GPS Spoofing Detection with a Random Forest Multiclass Classifier

Global Positioning System (GPS) signal spoofing is an attack method where false GPS signals are broadcasted by an adversary to mislead GPS receivers into computing incorrect Position, Navigation, and Timing (PNT) information. The consequences of a successful GPS spoofing attack are profound, potentially causing significant disruptions in sectors as diverse as transportation, military operations, and financial services. Traditional methods of detecting GPS spoofing, often based on signal strength analysis and cryptographic techniques, are inadequate against sophisticated spoofing attacks. In this research, we employ a Machine Learning (ML) technique, specifically the Random Forest Multiclass Classifier (RFMC), to detect and differentiate authentic GPS signals from spoofed ones. Unlike previous studies that focus on binary classification, this research not only detects spoofed GPS signals but also categorizes them into simplistic, intermediate, and sophisticated spoofing attacks.RFMC is applied to a publicly available GPS spoofing dataset comprising thirteen features extracted from legitimate and simulated GPS signals across three distinct scenarios. In scenario 1, the RFMC model is trained using all thirteen features from the dataset. In scenario 2, the model is trained by using a reduced set of features, selected based on Spearman’s correlation and feature importance to address multicollinearity. In scenario 3, the dataset with reduced features is balanced using the Synthetic Minority OverSampling Technique and Edited Nearest Neighbor (SMOTE-ENN). The performance is evaluated using three performance metrics: precision, recall, and F1-score across all three scenarios. Among the three scenarios evaluated, scenario 3 stands out with high F1 scores of 0.97 for authentic signals, 0.79 for simplistic spoofing, 0.75 for intermediate spoofing, and 0.96 for sophisticated spoofing.