系統抵抗此攻擊的效果，
並證明我們可以使用簡易的感測裝置，來偵測GPS 欺騙攻擊並更正使用者遭竄
改的位置資訊。

Nowadays, applications using Global Navigation Satellite Systems (GNSSs), such
as GPS, are increasing. Most of the location-based applications are using civilian
GPS signal which has no countermeasure to GPS spoofing attack (GSA). GSA using
software defined radio (SDR) device had been published and it is cheap and easy to
launch such an attack. An evil attacker can easily spoof a location based application
user to some dangerous place or cheating on the location- based application.
In this thesis, we build up a system using mobile embedded sensors such as
accelerometer and magnetometer to detect GSA and correct the user’s locationbased
on the user’s walking motion when they have been spoofed. We also launch
types of GSA using SDR device to evaluate our system. These results proof that we
can use common sensors to detect a GSA and correct the location information.

Table of Contents i
List of Figures iii
List of Tables iv
1 Introduction 1
2 Background 4
2.1 Global Positioning System . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 GPS spoofing attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2.1 Influence of GPS spoofing attack . . . . . . . . . . . . . . . . 5
2.2.2 GPS spoofing using SDR . . . . . . . . . . . . . . . . . . . . . 6
2.3 Mobile sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3.1 Accelerometer . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3.2 Magnetometer . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3.3 GPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3 GSP spoofing detection and location correction 10
3.1 Problem Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2 GPS spoofing detection . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2.1 Dead-Reckoning and related work . . . . . . . . . . . . . . . . 11
3.2.2 Pedestrian Dead-Reckoning . . . . . . . . . . . . . . . . . . . 11
3.2.3 Classification features . . . . . . . . . . . . . . . . . . . . . . 14
3.3 Location correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4 System Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4 Experiment 18
4.1 classification data gathering and process . . . . . . . . . . . . . . . . 18
4.1.1 raw data gathering . . . . . . . . . . . . . . . . . . . . . . . . 18
4.1.2 pre-process:step number estimation . . . . . . . . . . . . . . . 19
4.1.3 pre-process:dynamic step length estimation . . . . . . . . . . 20
4.1.4 spoofing data simulation . . . . . . . . . . . . . . . . . . . . . 21
4.2 Enhancement using dynamic step length estimation . . . . . . . . . . 22
4.2.1 position estimation enhancement . . . . . . . . . . . . . . . . 22
4.2.2 class separability enhancement . . . . . . . . . . . . . . . . . 24
4.3 Detection error rate and correction accuracy . . . . . . . . . . . . . . 25
4.4 GPS spoofing attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
4.4.1 Environment Setup . . . . . . . . . . . . . . . . . . . . . . . . 27
4.4.2 spoofing on our system . . . . . . . . . . . . . . . . . . . . . . 28
5 Conclusion 31
5.1 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.2 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

[1] Urban computing. https://en.wikipedia.org/wiki/Urban_computing.
[2] Pokemon go. http://www.pokemongo.com/.
[3] Kexiong Curtis Zeng, Yuanchao Shu, Shinan Liu, Yanzhi Dou, and Yaling
Yang. A practical gps location spoofing attack in road navigation scenario. In
Proceedings of the 18th International Workshop on Mobile Computing Systems
and Applications, pages 85–90. ACM, 2017.
[4] Ankle monitor. https://en.wikipedia.org/wiki/Ankle_monitor.
[5] Kang Wang, Shuhua Chen, and Aimin Pan. Time and position spoofing with
open source projects. Black Hat Europe, 148, 2015.
[6] Soft defined radio. https://en.wikipedia.org/wiki/Software-defined_
radio.
[7] Jon S Warner and Roger G Johnston. Gps spoofing countermeasures. Homeland
Security Journal, 25(2):19–27, 2003.
[8] Hengqing Wen, Peter Yih-Ru Huang, John Dyer, Andy Archinal, and John
Fagan. Countermeasures for gps signal spoofing. In ION GNSS, pages 13–16,
2005.
[9] u-blox. https://www.u-blox.com/en/press-release/
u-blox-m8-multi-gnss-receivers-achieve-higher-level-performance-embedded-security.
33
[10] Mark L Psiaki and Todd E Humphreys. Gnss spoofing and detection. Proceedings
of the IEEE, 104(6):1258–1270, 2016.
[11] Global positioning system. https://en.wikipedia.org/wiki/Global_
Positioning_System.
[12] Ali Jafarnia-Jahromi, Ali Broumandan, John Nielsen, and Gérard Lachapelle.
Gps vulnerability to spoofing threats and a review of antispoofing techniques.
International Journal of Navigation and Observation, 2012, 2012.
[13] radio jamming. https://en.wikipedia.org/wiki/Radio_jamming.
[14] Ubuntu manpage : hackrf-transfer. http://manpages.ubuntu.com/manpages/
xenial/man1/hackrf_transfer.1.html.
[15] opensource project : gps sdr sim. https://github.com/osqzss/gps-sdr-sim.
[16] Gps introduction. http://www.gps.gov/systems/gps/performance/
accuracy.
[17] Antonio R Jimenez, Fernando Seco, Carlos Prieto, and Jorge Guevara. A
comparison of pedestrian dead-reckoning algorithms using a low-cost mems
imu. In Intelligent Signal Processing, 2009. WISP 2009. IEEE International
Symposium on, pages 37–42. IEEE, 2009.
[18] Eladio Martin, Oriol Vinyals, Gerald Friedland, and Ruzena Bajcsy. Precise
indoor localization using smart phones. In Proceedings of the 18th ACM international
conference on Multimedia, pages 787–790. ACM, 2010.
[19] Y. Li, P. Zhang, X. Niu, Y. Zhuang, H. Lan, and N. El-Sheimy. Real-time
indoor navigation using smartphone sensors. In 2015 International Conference
on Indoor Positioning and Indoor Navigation (IPIN), pages 1–10, Oct 2015.
[20] G Trein, N Singh, and P Maddila. Simple approach for indoor mapping using
low-cost accelerometer and gyroscope sensors.
[21] Jó Agila Bitsch Link, Paul Smith, Nicolai Viol, and Klaus Wehrle. Footpath:
Accurate map-based indoor navigation using smartphones. In Indoor Positioning
and Indoor Navigation (IPIN), 2011 International Conference on, pages
1–8. IEEE, 2011.
[22] Using accelerometers to estimate position and velocity. http://www.
chrobotics.com/library/accel-position-velocity.
[23] Stephane Beauregard and Harald Haas. Pedestrian dead reckoning: A basis
for personal positioning. In Proceedings of the 3rd Workshop on Positioning,
Navigation and Communication, pages 27–35, 2006.
[24] Xiaoxu Wu, Yan Wang, and Gregory Pottie. A robust step length estimation
system for human gait using motion sensors. In Proceedings of the conference
on Wireless Health, page 14. ACM, 2015.
[25] Jung Ho Lee, Beomju Shin, Chulki Kim, Jaehun Kim, Seok Lee, and Taikjin
Lee. Real time adaptive step length estimation for smartphone user. In Control,
Automation and Systems (ICCAS), 2013 13th International Conference on,
pages 382–385. IEEE, 2013.
[26] atan2. https://en.wikipedia.org/wiki/Atan2.
[27] Gpgga format. http://aprs.gids.nl/nmea/#gga.
[28] Sergios Theodoridis and Konstantinos Koutroumbas. Pattern Recognition,
Fourth Edition. Academic Press, 4th edition, 2008.
[29] Hackrf official website. https://greatscottgadgets.com/hackrf/.
[30] tolerance of hackrf. https://github.com/mossmann/hackrf/wiki/Clocking.
[31] Gps spoofing attack and tcxo. https://forums.hak5.org/index.php?
/topic/38290-gps-simulator/.
[32] Nuc, box personal computer. http://www.intel.com.tw/content/www/tw/
zh/nuc/products-overview.html.
[33] Demo vedio. https://goo.gl/qwriX0.
[34] Jennifer R Kwapisz, Gary M Weiss, and Samuel A Moore. Activity recognition
using cell phone accelerometers. ACM SigKDD Explorations Newsletter, 12(2):
74–82, 2011.
[35] Ling Bao and Stephen S Intille. Activity recognition from user-annotated acceleration
data. In International Conference on Pervasive Computing, pages
1–17. Springer, 2004.