Detection of On-Road Vehicles Emanating GPSInterference

Gorkem Kar†, Hossen Mustafa♯, Yan Wang‡

Yingying Chen‡, Wenyuan Xu♯, Marco Gruteser†, Tam Vu∗

†Winlab, Rutgers University, North Brunswick, NJ 08902, USA†{gkar87,gruteser}@winlab.rutgers.edu

‡Stevens Institute of Technology, Hoboken, NJ 07030, USA‡{ywang48,yingying.chen}@stevens.edu

♯University of South Carolina, Columbia, SC 29208, USA♯{mustafah, wyxu} @cse.sc.edu

∗University of Colorado Denver, Denver, CO 80204, USA∗tam.vu@ucdenver.edu

AbstractThe Global Positioning System (GPS) is widely used in criti-cal infrastructures but is vulnerable to radio frequency (RF)interference. A common source of interference are commer-cial drivers that use GPS jammers to circumvent vehicletracking systems. Existing mechanisms to detect and iden-tify such interference emitting vehicles on roadways requirea large number of specialized detectors or a manual observa-tion process. In this paper, we design a practical, automatedsystem to facilitate enforcement actions. Our system com-bines information from roadside monitoring points at key lo-cations along the roadway as well as mobile detectors (e.g.,smartphones and other mobile GPS systems). Rather thanattempting precise localization at a given time, the systemexploits the inherent variation in driving speeds and the re-sulting diverging trajectories of vehicles to uniquely identifythe interfering vehicle. Through our experiments on a lo-cal highway with a vehicle transmitting interference in the900MHz ISM band, we found that the vehicle identificationrate of our mechanism is 65% for a single-point setup and100% for a two-point setup. We performed 200 hours of pas-sive monitoring of GPS L1 band on roadways and found twoepisodes of real interference. We also demonstrate that ourmobile detector-based profiles are sufficiently consistent intime and space to enable reliable interference detection.

Categories and Subject Descriptors

C.5.0 [Computer System Implementation]: [General]

KeywordsGPS; jamming; vehicular

Permission to make digital or hard copies of all or part of this work for personal or

classroom use is granted without fee provided that copies are not made or distributed

for profit or commercial advantage and that copies bear this notice and the full cita-

tion on the first page. Copyrights for components of this work owned by others than

ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-

publish, to post on servers or to redistribute to lists, requires prior specific permission

and/or a fee. Request permissions from permissions@acm.org.

CCS’14, November 3–7, 2014, Scottsdale, Arizona, USA.

Copyright 2014 ACM 978-1-4503-2957-6/14/11 ...$15.00.

http://dx.doi.org/10.1145/2660267.2660336.

1. INTRODUCTIONMany networked systems, particularly in the transporta-

tion domain rely on the Global Positioning System (GPS)for location tracking. For example, automatic vehicle lo-cator system are installed in truck fleets to monitor deliv-ery progress and optimize routes [19], in taxicabs to facil-itate cab-passenger scheduling [4], and also in aeronauticalapplications such as landing systems. If current plans forconnected vehicles with Vehicle-2-Vehicle Dedicated ShortRange Communications [28] are any guide, this reliance onGPS will only increase. In this effort, vehicles are expectedto broadcast their current GPS reading and recent trajec-tory multiple times per second, so that each vehicle can beaware of nearby vehicle movements and use this informationto improve efficiency and safety.

GPS Interference and Jamming. This reliance onGPS has also exposed its susceptibility to interference. Dueto the 20,200km distance to the transmitting satellites, thereceived signal strength is extremely low at about -125dBm.This is much weaker than in most other wireless commu-nication systems and below the noise floor. These signalscan therefore easily be masked by other transmissions, ei-ther from jammers or malfunctioning electronic equipment.A particular source of concern are in-vehicle GPS jammers.These appear to be used mainly by drivers to gain loca-tion privacy, that is to prevent employer-installed GPS vehi-cle tracking systems from recording their trajectories. GPSjammers are easy to use, some can be simply plugged into thevehicles cigarette lighter for power, and require no knowl-edge about the vehicle tracking system or the location ofthe GPS receiver. They can be removed as easily as theyare installed and leave no evidence of tampering. To be ef-fective regardless of the type and mounting position of theGPS antenna and across vehicle types from large commercialtrucks to small passenger vehicles, the output power of thesedevices will have to be relatively high. Such generously pro-portioned output powers, however, increase the likelihoodof interfering with other nearby receivers. For this reason,the United States and many other countries have significantregulatory restrictions in place for such devices.

The Detection Challenge. Still, both anecdotal evi-dence such as incidents at Newark Airport and a study inthe UK [7] indicate that use of jamming devices is common

Figure 1: Overview of jamming detection system consistingof monitoring points, mobile detectors, and central office forcamera-based vehicle identification.

enough so that it can interfere with current critical infras-tructure and could be a concern in any future connected ve-hicle deployment. Moving jammers might appear to causeonly brief interference and be less of a concern. However,some GPS systems, particularly stationary ones, may notbe designed to expect frequent interference and even a shortinterference spike could cause malfunction (as in the initialNewark airport system). For mobile GPS receivers passingat high speed, this may be less of an issue, but receivers invehicles driving along with the interferer could still experi-ence outages over several minutes. Presumably regulatoryrestrictions can reduce their use, but enforcing these restric-tions, particularly at the individual vehicle level, is very la-bor intensive. The accuracy of standard wireless localizationtechniques [14, 16, 23] is usually not sufficient to pinpointa particular vehicle in dense traffic. Current methods re-quire manually pointing a handheld monitoring device witha directional antenna receiver at individual vehicles to scanfor emissions. Expending this level of effort1 is usually onlypractical when frequent interference has been reported at afixed location.

Automated Monitoring and Detection. This paperseeks to overcome these challenges with an automated in-terference detection and vehicle identification system, withincludes roadside interference monitors, mobile interferencedetectors and camera-based vehicle identification, as shownin Figure 1. The roadside component of such a system couldremain in continuous operation near critical infrastructureand thereby quickly identify interference in such areas. Themobile detectors that leverage smartphones or other mobiledevices opportunistically to identify interference can achievewide coverage at low overhead. It requires a special profilingapproach, however, to distinguish interference from benignfading and attenuation based on the limited GPS perfor-

1As an example, consider a case at Newark airport whererepeated interference at GPS reference receivers from thelanding system was observed [15]. It took many monthsfor FAA/FCC investigators to locate one jammer. Duringthis time frame, FAA/FCC teams convened with contrac-tors twice for three day investigation sessions until it wasdetermined that the interference source is mobile and mov-ing on the I-95 highway next to the airport. In an additionalsession, the FAA/FCC team with contractors used a spec-trum analyzer on an overpass to identify a set of candidatevehicles that might carry a jammer. These vehicles werethen pursued with patrol vehicles carrying mobile interfer-ence detectors or spectrum analyzers until a single vehiclecould be isolated (apparently based on interference signalstrength and proximity to the patrol car). This vehicle wasthen stopped to confirm that a jamming device is presentinside the vehicle.

(a) GPS jammer (b) Spectrogram of a jamming signal

Figure 2: (a) shows one of the commonly available jammerand (b) shows the spectrogram of a 8 MHz wide jammingsignal generated using Matlab function.

mance indicators available on widely used mobile devices.Our approach combines data from multiple detections toidentify vehicles. The inherent variation of driving speedsmeans that a group of cars that passes a first monitoringpoint together likely has dispersed at a later monitoringpoint, which allows unique identification of the vehicle emit-ting such signals. The salient contributions of this work aresummarized below.

• We propose an automated two-pronged interferencemonitoring framework with roadside monitoring sta-tions and mobile detectors that can achieve wide cov-erage at low cost.

• We design profile-based algorithms that detect GPSsignal anomalies based on widely available satellite signal-to-noise ratio measurements (e.g., accessible from An-droid apps). Even though GPS signals are highly vari-able due to fading, our method of constructing signalprofiles is sufficiently robust to allow interference de-tection without any specialized chipset functions.

• Instead of precise triangulation with multiple receiversto locate the interference source, our system can workwith just a single detector (assuming repeated com-muting by the jammer) or at most two detectors toidentify the interference source.

• We evaluate through multiple days of roadway exper-iments on local highways the likelihood that a mon-itoring station can uniquely identify an interferenceemitting vehicle and show that unique identificationis possible with two appropriately spaced monitoringstations in most cases.

• We use our system to investigate the prevalence of GPSinterference on US public roadways. During 200 hoursof passive monitoring in two US cities, we capturedtwo instances of interference.

2. SYSTEM OVERVIEWOur proposed detection system uses unmanned roadside

monitoring stations in critical locations (e.g., airports) andcrowdsourced GPS signal-to-noise ratio data from mobilephones or vehicles to achieve broad coverage. It is designedto significantly reduce the effort required to detect and trackdown interference in the civilian use L1 GPS carrier at 1.57542GHz. We envision that such a system can be used for identi-fying malfunctioning equipment that generates interferenceor for enforcement actions against GPS jammers.

Monitoring Point1

Mobile Detector1

Energy-based Jamming DetectionWireless Receiver

Interference Detector

Signal Analyzer

C/N0-based Jamming DetectionGPS Data Collector

Interference Detector

Jamming Validator

Y Y

Centralized Camera-based Vehicle IdentificationPeak Prediction

Zone IdentificationCandidate Source

Vehicle Identification

jamming incident jamming incident

2 3 N 2 3 M

PathInterpolation

Predicting Recording Time Zone

Figure 3: Overview of our GPS jamming detectionmethodology. Each monitoring point uses a USRP for cap-turing wireless data and each mobile detector uses phone’sGPS APIs to collect SNR values. The centralized camera-based vehicle identification system uses traffic camera im-ages for accurate vehicle identification.

2.1 Attack Model: Personal Privacy GPS Jam-mers

The attackers are mainly drivers that want to gain loca-tion privacy by circumventing employer-installed GPS ve-hicle tracking systems with GPS jammers. We target rela-tively widespread low-cost jammers that are used as personalprivacy devices rather than sophisticated defense-related equip-ment. Such personal privacy devices are often small jammersthat can be powered by an automotive power outlet.

These GPS jammers simply overpower GPS signals withinterference. Although some advanced jammers can blockthe L1, L2, L3, L4 and L5 bands, the most commonly usedones block only the L1 band. Such GPS jammers can becategorized into two categories in terms of signal character-istics [1]: (a) Continuous wave jammers simply transmit anunmodulated continuous wave signal with a bandwidth lessthan 100 kHz [24], and (b) Chirp jammers transmit differenttypes of narrowband and wideband chirp signals where thechirp signal can be a saw-tooth function, a multiple saw-tooth function, or a frequency bursts.

The jamming bandwidth ranges from 0.92 kHz to 44.9MHz and the output power varies from -9.5 dBm to -30.8dBm [2]. Chirp signal jammers are most common [2]—weshow an example in Figure 2(a). For our experiments andanalysis, we generated a chirp signals similar to the charac-teristics reported by Bauernfeind et al [2]. An 8 MHz chirpsignal is depicted in Figure 2(b).

2.2 Design RequirementsTowards this goal, we identify the following design require-

ments for identifying vehicles emanating GPS interference.

• Automated. The detection and identification systemshould be able to operate around the clock with lim-ited human intervention. While manual examinationof detection results may still be required, continuoushuman presence at a monitoring location should notbe necessary.

• Low-cost. To facilitate widespread usage, infrastruc-ture costs should be minimal. Some infrastructure isappropriate for priority locations around critical GPSinfrastructure (e.g., airports).

• High accuracy. Identifying the source of the inter-ference source should be accurate enough to supportenforcement actions. False positive can lead to incon-veniencing innocent drivers and false negative repre-sents missed detections.

2.3 ChallengesIdentifying GPS jammers carried by vehicles in roadways

is challenging for several reasons.Availability of GPS performance metrics. Widely

used GPS receivers only provide high-level GPS performancemetrics that are not obvious indicators of interference. Iden-tification of interference in the GPS L1 band is not partic-ularly difficult with specialized equipment or high perfor-mance GPS receivers that monitor interference conditions.Such equipment, however, is costly or at least not in wide-spread use. Many GPS receivers only allow monitoring satel-lite signal-to-noise ratios (SNR) and outages (i.e., a loss ofthe position fix). Both metrics, however, are also affectedby the varying signal conditions under normal operation.

Vehicle identification in complex environment. Road-ways present both a complex radio propagation and trafficenvironment. The radio propagation on a multi-lane high-way is highly irregular because of the strong attenuation andfading caused by the metal bodies of vehicles, the Dopplershift introduced by high traveling speeds, and unpredictableradio propagation paths due to the dynamic traffic patterns.All the irregularity make it challenging to accurately identifythe vehicle that carries a GPS jammer.

Several projects have proposed to localize GPS jammers,but none of them can automatically identify vehicles withGPS jammers accurately and economically. For instance,most of the latest research on GPS jammer localization arebased on the time difference of arrival (TDOA) technique [14],[16], [23]. However, TDOA-based approach requires eitherhigh accurate synchronization between multiple observingstations or the prior knowledge of GPS jamming signals.In addition, these localization mechanisms are not accurateenough to identify a single vehicle. While some of them canlocalize the source of jamming signals with an accuracy of 5meters in certain cases, this is still not sufficient to distin-guish two vehicles driving on adjacent lanes. Thus, a newvehicle identification solution is in need.

2.4 ApproachWe chose a two-pronged approach with specialized road-

side detectors and mobile detectors because the former promisehigher system accuracy around critical infrastructure andthe latter offer low-cost, broad coverage of an entire trans-portation network. As shown in Figure 3, both types ofdetectors will report signal anomalies to a centralized sys-tem. Rather than attempting precise localization at a singlepoint in time, the system uses multiple reports to identifythe source vehicle. To do so, it must have access to vehi-cle identification information such as electronic toll systemidentifiers or camera footage that reveals license plates. Wefocus here on the latter as an example.

For specialized roadside equipment, there exist establisheddetection methods. In the interest of low complexity, we relyon energy-based detection, wherein a Wireless Receiver

continuously monitors the GPS L1 frequency band and theInterference Detector monitors whether energy exceedsthe normal noise levels at this location. Suspicious signalscan further be validated against established jamming pat-terns by the Signal Analyzer and are reported to the cen-tralized system together with their location.

Interference detection is most challenging when seeking tocollect interference data from widely deployed, mobile GPSreceivers. We chose to focus on smartphone GPS receiversaccessible through Android apps, because this is arguably

the most common GPS platform. For example, such mo-bile detectors could be carried in government vehicle fleetsor with appropriate energy optimizations offered as an An-droid background service to the public. The Android plat-form makes available carrier-to-noise density ratio—looselycalled signal-to-noise (SNR)—measurements of each satellitein addition to the GPS position data, but does not provideany information that would directly indicate interference.Interference, however, can be expected to manifest itself asadditional noise at the receiver and therefore decrease thecarrier to noise density ratio (or, a loss of fix, in the ex-treme). The challenges lie in distinguishing this effect fromsignal fading or attenuation, which is prevalent in wirelesspropagation environments and also leads to carrier to noisedensity ratio decreases or outages.

Our mobile detection approach therefore profiles the en-vironment to establish reference signal levels for a certainreceiver. Signals are then classified as anomalies, when theydeviate significantly from this profile. They can be fur-ther validated by detecting abnormal patterns in carrier-to-noise-density ratio variations. These three steps makeup the GPS Data Collector, Interference Detector, andJamming Validator components. We discuss detection inmore detail in Section 3.

The centralized camera-based vehicle identification com-ponent identifies a vehicle using images from roadside unitsor traffic cameras. For roadside detection, it is most conve-nient to have cameras collocated with the interference de-tector. Still, in many cases one can expect multiple vehiclesto be present in the image and it will be difficult to iden-tify which one is the interference source. We address thischallenge by relying on multiple detections in time or space.Since groups of vehicles will eventually disperse, multipledetections (of the same jammer) will eventually show onlyone common vehicle. When mobile detections are reported,there may not be any camera available at this location. Inthis case, the system will have to interpolate the vehiclespath to a camera location, and work with a larger set ofcandidate vehicles to account for the path estimation uncer-tainties. Still, with a sufficient number of detections, uniqueidentification can be expected. We discuss this componentin Section 4.

3. JAMMING DETECTIONWhile many sophisticated jamming detection solution ex-

ist, we focus here on techniques that can be implementedwith existing widely available GPS receiver hardware or lowcost software radios. In particular, we develop a carrier-to-noise profiling approach which only relies on the carrier-to-noise metrics (sometimes imprecisely referred to as signal-to-noise ratio) reported by most GPS receivers. This met-ric is even accessible for apps through the Android locationAPI. We also consider energy detection which can easily beimplemented on dedicated monitoring devices and is alsosupported in more sophisticated GPS receivers. While notnearly as widely available as the carrier-to-noise metric, en-ergy detection allows a more direct measure of interferencesince it does not need to account for variations in satellitesignal propagation.

3.1 Carrier-to-Noise ProfilingTo achieve broad coverage with this monitoring system,

we design a solution that can take advantage of existingGPS chips and devices such as smartphones or in-car GPS

Algorithm 1 Mobile Detector

1: function profileSNR(n, d)◃ record time series data for n satellites

2: < time,SNRsat, lat, lon >= record data(n)3: p = calculate path distance(lat, lon)4: for each path segment pi with length d do5: satsnr(pi) = get sat snr(SNRsat)6: msnr(pi) = average(satsnr(pi))7: τsnr(pi) = mode(satsnr(pi))8: σsnr(pi) = std dev(satsnr(pi))9: save profile(pi,msnr, τsnr,σsnr)10: end for11: end function12: function detectSNRAnomaly(n, k, pi)13: satsnr = read sat snr(n)14: msnr = average(satsnr)15: τsnr = mode(satsnr)16: σsnr = std dev(satsnr)17: < mpr, τpr, σpr >= get profile(pi)18: δ = mpr − k ∗ σpr

19: if msnr + (τpr − τsnr) ≤ δ then20: jamming status = verify all sat()21: if jamming status = true then22: [lat, lon] = get location()23: send report(lat, lon,msnr)24: end if25: end if26: end function

receivers connected to telematics units. The carrier-to-noisedensity ratio (C/N0) is the most fine-grained GPS perfor-mance measure that conveys information about interferenceand is provided by nearly every GPS chip as well as madeaccessible through the NMEA standard or through the An-droid API. It is the ratio of the satellite signal power tonoise density and is often somewhat imprecisely referred toas signal-to-noise ratio (SNR) in many GPS interface docu-mentations.2

The C/N0 is primarily affected by signal variations whichare due to fading, both from obstructions (e.g., skyscrapers,tall billboards), satellite movement, and multipath propaga-tion. Under interference conditions, however, the interferingsignal acts similar to noise on the satellite signal receptionprocess. The reported C/N0 is therefore usually a signal-to-interference-plus-noise density ratio, which will decreasewhen either interference increases or signal fading occurs.

The challenge is then to distinguish fading from interfer-ence. We propose to detect abnormally low SNR values bycomparing them with SNR profiles that characterize typicalfading variations at a location. We rely here on three keyobservations: (i) in-vehicle jammers and interferers are mo-bile and rarely dwell for an extended amount of time in thesame location (indeed, they are usually deactivated when avehicle parks); (ii) vehicles pathways are highly constrainedby roadways and tend to repeatedly pass through those; (iii)most significant signal fading is cause by stationary struc-tures such as tall buildings, underpasses, tunnels, etc. Thefirst observation leads us to the heuristic that a temporarilylow SNR at a particular location is indicative of interference,

2In wireless communications, SNR typically includes noiseover the entire receiver bandwidth, while C/N0 uses noisedensity, that is noise over 1 Hz. We use the terms inter-changeably here to refer to the carrier-to-noise ratio density.

while a more permanently low SNR at a particular locationis more likely due to obstructions in the built environment.The second and third observations leads us to the idea toconstruct a profile of typical signal levels at each location.If detectors are mobile, each small interval of length d alonga roadway is treated as a separate location, which will even-tually lead to a signal map. By comparing current SNRreadings with this profile, rather than a global threshold, wecan then perform outlier detection to determine whether thereadings are unusually low for this particular location. Thisshould significantly reduce false positives. Thus, our algo-rithm contains two stages: profiling, and jamming detection.The generalized mobile version is shown in Algorithm 1 andwe describe the individual stages next.

Profiling. In this stage, we first collect C/N0 values alonga route from the n strongest satellites for each of the posi-tion readings along the route. Note that as satellites orbitthe earth, the identity of these satellites will change butwe found C/N0 readings to be sufficiently consistent to notwarrant further distinction. For each interval pi along aroadway, we calculate and store the mean m, the mode τ ,and the standard deviation σ of the C/N0 values from allsatellites and all position updates within this interval. Bycalculating a mean over multiple C/N0 readings (from differ-ent satellites but also different locations within the intervalor different trips), we will average out multipath effects andthe approach becomes more robust to small scale fading.The mode is provided as a statistic that is more robust tooutliers. We chose 20m as the interval length d, because itis sufficiently fine-grained to capture signal variations causeby smaller structures, and large enough so that usually atleast one sample from a trip falls into this interval. Thesevalues comprise the profile and can be continuously updatedas additional C/N0 data from the same location arrives (i.e.,the vehicle travels over the same road again).

Anomaly Detection. In this stage, we use the param-eter recorded in the profiling stage to determine whetherthe SNR at a particular location is abnormally low. First,the current reported latitude and longitude are mapped toa particular road interval pi. Second, we will again calcu-late the mean SNR msnr over all satellites and all locationupdates from the current trip that fall into this interval.This is reasonable even if we expect interference, because(i) interference will affect all satellites equally since they aretransmitting on the same L1 carrier and (ii) in most casesinterference will be present long enough for the vehicle totravel a short distance d (e.g., 20m). Thus, the averaging isunlikely to remove the effect of interference.

The mean of the profile and the sigma of the profile arethen used to derive a threshold for outlier detection. Anabnormal signal report is generated if msnr < mpr −k ∗σpr.Since the normal distribution is often successfully used tomodel the distribution of SNR readings one might expectat a given distance, it can serve also as a guide for deter-mining the k parameter of the threshold. While this is notnecessary for built-in vehicle GPS receivers with externalantennas, the threshold for portable GPS receivers can befurther calibrated to account for placement differences in-side the vehicle from one trip to the next. For this purpose,the algorithm will also track the mode of the SNR τsnr overan extended distance dext, which is chosen longer than thelongest expected interference duration. The algorithm thenestimates the profile mode over the same extended intervalbased on the mpr that make up this interval. The difference

Monitoring Point

Peak zone

Zone 1

Determined by Antenna

Determined by Antenna

Traffic Direction

Figure 4: Ladder-shaped detection zone on the road.

between this estimated profile mode and the current mea-sured mode is a calibration parameter that will be added tomsnr before the comparison.

When the SNR falls below this threshold, a signal anomalyreport can be transmitted to a central office. This report willcontain the difference between the threshold and the meanSNR value as well as the current or the last known GPSlocation, if the current one is unavailable. In the latter case,the first new location fix may also be provided subsequently,to allow a better estimation of the location of the low signal.Complete outages, where no satellites can be detected, aretreated as the lowest possible SNR value in the algorithm.The low signal report can further include indicators of de-tected signal characteristics which imply a higher confidencethat this signal level is due to jamming, such as the highvariance described earlier. The central office can take themagnitude of the SNR difference and such indicators intoaccount, when determining the reliability of such reports.

3.2 Comparison with Energy-based DetectionRoadside units designed for interference monitoring can

rely on many custom techniques to detect interference. En-ergy detection is a simple yet effective technique in the GPSband, since the GPS signal level is typically below the ther-mal noise floor (confirmed in our experiments). Therefore,any energy-level above the noise floor is unwanted interfer-ence. This approach greatly simplifies the choice of detectionthreshold since no signal variations have to be taken into ac-count but it requires hardware that supports such metrics.

Based on these considerations, we chose the carrier-to-noise-profiling approach in our mobile smartphone detectorsand implemented energy detection in our dedicated road-side detector using a Universal Software Radio Peripheral(USRP) N210 [8] in conjunction with a WBX daughterboardand with GNURADIO [11] scripts. The roadside unit firstautomatically sets the threshold value just above the am-bient noise level. For monitoring, the wireless receiver

block (Figure 3) continuously captures 10 milliseconds ofdata and passes it to interference detector block. Whenthe energy becomes larger than the threshold (−75dBmto −83dBm in our experiments), the interference detec-tor records a suspicious signal and reports it together withtimestamp information. A signal analyzer can optionallyconduct temporal and spectral analysis to gain additionalconfidence in the report.

4. SOURCE VEHICLE IDENTIFICATIONIn this section, we describe how to correlate the detection

with license plates from traffic camera footage to allow iden-tification of a set of candidate vehicles and how this set canbe narrowed down to a unique vehicle after multiple detec-tions. While we discuss this in the context of traffic cameras,similar methods could be applied to other vehicle identifi-

−40 −20 0 20 400

2

4

6

8

10

Distance to the detector along the road

Dis

tance

to the d

ete

ctor

perp

endic

ula

r to

the r

oad

Practical positions of transmitting vehicle at t

m

Theoretical positions of transmitting vehicle at t

m

Derived peak detectionzone

Figure 5: Positions of transmitting vehicle passing by thedetector at time tm when the maximum energy value is iden-tified in multiple experimental runs in real-road scenarios.cation methods such as IDs from electronic toll collectionsystems.

4.1 Identification Using Roadside DetectorTo facilitate vehicle identification, the system needs to

map an energy detection to a portion of a video obtainedfrom a traffic camera that the monitoring point is collocatedwith. It is therefore convenient to focus the wireless detec-tions on a smaller area that is in view of the camera. Thiscan be achieved by using a directional antenna at the moni-toring point and results in a trapezoidal area of the roadwayfrom which signals can be detected. Such a detection zoneis illustrated in Figure 4 (marked as Zone 1 ). Let us firstconsider a naive approach to identify a set of candidate vehi-cles. Given a time interval [ts, te] during which interferencewas detected, consider every vehicle that was sighted in themonitoring zone at least at one point of this time interval.In practice, however it is challenging to determine this zonesince it not only depends on wireless propagation effects butalso the transmission power and antenna of a jammer.

Deriving Peak Detection Zone. To address this weuse the concept of a peak detection zone. As an interferingvehicle approaches and leaves, the received signals at themonitoring point can be expected to rise and fall, respec-tively. By considering only the moment tm at which theenergy of interference signals peaks, we can define a smallerpeak detection zone.

Theoretically the energy of interference signals reaches themaximum value when the transmitting vehicle is at the clos-est position to the detector. These closest positions are alonga line perpendicular to the road and passing through the de-tector (red dotted line in Figure 4). Due to multipath suchas reflections of interference signals by other vehicle bodies,there is however some uncertainty regarding the exact posi-tion of the vehicle when energy peaks. We therefore use apeak detection zone as the area that includes all those pos-sible positions (i.e., the red trapezoid in Figure 4).

This discussion implicitly assumed omnidirectional trans-mitters. For a transmitter that is using a directional an-tenna, the peak may in theory not occur when the transmit-ting vehicle is closest to the detector but most commerciallyavailable jammer in the market have omnidirectional anten-nas and in practice, the tolerance zone can compensate manydiscrepancies.

Obtaining the boundary of the peak detection zone theo-retically is complicated and thus we identify the zone empir-ically. We use the following steps: 1) For each experiment,we identify the position (pm) of the transmitting vehicle atthe moment tm by examining the recorded video; 2) drawa ladder-shaped area to cover all the marked vehicle posi-tions (pm) across all the lanes. Figure 5 shows the identified

vehicle positions at the moment tm for the 20 rounds of real-road experiments. Empirically, we determine that the peakdetection zone for our receiver configuration can be enclosedby an trapezoid with a width of about 15 meters. Overall,the results are encouraging as it indicates it is possible toderive a peak detection zone that minimizes the number ofcandidate vehicles to uniquely identify the source vehicle.

4.2 Identification Using Mobile DetectorWhen multiple mobile devices (e.g., smartphones) on the

road detecting the presence of the GPS jamming/interference,our system can track and predict the movement of the jam-mer on the road and coordinate with the roadside camerasto capture the candidate interference vehicle.

Determining the Moving Direction of Jamming/Interference Source. When the GPS jamming /interfer-ence is detected by a mobile detector (e.g., a smartphone),it is possible to determine the moving direction of the vehi-cle emanating interference by utilizing the detection period,which is the time period that the mobile detector finds lowGPS SNR (i.e., below the detection threshold). The ra-tionale behind this is if the mobile detector moves in theopposite direction as the jammer, the detection period willbe very short, typically 1-2s. Whereas if the mobile detec-tor moves towards the same direction as the jammer, thedetection period will be longer than few seconds. Thus, byutilizing a time threshold we can determine the relative di-rection of the GPS jamming source.

Intuitively, the mobile detector moving in the opposite di-rection as the source vehicle is the most common case, sincea vehicle has much more chances to encounter different ve-hicles in the opposite direction than in the same direction.Therefore, we focus on the cases when the moving directionof the source vehicle is opposite to that of the mobile detec-tor. Since the source vehicle is moving along the road, it isreasonable that there are multiple mobile detectors sequen-tially detecting the presence of jamming at several differentlocations on the road. It is thus possible to determine thespeeds of the source vehicle and its estimated locations, andfurther perform the path interpolation to estimate the timewhen the source vehicle passes the closest installed roadsidecamera.

To estimate the number of mobile detectors needed toguarantee at least one detector-jammer encounter, we builtan emulation to analyze an actual dataset, called Next Gen-eration SIMulation (NGSIM) [12]. The dataset containsactual trajectories of more than 2100 vehicles recorded byvideo cameras mounted on the side of an urban highway inNorth Hollywood, CA during a 15min rush hour period. Theemulation randomly selects one vehicle to be a jammer andM vehicles to be mobile detectors. For each selection, theemulation looks at the vehicles’ traveling timestamps andtrajectories to detect if any mobile detector encounters thejammer. The emulator repeats 10,000 times for each valueof M ranging between 1 and 10. The results shows that thejammer can be encountered 92% of the time with 10 mobiledetectors. The number reduces to 91%, 83%, 74%, 67%, and51% when the number of monitoring points reduces to 9, 5,3, 2 and 1 respectively.

Estimating Recording Time Zone.Next, we first present how to estimate the speed of the

source vehicle based on two GPS signal SNRs observationsfrom a single mobile detector at two time points. Thenwe discuss how to determine the recording time zone by

leveraging the estimated speed and location of the sourcevehicle.

Assuming that at time t1 the mobile detector detects thepresence of GPS jamming on a road with the opposite direc-tion, the detector reports its speed vm, the maximum SNRsof the GPS signal before the detection S0 and after the de-tection S1 to a centralized server. Based on S0 and S1, thecentral server can calculate the noise power after the detec-tion as N1 = S0−S1+N0. Then it can obtain the jammingsignal’s amplitude by subtracting the thermal noise from thenoise after the detection, and further estimate the jammingsignal power by taking the square of the jamming signal’samplitude using the equation:

J1 = 10 log10 (√

10N1/10 −

√

10N0/10)2, (1)where N0 can be calculated with room temperature and sig-nal bandwidth [26]. Note that the J1 in Equation (1) isconverted to decibel unit. Since most civilian GPS jammershave similar jamming power [2], the central server can esti-mate the relative distance d1 between the jammer and thedetector with the estimated jamming signal power J1 basedon the free-space path loss model[22]. Similarly, the centralserver can estimate the relative distance d2 = d1 − ∆d attime t2 = t1 + ∆t by using the S0 and another maximumSNR S2 reported by the detector at time t2 (within the de-tection period). The estimated speed of the source vehiclevJ can be calculated as following:

vJ = (∆d)/(∆t) + vm, (2)The estimated speed of the source vehicle keeps updating

whenever there are new smartphones reporting the detec-tion of the jamming/interference. Assuming the individualvehicle speeds follow a invariant normal distribution [18],the central server can fit the vJ in Equation (2) to a normaldistribution N (µv, δv), where µv and δv are the mean andstandard deviation of the speed, respectively. Since the cen-tral server can also estimate/track the locations of the sourcevehicle by utilizing the last-fixed locations reported by mo-bile detectors on the road, when the central server finds thatthe source vehicle will pass a roadside camera that is at adistance of dc away, it can estimate the traveling time of thevehicle to reach the camera as:

tc = (dc)/(µv), (3)and start recording on the camera around tc to capture

the candidate vehicles. We define the recording time zone as{tc− θ1, tc+ θ2}, where θ1 and θ2 are adjustable parameterscapturing the estimation errors, which can be calculated asfollowing in our work:

θ1 = (dc · 3δv)/(µv(µv + 3δv)),θ2 = (dc · 3δv)/(µv(µv − 3δv)).

(4)

To get an understanding of the relationship between θ andthe distance from the interference observation, we analyzethe difference in travel time of vehicles on a common roadsegment using the NGSIM dataset mentioned above. Theemulation randomly selects 2000 pairs of intervals that are100 to 500m long on this road segment. It then calculates theamount of time it takes for each vehicle to travel through thisinterval. Figures 13 shows the distribution of travel time foreach interval length, in 100 meter increments. The spreadin travel times is directly related to theta. For example, theresults show vehicles took between 25 to 55s to travel the500 meters intervals. This means that if the camera is 500meters away from the mobile detection, an appropriate sizefor θ1 and θ2 would be 15s, which together results in the 30sspread in travel times observed.

RF&DC

RF

Power Injector IsolatorSignal Attenuator

T

USRP Interference Attenuator

Combiner T u-blox

GPSAntenna

T

Figure 6: The wired experiment circuit.

4.3 Monitoring Point Vehicle IdentificationThe formulation of the peak detection zone and record-

ing time zone equip our system to derive a new approachthat can automatically identify the transmitting vehicle byexploiting the camera visualization. When a single monitor-ing point with a roadside detector and a monitoring camerais available, the moment tm when the detector finds the in-terference signals having the maximum value is utilized tocheck the video captured by the monitoring camera. Andthe peak detection zone is applied to capture all the candi-date vehicles. We show in the next Section that we find over95% of our experiments in real-road scenarios capture onlyone candidate vehicle inside the peak detection zone.

In low traffic conditions, using single monitoring point canidentify transmitting vehicles with high confidence, becausein most of the cases there is only one transmitting vehicle inboth the peak detection zone and the recording time zone.However, if the traffic is heavy, multiple candidate vehiclescould be captured by either the peak detection zone or therecording time zone. By using our low-cost solution, our sys-tem can employ multiple monitoring points separated alongthe major roads having high traffic volume to still uniquelyidentify the transmitting vehicle. The intuition behind thisis that with two or more monitoring points along the samedirection of the major roads, it is less likely for a trans-mitting vehicle to have the exact same neighboring vehiclesinside of either the peak detection zone or the recording timezone when crossing different monitoring points.

Thus, the multiple monitoring points identification algo-rithm is separated into 2 steps:

Step 1: Collect Images of Candidate Vehicles fromMonitoring Points. Assume the transmitting vehicle pass-ing K monitoring points on the road, the cameras at thesemonitoring points are all triggered to record the videos whenthe transmitting vehicle passing by. Therefore, each moni-toring point generates the images of candidate vehicles (in-cluding the transmitting vehicle) from the recorded videos,denoted as Rk = {rk1 , . . . , r

km}, where k = 1, . . . ,K is the in-

dex of monitoring points, rkm is the images of mth candidatevehicles captured at the kth monitoring point. All Rk aretransmitted to a central server. We note that this step is alsovalid if the transmitting vehicle passing the same monitoringpoint for K times in one day or different days, similarly, Rk

from the same monitoring point will be transmitted to thecentral server.

Step 2: Cross Validate Candidate Vehicles. Oncethe central server receives the sets of vehicle’s image Rk fromall monitoring point cameras, it finds the common vehicleC that appears in all Rk by calculating the C = R1 ∩ R2 ∩. . . ∩RK .

5. PERFORMANCE EVALUATIONIn this section, we evaluate the two most important com-

ponents in the designed system: Carrier-to-Noise (C/N0)

−100 −90 −80 −70 −60 −500

10

20

30

40

50

Interference Power(dBm)

C/N

0(d

B)

Satellite 12Satellite 14Satellite 18Satellite 22Satellite 25

0 50 100 1500

5

10

15

20

25

30

Time(sec)

C/N

0(d

B)

Satellite 12Satellite 14Satellite 18Satellite 22Satellite 25

(a) (b)

Figure 7: Result of cable experiments where (a) showsC/N0 levels of satellites for different interference power lev-els, and (b) shows C/N0 levels of satellites when GPS re-ceiver lost location fix.

profiling based detection in both static and mobile cases,and source vehicle identification leveraging energy detectionthrough roadside monitoring. Such performance evaluationprovides fundamental insights to a complete system imple-mentation for GPS interference detection.

5.1 Stationary Carrier-to-Noise Profiling andInterference Tests

To gain a deeper understanding of the effect of an jam-ming signal on SNR levels of GPS receivers, we conductedthe following experiments. To comply with federal regula-tions and to minimize possible interference to GPS systems,we created a wired testbed depicted in Figure 6. In thissetup, a jamming signal created by a USRP N210 softwaredefined radio is combined with GPS satellite signals froman external antenna and fed into a u-blox EVK-7N GPS re-ceiver [27]. We used an isolator to ensure that the jammingsignal is not transmitted by the GPS antenna. In addition,we utilized a high gain (40dB) GPS antenna with attenua-tors to adjust the SNR of the received GPS signals. Usingthis setup, we first analyze the SNR patterns of differentsatellites with a 10 hour experiment. In this test, we didnot use any attenuation to be able to observe the naturalSNR behaviour of satellites. The result of our detection al-gorithm is depicted in Table 1 as the stationary case. Thenby using this setup, we analyze the impacts of interferencepower on different satellites. As shown in Figure 7(a), in-creasing interference power results in a linear decrease ofSNR with increased noise. This result verifies the expectedeffect of interference on the SNR readings.

We also observe that when a GPS receiver loses a locationfix due to high-energy interference it sometimes still can re-ceive data from some satellites, at least for part of the time.We show the SNR level of several satellites over time at aninterference level of −45dBm in Figure 7(b) where the GPSreceiver has lost the location fix. We can observe high vari-ance in several satellites under this high level of interference,an effect that we have not observed under any of our non-interference tests—both in this wired setup and the vehicleexperiments described later. This pattern can therefore bea further indicator for interference.

5.2 Mobile Detectors for Carrier-to-Noise Pro-filing

We study the performance of mobile detectors leveragingmobile devices (e.g., smartphone and GPS receiver) placedinside of vehicles. Specifically, we examine the detection rateand false positive rate under various interference powers andthe behavior of SNR changes across different mobile devicesover repeated road trips.

0 5 10 150

10

20

30

40

50

60

Distance(km)

Ave

rage C

/N0(d

B)

Trip 1Trip 2Trip 3Trip 4

0 100 200 300 400 500 600 7000

10

20

30

40

50

60

Distance interval number

Ave

rage C

/N0(d

B)

(a) Average C/N0 (b) Combined C/N0

Figure 8: C/N0 profile construction: (a) shows averageC/N0 for different trips for a route and (b) shows the con-structed C/N0 profile the route.

5.2.1 Experimental SetupHardware and Signals. We conduct our experiments

in two routes in two US cities. In the first city, we use 1HTC Evo 4G phone, 1 LG Nexus 4 phone, and 1 u-bloxEVK-7N GPS receiver. We use 1 LG Nexus 4 phone inthe second city. During the experiments, smartphones arelocated on the front panel of the car and GPS antenna foru-blox receiver is placed on top of the car.

Real Road Scenarios. We chose a suburban highwayfor route 1 with a distance of 12 km which includes oneunderpass and a city road for route 2 with a distance of6 km. We drove our vehicle in regular traffic at differenttimes of a day for 20 different days over 4 weeks and use thesmartphones and the GPS receiver to record the GPS signalfor all trips. We split the distance into 20 meters long roadintervals which is relatively small and is long enough to getseveral readings from receivers.

Metrics. In this work, we utilize the mean value of 4largest SNRs from all satellites, since GPS chips utilize the4 strongest satellite signals to determine 3-D positions. Inthe rest of the paper, SNR level corresponds to such a meanvalue. We consider the case, where the SNR level reportedby a receiver is less than the threshold, as a detection whenthe GPS jamming/interference is present. Based on this,we evaluate the performance of the detection algorithms interms of following metrics: 1) detection rate (DR) is thepercentage of distance intervals in which the detection issuccessful. For instance, in our route 1 experiment, thereare 610 different road intervals (i.e 610 * 20 meters = 12.2km), and if the detection is successful in x of them, then thedetection rate becomes (x * 100 / 610) %. 2) False positive isthe case when our algorithm determines there is a suspiciousGPS interference activity although it is not coming from ajammer. We note that the detectable interference power isdefined as the level where detection rate exceeds 95%.

5.2.2 Experimental ResultsFeasibility Study of Profile Construction. Figure 8

shows the average C/N0 over 4 days (each trip represents oneday) versus the relative distances from the starting pointsof the trips in two cities. We observe that the C/N0 levelsare consistent at same locations across different days. Forinstance, there is always a big drop in C/N0 at about 6 km inFigure 8(a) which is caused by an underpass during the roadtrip. We note that the C/N0 level in smartphones fluctuatemore than that in the GPS receiver.

To further illustrate the basic idea, a C/No profile couldbe constructed by combining the C/N0 values from all tripsacross different days into each corresponding distance inter-val. The constructed C/N0 profile of the testing route isshown in Figure 8(b).

−150 −130 −110 −90 −70 −500

20

40

60

80

100

Interference Power(dBm)

Dete

ctio

n R

ate

%

m − 2*σ

m − 3*σ

m − 4*σ

−150 −130 −110 −90 −70 −500

20

40

60

80

100

Interference Power(dBm)

Dete

ctio

n R

ate

%

m − 2*σ

m − 3*σ

m − 4*σ

(a) u-blox GPS receiver (b) Smartphone

Figure 9: Estimated detection rate of our detection algo-rithm for different interference powers.

Detection Performance. As we discussed in Section 3,we can determine whether there are interference signals ornot by comparing the newly reported SNR to a fixed thresh-old. We present the detection rate of our algorithm underdifferent interference power by varying the threshold lev-els in Figure 9. In our profiling algorithm as presented inSection 3, the threshold is defined as δ = msnr − k ∗ σsnr.We observe the detection rate increases with the increase ofreceived interference power. And the best detection rateis achieved by using k=2. We further present the falsepositive rate of our algorithm and detectable interferencepower(DIP) under different thresholds in Table 1. We findthat low false positive rates are achieved under all cases,indicating the effectiveness of our approach.

The detection range is dependent on signal propagationconditions. We therefore first evaluate detection rate basedon the actual received interference power. We further studyhow to decide on the distance of the jammer. From de-tectable interference power results in Table 1, we know thatif the received power is -109 dBm, with 95 percentile pos-sibility we can detect the jammer. By using the free spacepath loss(FSPL) model with two propagation exponents 3and 3.5, we observe the jamming activity could be detectedunder the distance of 77 and 14 meters respectively.

5.3 Roadside Monitoring for Source VehicleIdentification

We next study the accuracy of source vehicle identificationthrough roadside monitoring. To perform a representativecase study, in place of an actual jammer, we use a trans-mitter with similar characteristics in the closest ISM bandat 900MHz. This is to minimize the chance of causing anyGPS interference. The shift to the 900MHz band primar-ily means somewhat better material penetration and higherantenna effectiveness. This means that the range in the L1band will be somewhat shorter, but we believe these 900MHzresults are sufficiently close to be useful guidance.

5.3.1 Experimental SetupHardware and Signals. As described in section 3, we

conducted our experiments using USRP N210 at 915MHzband to implement the energy-based interference detectorat each monitoring point. The USRPs were connected tolaptops streaming data to or from the host processors. A

kDIP u-bloxstationary

DIP u-bloxmobile

DIP phonemobile

False Posi-tive

2 -108 dBm -103 dBm -109 dBm 5%3 -105 dBm -86 dBm -91 dBm 1%4 -101 dBm -55 dBm -69 dBm 0.1%

Table 1: Detectable Interference Power and False PositiveRate for different thresholds

(a) 0 MPH (static) (b) 50 MPH

Figure 10: Spectrogram of a jamming signal captured bythe jammer detector from the simulated jammer transmit-ting jamming signal at 915 MHz.

video camera was setup with the USRP at the monitoringpoint to record videos during the experiments with its timesynchronized with the laptop. Specifically, the camera ison an adjacent overpass at each monitoring point, and an-gled to capture the video of traffics on all lanes within thetransmission range of the detector.

Real Road Scenarios. We chose a suburban highwayas a representative route, and placed two monitoring points3 miles apart. The locations were chosen to reflect differ-ent lane/road configurations and based on the availability ofoverpasses for camera placement as well as the availabilityof safe roadside positions (a parking lot and bus stop). Wedrove the vehicle carrying the transmitter on the right-mostand left-most lanes, and passed by the monitoring point for20 times, respectively. The experiments were across differentdays with regular traffic.

Metrics. We consider the number of candidate vehiclesthat are in the detection area(s) at the time of detection. Ifthe number is one, and this is our transmitter vehicle, weconsider a detection successful. Based on this, we evaluatethe performance of our detection and identification approachin terms of the following metrics: 1) detection rate (DR): thepercentage of passes during which our transmitting vehiclewas correctly identified by our system, and 2) false detection:when a vehicle that likely does not emit interference signalsis implicated by our system.

5.3.2 Experimental ResultsValidation of the Emulated GPS Jammer To vali-

date this detection approach and ensure a sufficient detec-tion range as well as robustness to high speeds we conductedthe following experiment. In addition to the roadside de-tector we used a second USRP with a Matlab generated(Figure 2) interference signal to emulate a jammer. Bothwere equipped with one omni-directional antenna [9] (824-960 MHz).

Given that the simulated GPS jammer jams at the powerof -15 dBm, we were able to detect it 50 meters away, in-dicting a good chance of detecting GPS jammers from aroadside location. The spectrograms of the received signalat different speeds (Figure 10) shows that the chirp shapeof the jamming signal remains visible even if the speed is50 MPH and the received signal strength remains similar atdifferent speeds.

Single Monitoring Point Case. We first consider a sin-gle monitoring zone. Provided with the video images fromthe time of signal detection, we manually identified the num-ber of vehicles inside the detection zone and whether ourtransmitter vehicle is among them. As shown in Fig. 11, atmonitoring point 1 there is only a single vehicle in the mon-itoring zone in 13 out of the 20 passes and 2 to 3 vehicles

0 5 10 15 200

1

2

3

4

Trial number (one pass along test route)

Nu

mb

er

of

can

did

ate

ca

rs

0 5 10 15 200

1

2

3

4

Trial number (one pass along test route)

Nu

mb

er

of

can

did

ate

ca

rs

(a) Monitoring point 1 (b) Monitoring point 2

Figure 11: Number of candidate cars at a monitoring pointwhen jamming activity is detected.

are present in the remaining 7 trials. Our transmitter vehiclewas present during all 20 trials, this indicates our system didnot have any false positives and were able to uniquely iden-tify the transmitting vehicle in 65% of the cases. When onlyconsidering monitoring zone 2, a single vehicle was presentin 7 out of the 20 passes with 2 to 4 vehicles in the remainingones, yielding no false positives and a lower detection rateof 35%. This is likely due to the larger number of lanes atthis location.

Multi-Monitoring Point Case. The detection rate canbe significantly improved by combining the information col-lected from both zones. In particular, in the 16 cases wheremore than one car was inside the detection zone at eithermonitoring point 1 or 2, we determined the intersection ofthe candidate vehicle set from zone 1 and 2, as per thecross validation method when multiple detection zones arepresent. This resulted in only a single detected vehicle and acorrect identification of our transmitter vehicle in all cases.

To investigate these aspects further, we determined thetime difference that has accumulated between cars that passedmonitoring zone 1 together when they arrived at monitoringzone 2. Figure 12 (a) presents a histogram of this time differ-ence. Positive timing means it takes more time for a regularvehicle to travel from monitoring point 1 to 2 than the trans-mitting vehicle and vice versa. This time difference allowsus to judge how large detection zones can become before thedetection rate would fall. Our current detection areas couldbe traversed in about 1-2 seconds at typical speeds. The his-togram shows that only a detection zone taking more than4 seconds to traverse (approximately 100m at 25m/s) wouldstart to yield failed detections.

Detection Zone Size and Detection Rate. The re-lationship between detection zone size and detection rate isfurther examined in Figure 12 (b). Here the detection timeinterval represents a detection zone in the time domain (forexample, a 50m zone is approximately equivalent to 2s at25m/s). When this interval is too short, the detection zonemay not include the transmitting vehicle and detection rateis low. If it is too long, many other vehicles are also in thedetection area, which means unique vehicle identification isnot possible and detection rate declines again. In our road-way experiments, detection rate was optimized with a 3-4second interval, achieving a detection rate of 100%.

Thus, to determine the detection zone size, we drove thetransmitting vehicle and passed by each monitoring point20 times as mentioned in section 4. In each pass, when thedetector is triggered by the transmitting signal, our systemrecorded the position of the transmitting car and markedthat position in a screenshot obtained from the camera ascan be seen in Figure 14. These positions let us empiricallycreate a detection zone which covers all of these positions.

−20 0 200

1

2

3

4

Time difference(sec)

Num

ber o

f oth

er c

ars

0 5 10 150

25

50

75

100

Detection time interval(sec)

Det

ectio

n ra

te(%

)

(a) (b)

Figure 12: (a) Time difference between the jamming ve-hicle and other suspicious vehicles that are in the detectionareas at both monitoring points, (b) The change of detectionrate with the detection zone size.

Evolution of the Signal Through One Pass. Whenwe were passing by the monitoring point, the detector de-tects several activities (10 ms long). In Figure 15(a), wepresent how the normalized amplitude of the signal is chang-ing over time for three passes as an illustration. Finally,Figure 15(b) presents the received power for each detectedsignal with the duration of that signal together with a de-tection threshold at monitoring point 1. It is clear thatin the false detection cases, the durations of the incidentand the received power are much less than those in the cor-rect detection cases. Similar observations are obtained frommonitoring point 2. Our detection algorithm gives perfectresults (precision 1) for both monitoring points.

5.3.3 DiscussionIn our experiments, the distance between the monitor-

ing points is about 3 miles and there is no traffic light inbetween. If the distance between the monitoring points isshorter, then we expect to see more cars to travel togetherand they would be seen in the monitoring points together. Ifthere are some traffic lights between the monitoring points,it would force the drivers to move in the same groups andthe number of common cars in both monitoring points isexpected to be more than those in our case. Also drivingstyles can effect the results.

In the evaluation, we have not compared with compet-ing solutions, because we are not aware of an approach thatcan isolate mobile GPS jammers with the level of resourcesthat were at our disposal (we did not have access to theFAA/FCC teams and contractors described in Newark Air-port incident).

5.3.4 Passive Roadside MonitoringWe deployed our detection system in several locations

in two US cities for monitoring GPS L1 frequency band(1575.42 MHz) passively on the roadside. We mainly use ainterference/jamming detector equipped with a multi-bandGPS antennas [17] to continuously monitor the GPS L1 fre-quency (1575.42 MHz) band. The detector is tuned to logany suspicious signal at the L1 band when its power exceedsthe pre-set threshold, which was -60dBm. The suspicioussignals are studied through offline analysis.

To perform extensive roadside monitoring, we want toidentify the interfering GPS signals on public roadways. Withthis purpose, we have selected several locations on threekinds of roads: a major highway, one of the busiest tollroad, and an urban road for passive monitoring of GPS fre-quency band. In total we monitored the roadways passivelyfor approximately 200 hours in the 5 locations in NJ andSouth Carolina.

10

20

30

40

50

100 200 300 400 500Distance between two monitoring points (m)

Tra

veling T

imes (

sec)

0 5 10 150

10

20

30

40

50

60

Distance(km)

Avera

ge S

NR

(dB

)

Trip 1Trip 2Trip 3Trip 4

(a) (b) (c) (d)

Figure 13: (a) Spectrogram of no jamming activity at location 1, (b) suspicious interference activities detected at location2, (c) Travel time of vehicles for different interval length, (d) HTC Evo phone for route 1.

Figure 14: Positions of the transmitter vehicle at the timeof maximum detection in monitoring point 1.

In the 200 hours monitoring at five monitoring points, wedetected two suspicious interference incident at the location1 (on a busy toll road) and the location 2 (on an interstatehighway) respectively. As shown in Figure 13, there washigh energy at the L1 frequency band in both of the twoincidents.

We also emphasize that although, it is not clear if thesignals detected in passive monitoring are coming from areal jammer, these results show that significant interfer-ence events happen in the L1 frequency band and even non-jamming interference can cause problems.

6. DISCUSSIONSystem limitations for future jammers. Our goal

is to design a low-cost detection mechanism that can bemass deployed in roadways, and thus our jamming detec-tion mechanisms are designed to identify existing off-the-shelf GPS jammers that continuously emit interference. Fu-ture jammers that may emit the interference for a short pe-riod of time could still be caught by the mobile detectors(e.g smart phones) since they could still be reporting anyoutages or SNR anomalies even the strength of the jammingsignals change over time. With such reports, the path ofthe jammer car can be interpolated to cameras for identifi-cation. The probability that jammer would be detected bya stationary monitoring point on a single pass is smaller butafter a sufficient number of passes (say, for a commuter),detection would still be likely.

Opportunistic Crowdsourcing. While not every indi-vidual user will be motivated to install our mobile detectorapp for jammer detection, we envision that this mechanismcan still be deployed in police vehicles, public transit sys-tems, delivery truck fleets, etc. It could also become partof future connected vehicle standards or be integrated insmartphone platforms with careful energy management.

GPS Spoofing. Apart from GPS jamming, another se-curity issue is GPS spoofing attacks, whereby attackers trans-mit fake GPS signals to fool the GPS receivers[20]. Notethat GPS spoofing is outside the scope of this paper andwe focus on designing a practical solution for detecting GPSjammers. Nevertheless, our method is complementary toGPS spoofing detection strategies.

0 10 20 30 40−60

−55

−50

−45

Duration(msec)

Re

ceiv

ed

Po

we

r(d

Bm

)

Pass 1Pass 2Pass 3

0 50 100−60

−55

−50

−45

−40

Duration(msec)

Rece

ived P

ow

er(

dB

m)

Correct detectionsFalse detectionsDetection line

(a) (b)

Figure 15: (a) shows the change in received power overtime as the transmitting vehicle passing by the monitoringpoint 1 and (b) shows correct detections and false detectionsat the same monitoring point.

7. RELATED WORKThere are quite a few works analyzing the characteris-

tics of the GPS jammers available in the market and utiliz-ing multiple static stations to detect and localize the jam-mer. Bauernfeind et al. [2] proposes to mitigate the in-carjammers by applying an inverse signal transformation [21].Mitch et al. [16] propose a time difference of arrival (TDOA)based method that can localize the GPS jammer with max-imum error of 15 meters, which however requires the priorknowledge of the jamming signal. Lindstrom et al. [14]builds a network of low cost application-specific integratedcircuit (ASIC) front-end modules providing automatic gaincontrol (AGC) values to detect and localize the interferencesources in GNSS L1/E1 band with an error of 21 meterson average. Similarly, Poncelet et al. [23, 3] can detect andlocalize wide-band GNSS jammers based on TDOA mea-surements with the accuracy of 20 meters.

Vehicular ad hoc networks are also being employed foridentifying and localizing GPS jammers. Bauernfeind etal. [1] uses a Differences-of-Received-Signal-Strength (DRSS)-based localization algorithm which requires at least signalmeasurements from four vehicles for localization. Fontanellaet al.[10] further experimentally confirms the potential forusing VENETs to locate in-car jammers. However, the as-sumption of having vehicles all around the jammer is notgenerally true and the estimation error is approximately 40meters which is too high for automatic vehicle identification.In addition, Kramer et al. [13] recently proposes an Androidbased approach which relies on relative position change be-tween a smartphone user and a static GPS jammer to per-form localization. Scott et al. [25] proposes a crowd-sourcingapproach to detect and localize the GPS jammer by exploit-ing the AGC values from the GPS receiver, which requiresto incorporate the GPS jam-to-noise (J/N) ratio detector incell phones.

Chronos Technology has two commercial devices [5][6] fordetecting and localizing GPS jammers in the L1 frequencyband. However, these devices can only detect jammer instatic scenarios and can only be used manually for a shortperiod of time. On the contrary, our solution is automatic,can be deployed at roadsides and can detect jammer in dy-namic mobile scenarios.

8. CONCLUSIONSeveral incidents caused by in-vehicle jamming devices

have illustrated their serious impact on the availability ofthe navigation services in critical infrastructure. To monitorand reduce the use of in-vehicle GPS jammers, we presenteda low-cost jammer identification system that can be massdeployed in roadways to automatically detect and identifythe vehicles with GPS jammers. Instead of covering all typesof possible jammers, our jamming detection mechanisms fo-cuses on achieving wide geographical coverage against themost prevalent off-the-shelf GPS jammers, which continu-ously emit interference. The dedicated detectors, however,could be extended for more sophisticated jamming signals.The key components of the system are monitoring stations(which are equipped with directional antennas and cameras)and mobile detectors (e.g., smartphones). Using an off-the-shelf software-defined radio (USRP) to emulate GPS jam-ming signals, we conducted a case study evaluation of oursystem with multiple trial drives on local highways in 2 UScities and found the monitoring stations effective.

We also demonstrated that by constructing location-basedprofiles of expected signals, our mobile detector componentcan detect interfering signals based on measurements thatare readily available in most GPS receivers, including theones in smartphones.Thus, it is possible to detect jammersvia crowdsourcing. While not every individual user will bemotivated to install our mobile detector app, we envisionthat this mechanism can be deployed in law enforcementvehicles, public transit systems, etc. End users may alsovolunteer to report data while using GPS navigation ser-vices, and thus provide opportunistic crowdsourced data.The positive results that are obtained when validating themost important components of our solution, i.e., the Energy-based monitoring point and the SNR-based mobile detector,are promising. They indicate the validity of a full-fledgedsystem that consists of a centralized vehicle identificationcomponent integrated with monitoring points and mobiledetectors.

9. ACKNOWLEDGEMENTThis material is based in part upon work supported by

the National Science Foundation under Grant Nos. CNS-0845896, CNS-1329939, CNS-0954020 and by the Army Re-search Office under Grant No. W911NF-13-1-0288.

10. REFERENCES[1] R. Bauernfeind et al. In-car jammer interference

detection in automotive gnss receivers and localizationby means of vehicular communication. In FISTS, 2011IEEE Forum on, pages 376–381. IEEE, 2011.

[2] R. Bauernfeind et al. Analysis, Detection andMitigation of InCar GNSS Jammer Interference inIntelligent Transport Systems. Deutsche Gesellschaftfur Luft-und Raumfahrt-Lilienthal-Oberth eV, 2013.

[3] J. Bhatti et al. Development and demonstration of atdoa-based gnss interference signal localization

system. In PLANS, 2012 IEEE/ION, pages 455–469.IEEE, 2012.

[4] A. Chhabra. Testimony of Ashwini Chhabra, DeputyCommissioner, Policy & Planning. NYC Taxi andLimousine Commission, 2012.

[5] Chronos Technology. CTL3510 GPS Jammer Detector.http://www.navtechgps.com/assets/1/7/CTL3510 DS.pdf.

[6] Chronos Technology. CTL3520 GPS Jammer Detector& Locator. https://www.ettus.com.

[7] Chronos Technology Ltd. SENTINEL: GNSS SErvicesNeeding Trust In Navigation, Electronics, Location.http://www.gps-world.biz/index.php/sentinel-1157.

[8] Ettus Research. USRP N210. https://www.ettus.com.[9] Ettus Research. VERT900. https://www.ettus.com.

[10] D. Fontanella et al. In-car gnss jammer localizationusing vehicular ad-hoc networks. 5/6 2013.

[11] GNU Radio. http://www.gnuradio.org.[12] http://ngsim-community.org/. Next Generation

SIMulation Community, 2013.[13] I. Kramer et al. Android gps jammer localizer

application based on c/n0 measurements andpedestrian dead reckoning. In ION-GNSS, 2012.

[14] J. Lindstrom et al. Gnss interference detection andlocalization using a network of low-cost front-endmodules. In ION GNSS, 2007.

[15] Merrill, John. Patriot Watch Vigilance SafeguardingAmerica.http://www.gps.gov/multimedia/presentations/2012/03/WSTS/merrill.pdf.

[16] R. Mitch et al. Civilian gps jammer signal trackingand geolocation. In ION GNSS, 2012.

[17] MobileMark Antenna Solutions. GPS MultibandAntenna.

[18] M. A. Mutaz et al. Leveraging platoon dispersion forsybil detection in vehicular networks. In PST. IEEE,2013.

[19] National Transportation Library. Transit-ManagementSystems. http://ntl.bts.gov/lib/jpodocs/edldocs1/13480/ch6.pdf.

[20] T. Nighswander et al. Gps software attacks. In CCS.ACM, 2012.

[21] X. Ouyang et al. Short-time fourier transform receiverfor nonstationary interference excision in directsequence spread spectrum communications. SignalProcessing, IEEE Transactions on, 49(4), 2001.

[22] J. D. Parsons and P. J. D. Parsons. The mobile radiopropagation channel. J. Wiley, 2000.

[23] J.-P. Poncelet et al. A low-cost monitoring station fordetection & localization of interference in gps l1 band.In NAVITEC. IEEE, 2012.

[24] G. D. Rash. Gps jamming in a laboratoryenvironment. NAWCWPNS, pages 1–20, 1997.

[25] L. Scott. J 911: Fast jammer detection and locationusing cell-phone crowd-sourcings. GPS World, 2010.

[26] E. N. Skomal et al. Measuring the radio frequencyenvironment. Van Nostrand Reinhold Company, 1985.

[27] U-Blox. EVK-7N.https://www.u-blox.com/en/evaluation-tools-a-software/gps-evaluation-kits.html.

[28] C. VSCC. Vehicle safety communications project: task3 final report: identify intelligent vehicle safetyapplications enabled by dsrc. 2005.