ML-Based System to Detect GPS Spoofing and Signal Jamming via Signal Logs

Abstract

This paper describes the design, implementation, and analysis of a machine learning-based and forensic-grade desktop system to detect GPS spoofing attacks and signal jamming attacks. The system processes telemetry logs collected from Unmanned Aerial Vehicles (UAVs) and other GNSS-enabled systems to detect any malicious signal manipulations and disruptions. It utilizes a pipeline comprising modules: GPS logging, feature extraction, and an unsupervised machine learning detection engine based on Isolation Forest, One-Class SVM, and LSTM Autoencoder models. The system learns the normal behavioral patterns and is trained on actual GPS data, therefore, identifying the previously unknown attacks. One of the contributions is that forensic concepts, such as hash-SHA-256, chain-of-custody logging, and read-only processing, are factored into the human process, thus supporting evidence integrity and traceability. The system generates elaborate visual and textual reports, giving a user-friendly timeline of the attack with severity ratings. Through the experiment with real and synthetic interfered datasets, the system is found to be effective in predictably distinguishing between spoofing (jumping coordinates and unrealistic kinematics) and jamming (significantly lost signal and large drift variance) with substantial detection. This tool offers an essential feature to cybersecurity forensic investigators, drone operators, and other critical infrastructure defenders to diagnose and record GNSS susceptibility.