GPS Multi-Receiver Joint Direct Time Estimation and SpooferLocalization

Sriramya Bhamidipati, Student Member, IEEE and Grace Xingxin Gao, Senior Member, IEEE

Abstract—We propose a novel algorithm on joint estimation ofGPS time and spoofer location (LS) using Multi-Receiver DirectTime Estimation (MRDTE). We utilize the geometry and knownpositions of multiple static GPS receivers distributed within thepower substation. DTE directly estimates the maximum likelyclock parameters from a pre-generated set of clock candidatesby performing multi-peak vector correlation across the satellites.We compare the time-delayed similarity in the signal propertiesacross the geographically distributed receivers to detect anddistinguish the spoofing signals. Later, we localize the spooferusing our joint Particle and Kalman Filter.

We validate the robustness of our LS-MRDTE subjected tospoofing attacks such as meaconing and data-level spoofing.Our experimental results demonstrate precise localization of thespoofer while simultaneously estimating GPS time to within theaccuracy specified by the power community (IEEE C37.118).

Keywords—GPS, Spoofing, Meaconing, Maximum LikelihoodEstimation, Kalman Filter, Particle Filter, Vector Correlation,Phasor Measurement Units, Cramer Rao Lower Bound, Detection,Localization

I. INTRODUCTION

In power grid, Wide Area Monitoring System (WAMS) [1]–[3] depends on synchronized phasor (voltage and current)measurements obtained from distributed Phasor MeasurementUnits (PMUs) [4]. When the current power system is trans-ferred to an automated smart grid in the future, these PMUmeasurements are crucial for high-resolution grid state esti-mation and early-stage detection of destabilizing conditions.

A. GPS Timing in PMUsThe IEEE C37.118.1-2011 describes the standarized mea-

sures to evaluate the stability of the power grid [5]. Thisstandard evaluates the Total Vector Error (TVE) which dependson three parameters: magnitude, timing and phase angle. Withno errors in timing and magnitude, phase angle error of 0.573◦which corresponds to a 1% TVE, is the maximum allowableTVE as in Fig 1(a). This phase angle error is equivalent to atiming error of 26.5 µs which is used as a benchmark in ourpower grid stability analysis [6]-[7].

In this regard, PMUs maintain network-wide synchroniza-tion by obtaining precise time stamps from time keepingsources such as GPS, external atomic clocks etc. Civil GPSsignals provide µs-level time accuracy and are freely availableto users. Due to the global coverage provided by the GPSconstellation, network-wide stability monitoring of the powergrid is efficiently achieved.

However, the power of GPS signals received is as low as10−16 W , which is below the thermal noise floor. In addition,the GPS civil signals are unencrypted, with their PRN codes

explicitly described in publicly available documents [8]. Thismakes the GPS signal spectrum susceptible to external timingattacks such as jamming [9]-[10], spoofing [11]-[12] etc.

(a) IEEE C37.118.1 (b) Under spoofing attack

Fig. 1: (a) IEEE C37.118 standard for synchrophasors. Maxi-mum allowable TVE is 1%; (b) during spoofing, GPS signalacquisition shows two significant peaks one due to authenticsignals and other due to spoofing.

B. Impact of spoofing attacksThe susceptibility of GPS signals to spoofing leads to

potential threats in the power system. In spoofing, counterfeitsignals are transmitted as in Fig. 1(b) to mislead the PMUwith incorrect time and thereby disrupt the stability of thegrid. A spoofer aims to maximize the time error induced whileminimizing the probability of being detected. The various GPSspoofing attacks which threaten the stability of the powersystems are as follows:

1) Meaconing: A spoofer executing meaconing attack (alsoknown as record and replay) as seen in Fig. 2(a),records the GPS signals and replays them at a latertime to overpower the authentic signals and manipulatethe receiver [13]. To execute this attack, the spooferdoesn’t require the knowledge of encyrption codes andis thereby capable to spoof even military receivers.

2) Data-level spoofing: In data-level spoofing, a spoofermodifies the ephemeris [14] such that the satellitesare shifted in position along their Line-Of-Sight (LOS)to the target receiver as in Fig. 2(b). This causes thereceiver to still estimate the correct location but wrongtime thereby covertly manipulating the PMUs.

3) Signal-level spoofing: This is a sophisticated three-stageattack as shown in Fig. 2(c). At first, a spoofer generatesand broadcasts counterfeit GPS signals identical to theauthentic signals received at the target receiver [15]. Inthe second stage, the power of these malicious signalsis slowly increased to mislead the target receiver tolock onto these counterfeit signals. Once locked, the

1

spoofer manipulates the time by moving the counterfeitsignal away from the true time. Since there is no suddenchange in the GPS timing output, this method cannoteasily be detected by traditional methods.

(a) Meaconing attack (b) Data-level spoofing attack

(c) Signal-level spoofing attack

Fig. 2: Types of spoofing attacks: (a) meaconing attack in-volving record and replay of GPS signals; (b) data-levelspoofing that transmits incorrect ephemeris; (c) signal-levelspoofing that generates spoofing signals to trick the receiverinto latching onto the spoofing peak.

C. Related Work

One of the works on spoofing [16] analyzes the requirementsfor successful spoofing attacks and analytically identifies thelocation and precision with which the attacker needs to gen-erate the corresponding spoofing signals. This work describesthe characteristics of the spoofing attacker and their temporaland spatial effect on the receivers.

The hazardous impact of GPS timing attacks has recentlygained worldwide attention due to the successful spoofing ofan $80 million yacht, demonstrated in [17]. Furthermore, testshave been conducted to demonstrate the vulnerability of PMUsto GPS spoofing attacks [18].

Various countermeasures have been proposed by re-searchers [19] to tackle varying complexity of spoofing attackson civilian GPS signals as seen in Fig. 2. Some of the state-of-the-art techniques deal with analyzing the physical character-istics of the signal such as satellite signal strength, noise floor,automatic gain control (AGC) and angle of arrival (AOA).Also, a simple spoofing detector based on analyzing theposition data has been proposed in [20] that employs Gaussianbased Neyman-Pearson perspective.

A probabilistic countermeasure has been proposed in [21]that leverages the underlying correlation between the errorsat co-located receiver positions to detect the presence ofspoofing attacks. The increase in complexity of placing asuccessful spoofing attack has been demonstrated by observingthe L1 carrier differences between multiple receivers in [22].However, the above mentioned methods are not completelyresilient against advanced attacks capable of manipulatingthe navigation message while maintaining the original signalcharacteristics or that can perform seamless takeover attack.

In [23] researchers analyze the security of GPS timing inPMUs against spoofing attacks by detecting and localizing thepresence of the spoofing source using multilateration tech-niques. A spoofing resistant GPS receiver known as SPREEhas been proposed in [24], that detects the spoofing signalsusing auxiliary peak tracking technique and analyzes its theo-retical and practical bounds within which it successfully tracksthe malicious signals.

In our prior work, we proposed our novel Direct TimeEstimation (DTE) [25] architecture to improve the robustnessof GPS timing supplied to the PMUs. We extended our workto Multi-Receiver Direct Time Estimation (MRDTE) [26] thatutilizes the known location of the spatially dispersed receiversto improve resilience against external timing attacks. In theaforementioned, we validated the improved attack-resilienceof our MRDTE based timing as compared to the traditionalscalar tracking and our prior work on Position-Information-Aided Vector Tracking [27].

D. Our work and contributionTo address GPS spoofing, which is a complex and sophis-

ticated external timing attack, we develop a novel algorithmon joint estimation of spoofer location (LS) and GPS timeusing MRDTE. The focus of our LS-MRDTE is to explicitlydetect and distinguish the spoofing signals using multiple peakvector correlation and later mitigate and localize the spooferusing joint Particle and Kalman Filter. In our prior work [26],we described the framework of MRDTE and in [28], weshowed the preliminary results of our LS-MRDTE subjectedto meaconing. In this paper, we present our new contributionsin the following aspects:

1) To analyze the localization accuracy obtained, we the-oretically formulated the impact of the geometry andpositions of multiple receivers in estimating the CramerRao Lower Bound (CRLB).

2) We mathematically estimated the covariance of themeasurements obtained by executing multiple peak vec-tor correlation designed to detect and distinguish thespoofing signals. These measurements are given to thejoint Particle and Kalman Filter to locate the spoofer.

3) We also estimated the probability of spoofer detectionusing our LS-MRDTE based on the covariance of themeasurements estimated.

4) During spoofing, we demonstrated the increased ro-bustness of our LS-MRDTE in estimating the GPSsignal parameters as compared to single receiverDTE (SRDTE) and traditional scalar tracking.

2

5) We validated the accuracy of estimated GPS time andspoofer location using our LS-MRDTE subjected to dif-ferent scenarios of spoofing attacks such as meaconingand data-level spoofing.

The rest of the paper is as follows: Section II describes ourLS-MRDTE architecture in detail and gives an overview of theJoint Particle and Kalman Filter module. We also theoreticallyprove the lower bounds of the spoofer localization accuracyobtained using CRLB and estimate the probability of spooferdetection. Section III validates the performance of our LS-MRDTE in localizing the spoofer and estimating the GPS timethrough outdoor experiments under different scenarios of GPSspoofing attacks. Section IV concludes the paper.

II. JOINT ESTIMATION OF SPOOFER LOCATION AND GPSTIME USING MRDTE

Our novel joint estimation algorithm is used in conjunctionwith our multiple receiver based DTE to simultaneously local-ize the source of spoofing signals and provide attack-resilientGPS timing to the PMUs.

A. Background of GPS Signal Parameters

Given that the power substation is static, we pre-computethe position and velocity (Xk, Xk k = 1, ..,L) of our L (> 3)spatially dispersed multiple receivers [29] and use this infor-mation for position aiding. In addition, all the receivers in oursetup are synchronized using a common clock.

Xk : Known position of the kth receiver= [x, y, z]k

Xk : Known velocity of the kth receiver= [x, y, z]k

Tt : Clock state of the receivers= [cδ t, cδ t]t ,

where t denotes the time instant, c = 299792458 m/s is thevelocity of light, cδ t denotes clock bias and cδ t denotes clockdrift.

For L1 frequency, the transmitted GPS civilian signals fromthe ith satellite are represented as:

siT =R

{√2PT U i(t) e j2π fL1t

}, (1)

where U i(t) = Di(t)Gi(t), PT represents the transmitted powerof the GPS signal and fL1 = 1575.42 MHz is the frequencyof L1 GPS signals. Di(t) and Gi(t) denotes the navigationdatabit and the L1 C/A code chip of the ith satellite at anytime instant t.

The GPS signal replica (Y ) given by Eq. (2) depends on4 signal parameters for each of ith satellite which includecarrier properties denoted by the carrier frequency ( f i

carr) andcarrier phase (φ i

carr) and C/A code properties denoted by codefrequency ( f i

code) and code phase (φ icode).

Y : Signal replica of the GPS signal

=N

∑i=1

Y i

Y i : Signal replica corresponding to the ith satellite

= Di(t)Gi( f icodet +φ

icode)e

j2π( f icarrt+φ i

carr),

(2)

where N denotes the total number of satellites-in-view.

f icode = fC/A +

fC/A

fL1× f i

D

φicode =−

fC/A

c

(||Xx,y,z−Si

x,y,z||

+(cδ t− cδ t i)

) (3)

f icarr = fL1 + f i

D

f iD : Carrier Doppler frequency of the ithsatellite

=− fL1

c

(− losi

x,y,z.(Xx,y,z−Six,y,z)

+(cδ t− cδ t i)

),

(4)

where

los(i)x,y,z : LOS vector for ithsatellite

=−(Xx,y,z−Si

x,y,z)

||Xx,y,z−Six,y,z||

Sit : Position and velocity of the ith satellite= [xi

s, yis, zi

s, xis, yi

s, zis]t .

B. Overview of LS-MRDTEThe underlying principle of our LS-MRDTE algorithm

depends on our novel signal processing technique known asthe Direct Time Estimation (DTE). Unlike the scalar tracking,DTE directly works in the navigation domain and does notestimate the intermediate pseudo-range and pseudo-rate mea-surements.

As in Eq. (5), DTE estimates the cumulative satellite vectorcorrelation of the received raw GPS signal (sR) with the signalreplica (Y ). This vector correlation is produced for each gridpoint g j from a pre-generated search space that consist ofG grid points. Later, the principle of Maximum LikelihoodEstimation (MLE) is applied to estimate the maximum likelyclock parameters.

corr j : Vector correlation for the jth grid point

= R(sR,N

∑i=1

Y i(g j))

g j = [cδ t j,cδ t j] , j = 1, ...,GTMLE : MLE estimated GPS time

= argG

maxj=1

corr j

= [cδ tMLE ,cδ tMLE ]

(5)

3

Our MRDTE algorithm executes DTE at each individualreceiver in parallel and later computes the joint probabilisticdistribution across the receivers. We leverage the informationredundancy and geometrical diversity of the receivers to im-prove the robustness of the GPS timing given to the PMUs asinput.

According to the free space path loss model, the receivedsignal sR,k at the kth receiver has two components whensubjected to spoofing: one corresponds to the authentic sig-nal (sR,aut,k) and the other is the meaconed signal (sR,sp,k).

sR,k =N

∑i=1

R

{λL1

4πei2π fL1t

[√2Piaut U i

(f icode,autt +φ i

code,aut

)e− j2πraut,k/λL1

riaut,k

+

√2Pi

sp U i(

f icode,spt +φ i

code,sp

)e− j2πrsp,k/λL1

risp,k

]}= sR,aut,k + sR,sp,k,

(6)

where λL1 =c

fL1and Pi

aut and Pisp are the received power levels

of authentic and spoofed GPS signals respectively. riaut,k and

risp,k = ri

sp,0 + rsp,1 are the distances traveled by the authenticand the meaconed signal respectively to reach kth receiver. ri

sp,0is the distance between the ith satellite and the spoofer locationwhile rk is the distance between the spoofer location and thekth GPS receiver.

Fig. 3: In our LS-MRDTE, time-delayed similarity in thesignals received by multiple receivers are utilized to detectand localize the spoofer.

To localize the ground spoofer as seen in Fig. 3, we utilizethe aspect that the spoofer is relatively in close proximity toour multiple receiver setup as compared to the authentic GPSsatellites that are at an altitude of 20200 km (12550 miles).

C. Architecture of LS-MRDTE

Our proposed LS-MRDTE addresses the spoofing attacks infour stages as shown in Fig. 4:

1) Firstly, we generate a 2-Dimensional (2D) search spaceconsisting of plausible clock bias and clock drift can-didates.

2) Later, we execute multi-peak vector correlation to detectall the significant peaks found in the pre-generatedsearch space considered.

3) Next, we detect and distinguish the spoofing signalsby comparing the time-delayed similarity in the signalproperties received across the geographically distributedreceivers.

4) We perform non-coherent summation across the satel-lites for each receiver to estimate the maximum likelyclock parameters in case of authentic signals and tocompute the shift in the emulated peak across thereceiver pairs in case of malicious signals.

5) Lastly, we execute our Joint Filter module which con-sists of a Particle Filter that localizes the spoofer; anda Kalman Filter that collectively processes the maxi-mum likely clock parameters obtained from differentreceivers to estimate the GPS time.

Fig. 4: High level architecture of our LS-MRDTE algorithm.

D. Our LS-MRDTE Algorithm

In our algorithm, we consider a single spoofer presentin the direct LOS of our multi-receiver setup. We assumethat the malicious signals sent by the spoofer effect all thereceivers.

1) Spoofer Detection::The first stage is our multi-peak vector correlation module.

Based on our DTE, this module estimates all the significantpeaks from the considered search space. By utilizing the known3D position and velocity of the satellites and receivers, wegenerate a combined satellite signal replica corresponding toeach of the grid points (g j) as in Fig. 5. Then, multi-peakvector correlation of the incoming raw GPS signal and ourcombined satellite replica is executed to obtain the likelihoodof each of the grid points.

4

Fig. 5: Detailed flow of vector correlation. Refer to [25].

At the individual receiver level, vector correlation plotsthe correlation amplitude and spectrum magnitude for eachsatellite. Correlation amplitude depends on the code phaseresidual (∆φ i

code) which is proportional to the clock biascandidate (∆cδ t j) as in Eq. (3). Similarly, spectrum magnitudedepends on the carrier Doppler frequency residual (∆ f i

carr)which is proportional to the clock drift candidates (∆cδ t j)as in Eq. (4). For computational efficiency, we separate ourcalculations into two independent threads as

∆Tcδ t =

∆cδ t1 0: :

∆cδ t j 0∆cδ tM 0

, ∆Tcδ t =

0 ∆cδ t1: :0 ∆cδ t j0 ∆cδ tM

and therefore,

cδ tMLE = argM

maxj=1

(N

∑i=1

R(

∆Tcδ t, j,cδ t))

(7)

cδ tMLE = argM

maxj=1

(N

∑i=1

R(

cδ t,∆Tcδ t, j

))(8)

For authentic signals, the correlation amplitude and spectrummagnitude plots show a single clear peak as in Fig. 5 across theclock candidates considered. However, under spoofing attack,we observe multiple significant peaks in the correlation ampli-tude plotted against the clock bias candidates as in Fig. 6(a).Of these, one peak corresponds to the spoofing signals and theother corresponds to the authentic signals. Across the satellites,we can observe that the peaks occur consistently at around thesame clock candidates with a difference in the magnitude ofthe correlation amplitude values.

Similar comparison is conducted across the receivers as inFig. 6(b). We compare time-delayed similarity in signals re-ceiver across spatially dispersed receivers to detect and distin-guish the spoofing signals. After this non-coherent summationacross the satellites is carried out at the individual receiverlevel to obtain weights that correspond to the likelihood ofthe grid point (g j). For authentic signals, principle of MLE iscarried out to obtain the maximum likely clock parameters.

(a) Across satellites (b) Across receivers

Fig. 6: Under spoofing, multiple peaks are detected in thevector correlations plots. The clock bias candidate that cor-respond to malicious peak passing through the red dotted lineis consistent across the satellites and show a significant shiftacross the receivers.

For spoofing signals, one of the receivers is designatedas master (k = 1) and the others as slaves (k = 2, ..,L). Wecompute the shift in the malicious peak for each master-slave pair which is equivalent to the difference in the rangeof receivers from the spoofer. Therefore, we not only detectthe counterfeit signals but also distinguish them from that ofauthentic signals.

MP1−MPk = r1− rk, k = 2, ..,L (9)

Due to position aiding, the unknown spoofer is localizedusing Particle Filter branch of the Joint Filter module.Simultaneously, the Kalman Filter branch of the Joint Filtercollectively processes the maximum likely clock parametersobtained from different receivers to estimate the correctedclock bias and clock drift parameters. These paramteres areused to estimate GPS time that is later given as input to thePMU.

2) Spoofer Localization using Particle Filter::The first branch of our Joint Filter module implements a

Particle Filter to localize the spoofer (Xsp) based on the shiftin the malicious peaks for each of the master-slave pair.

ζ =

MP1−MP2:

MP1−MPkMP1−MPL

=

||X1−Xsp||− ||X2−Xsp||:

||X1−Xsp||− ||Xk−Xsp||||X1−Xsp||− ||XL−Xsp||

ζk = m1k

(Xsp

) (10)

We generate α particles Xn,sp , n= 1, ...,α around the initialguess that is assumed to be the centroid of the multiple receiversetup. The geographical area to be spanned, distribution andnumber of particles are considered based on the receiver setupduring the initialization phase.

First, we update the weights of all the α particles based onour measurement model by computing the probability of the

5

measurement of a particle given the state of a particle (Pwn):

ζn,sp =

||X1− Xn,sp||− ||X2− Xn,sp||

:||X1− Xn,sp||− ||Xk− Xn,sp||||X1− Xn,sp||− ||XL− Xn,sp||

Pwn =1√

2πRp fe

(−(ζ − ζn,sp)

2

2Rp f

)

Pwn =Pwn

∑αn=1 Pwn

(11)

After obtaining the weights, we randomly (β ) re-samplenew set of α particles from the cumulative distribution of theweights Pwn . Based on statistical probability, on an average,we obtain the particles with higher probability. Then the meanof these particles is assigned as the estimate of the spoofer atthat particular instant.

Xn,sp = Xn,sp if β ≤ cumsum(Pwn)

Xsp = mean(Xn,sp)(12)

Finally the state of the particles are estimated for the nextinstant based on the state transition matrix of a stationaryspoofer. The measurement and process noise covariancematrix (Rsp, Qsp) are manually tuned during initialization toefficiently localize the spoofer.

3) GPS time using Kalman Filter::The maximum likely clock parameters obtained from indi-

vidual receivers are processed to obtain the measurement errorvector (et ). This is given as input to the second branch of ourJoint Filter module i.e., Kalman Filter.

The measurement update equations are as follows:

et =

Tt,1− Tt

:Tt,k− TtTt,L− Tt

H : Observation matrix

=

[1 0 1 0 1 0 1 00 1 0 1 0 1 0 1

]T

(13)

Pt : Predicted state error covariance matrixRt : Measurement noise covariance matrix

=

[Rt,1 .. 0 .. 0: : Rt,k : :0 .. 0 .. Rt,L

]Kt : Kalman gain matrix

= PtHT (HPtHT +Rt)−1

(14)

∆Tt : State error vector: Ktet

Tt : Corrected state vector of the kth receiver= Tt +∆Tt

Pt : Corrected state error covariance matrix= (I−KtH)Pt

(15)

We linearly propagate the clock parameters based on thefirst order state transition matrix to predict the common clockparameters for the next time instant t + 1. The time updateequations are:

F : State transition matrix, 2×2

=

[1 ∆T0 1

], ∆T is the update interval

Qt : State process noise covariance matrix

= F[

0 ∆T0 (c×στ)

2

]FT

στ : allan deviation of the front-end oscillator

(16)

Tt+1 : Predicted state vector for the (t +1)th instant= FTt

Pt+1 : Predicted state error covariance matrix= FPtFT +Qt

(17)

E. Localization accuracy using CRLB

The factors related to receiver setup such as number ofreceivers, their spatially geometry, distance of these receiversfrom spoofer affect the localization accuracy of the spoofer.In addition, our GPS signal processing technique namelyDTE impacts the covariance of measurements obtained therebyeffecting the localization accuracy. To assess the impact ofthese factors, we evaluate the CRLB that provides a measure onthe localization accuracy that is attained based on the incomingmeasurements.

The CRLB gives a lower bound on the asymptotic covari-ance that is achievable using any unbiased estimator. Thislower bound is defined to be at least as high as the inverseof the Fisher Information (FI). The CRLB and FI are definedas follows:

E[(Xsp−χ)(Xsp−χ)T

]= J−1

sp (18)

and

Jsp = E[∆χ lnp

(ζ |χ)(

∆χ lnp(ζ |χ))T], (19)

where E[.]

denotes the expectation operator, ζ denotes the dif-ference in range measurements for each master-slave receiverpair, Xsp is the estimate of the spoofer from our LS-MRDTEwhile χ is the true position of the spoofer.

In our LS-MRDTE algorithm, we consider a pre-determinedreceiver geometry and their positions based on the constraints

6

of the power substation. Assuming additive Gaussian measure-ment noise, the variance of the spoofing signals depends onthe spoofer characteristics and our LS-MRDTE i.e.,

ζ1k−m1k(χ)≈N

(0,σ2

1k(χ))

, (20)

where σ21k

(χ)= σ2

1(χ)+σ2

k

(χ)

and σ2k

(χ), k = 1, . . . ,L is

the variance of measurements estimated using our LS-MRDTEand given as input to the Particle Filter.

Based on this assumption, the probability of likelihoodfunction is expressed as

p(ζ |χ)=

1√2πΣ

(χ)e−

12

(ζ−m(

χ

))T

Σ−1(

χ

)(ζ−m(

χ

))

(21)

ln(

p(ζ |χ))

= ln(

1√2πΣ

(χ))

− 12

(ζ −m

(χ))T

Σ−1(

χ)(

ζ −m(χ))

,

(22)

where

Σ(χ)=

σ2

1 +σ22 σ2

1 . . . σ21

σ21 σ2

1 +σ23 . . . σ2

1...

.... . .

......

σ21 σ2

1 . . . σ21 +σ2

L

.

Substituting Eq. (22) into Eq. (19), we obtain the FI matrixin terms of receiver geometry and measurement covarianceof size 3× 3 for 3-Dimensional (3D). For i, j = 1,2,3, theelements of the FI matrix are represented as:

Jsp,i, j =

(∂m(χ)

∂ χi

)T

Σ−1(

χ)(∂m

(χ)

∂ χ j

)+

12

tr(

Σ−1(

χ)∂Σ

(χ)

∂ χiΣ−1(

χ)∂Σ

(χ)

∂ χ j

),

(23)

where

∂m(χ)

∂ χi=

∂m12(χ)

∂ χi∂m13

(χ)

∂ χi...

∂m1L(χ)

∂ χi

= 2

−~r1,i

r1+~r2,i

r2−~r1,i

r1+~r3,i

r3...

−~r1,i

r1+~rL,i

rL

.

We denote Jsp = Jwdop + JΣ where Jwdop depends on thegeometry of the receiver and JΣ represents the dependency ofthe covariance on the spoofer location.

σ2sp,x =

(Jwdop

)−111 , σ

2sp,y =

(Jwdop

)−122 , σ

2sp,z =

(Jwdop

)−133

esp =√

σ2sp,x +σ2

sp,y +σ2sp,z =WDOP, (24)

where esp is the 3D root-mean-square error in the spooferlocation that is attained for the given configuration of receivergeometry and measurements. σ2

sp,x, σ2sp,y and σ2

sp,z are therespective x, y, z covariances.

In Eq. (23), we define the inverse of the first part (J−1wdop)

as Weighted Dilution Of Precision (WDOP). WDOP char-acterizes the spoofer-receiver geometry. The lower is valueof WDOP, lower is the error (esp) and thereby better is theestimate of our spoofer location.

The second part of Jsp,i, j depicts the influence of the spooferlocation in determining the covariance of measurements es-timated using our LS-MRDTE. Therefore, we estimate thecovariance of the measurements given by Σ

(χ)

i.e., σ2k

(χ)

to obtain a bound on the localization accuracy J−1sp .

Our LS-MRDTE is based on DTE which estimates themaximum likely clock estimates from a pre-generated set ofclock candidates considered. Since MLE is asymptoticallyefficient our measurement covariance of spoofing peak is equalto the inverse of its corresponding FI matrix.

σ2k(cδ tMPk

)=

(N

∑i=1

E

{∂ p(sR,k|µ i

sp)

∂cδ tMPk

(∂ p(sR,k|µ i

sp)

∂cδ tMPk

)T})−1

,

(25)

where µ isp =

[φ i

code, f icode

]sp denotes the code phase and code

frequency of GPS spoofing signal. cδ tMPk denotes the clockcandidate corresponding to the malicious peak of the kth

receiver after detecting and distinguishing the spoofing signals.

For kth receiver, the probability of likelihood∂ p(sR,k|µ i

)∂cδ t

following a Gaussian distribution with covariance (σ2µ i) is

expressed as

p(sR|µ i)= 1√

2πσ2µ i

e−

12σ2

µ i

(Si

R−Y(

µ i))2

(26)

and

∂ p(sR|µ i

)∂cδ t

=

(∂ µ i

∂cδ t

)T∂ p(sR|µ i

)∂ µ i

(27)

In case of spoofing, we write the Eq. (25) as

σ2k(χ)= σ

2k(cδ tMPk

)=

[N

∑i=1

E

{(∂ µ i

sp

∂cδ tMPk

)T∂ p(sR,sp,k|µ i

sp)

∂ µ isp(

∂ p(sR,sp,k|µ i

sp)

∂ µ isp

)T∂ µ i

sp

∂cδ tMPk

}]−1

7

=

[N

∑i=1

(∂ µ i

sp

∂cδ tMPk

)T

E

{∂ p(sR,sp,k|µ i

sp)

∂ µ isp

(∂ p(sR,sp,k|µ i

sp)

∂ µ isp

)T}∂ µ i

sp

∂cδ tMPk

]−1

=

[N

∑i=1

(∂ µ i

sp

∂cδ tMPk

)T

JR,sp,k(µisp)

∂ µ isp

∂cδ tMPk

]−1

,

(28)

where JR,sp,k(µisp) is the FI matrix of µ i

sp corresponding to kth

receiver and is calculated from Eq. (26) and Eq. (27). As seenfrom Eq. (6), this matrix depends on the distance of spooferfrom receiver, SNR and sampling rate.

From Eq. (3) and Eq. (4), we calculate the derivative ofour code phase and carrier frequency with respect to the clockcandidate as:

∂ µ isp

∂cδ tMP=

[−

fC/A

c0

]T(29)

Substituting Eq. (29) in Eq. (28), we obtain the covarianceσ2

k

(χ)

as

σ2k(χ)=

(c

fC/A

)2[ N

∑i=1

[JR,sp

(µ

isp)]

11

]−1

(30)

The above expression for σ2k

(χ)

is substituted in Eq. (23)to obtain the lower bound on the localization accuracy for agiven configuration of multiple receivers. In addition, the valueof J−1

sp can be minimized to compute the optimum locationsfor the placement of multiple receivers. Thus, we providemathematical insights into choosing the parameters related tomulti-receiver setup by analyzing the corresponding CRLB oflocalization accuracy attained.

F. Probability of spoofer detection

Based on Eq. (28), the spoofing peak detected using ourmulti-peak vector correlation follows a Gaussian distributiongiven by

Yk = N

(cδ tMPk ,σ

2k(χ))

(31)

We rewrite Y in terms of Z as

Z =X− cδ tMPk

σk(χ) = N

(0,1)

(32)

Let H0 be the hypothesis that our LS-MRDTE detects spoofingand V0 be the hypothesis that the multi-receiver setup isactually being spoofed. Therefore, we detect the spoofingsignal using multi-peak vector correlation with a probabilitydefined as

P(H0|V0) = P(

Y > Raut(cδ t j,cδ taut,k

)| j=MPk

)= 1−P

(Z ≤

(Raut

(cδ t j,cδ taut,k

)| j=MPk − cδ tMPk

σk(χ) ))

= 1−Φ

(Raut

(cδ t j,cδ taut,k

)| j=MPk − cδ tMPk

σk(χ) )

,

(33)

where Φ is the standard normal distribution.

III. EXPERIMENTAL RESULTS AND ANALYSIS

Our experimental results are divided into two categories:firstly, we compared the improved robustness of MRDTE inestimating the GPS signal parameters as compared to ourprior work on SRDTE [25] and conventional scalar tracking.Secondly, we validated the accuracy of spoofer location androbustness of GPS timing estimated using our LS-MRDTEwhen subjected to spoofing attacks.

We collected our data using four Universal Software RadioPeripherals (USRP-N210) each equipped with a DBSRX2daughterboard as in Fig. 7. They are connected to a commonexternal atomic clock Microsemi Quantum SA.45s CSAC.The collected raw GPS signals are post-processed using ourpyGNSS platform, a python based object oriented framework.

Fig. 7: Our data collection experiments involve 4 USRPs, aCSAC and a laptop for storing data.

The integration time considered for our LS-MRDTE is ∆T =20 ms. In our Kalman Filter, our measurement noise covariancematrix Rt is estimated by computing the covariance of past 20measurement error vector values. The position and velocityof multiple static receivers are pre-determined using Multi-Receiver Vector Tracking [30].

A. Robustness of MRDTE against spoofing

We analyzed the robustness of MRDTE in estimating theGPS code frequency ( f i

code) and carrier frequency ( f icarr) as

compared to scalar tracking during meaconing.

8

1) Experimental setup:For this experimental analysis, we installed four AntCom

3GNSSA4-XT-1 GNSS antennas on the rooftop of TalbotLaboratory (TL), Urbana, Illinois as in Fig. 8. The receiversare arranged such that they represent the corners of a squareof diagonal 10 m.

Fig. 8: Four GPS antennas located on roof of Talbot Labo-ratory, University of Illinois at Urbana-Champaign (UIUC).Reference image is taken from [14].

2) Analysis of signal parameters during meaconing:When meaconing signal of 3 dB higher power than authentic

signals is added, the scalar tracking locks onto the counterfeitsignal as shown in Fig. 9 whereas MRDTE consistently tracksthe authentic signal and mitigates the effect of meaconingattack.

(a) 3 dB added meaconing (b) No meaconing

(c) 3 dB added meaconing (d) No meaconing

Fig. 9: Under 3 dB added meaconing: (a) carrier Dopplerfrequency residual for MRDTE; (b) carrier Doppler frequencyresidual for scalar tracking; (c) code frequency residual forMRDTE; and (d) code frequency for scalar tracking. Scalartracking locks onto the meaconed signal whereas MRDTEtracks the authentic signal.

In accordance with the experimental results shown in Ta-ble. I, MRDTE has a higher threshold to meaconing. In thepresence of meaconing attack, MRDTE offers 0.7 dB highertolerance than SRDTE and 2 dB higher tolerance than thescalar tracking.

TABLE I: Threshold of various GPS algorithms against mea-coning. MRDTE offers higher tolerance than SRDTE andscalar tracking.

Algorithm Meaconing Threshold (in dB)Scalar 1

SRDTE 2.3MRDTE 3

B. Accuracy analysis of our LS-MRDTEIn the second set of experiments, we validated the accuracy

and convergence rate of our LS-MRDTE in computing thelocation of spoofer and GPS time.

Fig. 10: Experimental setup for validating our LS-MRDTEalgorithm. The blue cross corresponds to the known multi-receiver setup and the red cross corresponds to the spooferposition to be determined.

1) Experimental Setup:We installed four AntCom 3GNSSA4-XT-1 GNSS antennas

at each corner on the rooftop of Talbot Laboratory (TL),Urbana, Illinois and the Spoofer is located approximately300 m away on the rooftop of Electrical and ComputerEngineering (ECE), Urbana, Illinois as seen in the Fig. 10.In our Particle Filter, we generate 1000 random particles ofuniform distribution every instant.

2) Fixed vs adaptive clock candidate distribution:To investigate the convergence rate and accuracy of GPS

time estimated using our MRDTE, we analyzed different clockcandidate distributions. Specifically, we compared the fixeduniform distribution in Fig. 11(a) with respect to adaptiveGaussian distribution as seen in Fig. 11(b). Clock candidatesfollowing adaptive Gaussian distribution are generated usingthe predicted covariance values estimated during the timeupdate of Kalman Filter.

In Fig. 12, the clock bias and clock drift residuals arecompared for both above-mentioned candidate distributions.We observed that the clock bias residuals are within 1 µsusing adaptive Gaussian and within 3 µs using fixed uniform

9

distribution. Similarly, in the case of clock drift, the residualscomputed are within 0.5ns/s using adaptive Gaussian andwithin 1.5 ns/s using fixed uniform. Thus, more precisetiming is obtained by implementing an adaptive Gaussian clockcandidate distribution.

(a) X-direction (b) Y-direction

Fig. 11: Clock candidate distributions: (a) fixed uniform distri-bution; (b) adaptive Gaussian distribution for higher accuracy.

(a) Clock bias residuals (b) Clock drift residuals

Fig. 12: Clock residuals for G = 2M grid points: (a) clockbias residuals; (b) clock drift residuals. Red line corresponds tofixed uniform distribution and blue line corresponds to adaptiveGaussian distribution. Adaptive Gaussian distribution showshigher accuracy in the clock residuals as compared to fixeduniform distribution.

3) Timing robustness during data-level spoofing:We performed data-level spoofing attack by transmitting

incorrect ephemeris such that 3D position of all satellites-in-view are shifted 18 km further away from the receiver alongthe LOS vector. Therefore, the intended time error inducedis 60 µs. These malicious signals are transmitted with 2 dBhigher power than the incoming authentic signals to overpowerthem.

(a) Clock bias residuals (b) Clock drift residuals

Fig. 13: Under 2 dB of added data-level spoofing attack:(a) clock bias residuals; (b) clock drift residuals. Red linedepicts scalar tracking whereas blue line depicts our LS-MRDTE. Scalar tracking shows a clock bias residual of 60 µswhereas our LS-MRDTE estimates accurate time.

In Fig. 13, we compared the clock residuals computedusing our LS-MRDTE with that of scalar tracking subjectedto data-level spoofing attack. We observed that the scalartracking tracks the malicious signals and thereby showsa clock bias residual of 60 µs whereas our LS-MRDTEmaintains a clock bias residual of within 1 µs.

4) Spoofer localization and GPS time during meaconing:During meaconing, the position calculated by the effected

receivers is the same as the position of spoofer’s antenna whilerecording the GPS signals. We demonstrated the robustnessof our LS-MRDTE in computing the GPS time and spooferlocation under two different cases of meaconing. Virtual mea-coning attack with 2 dB higher power and which induces adelay of 30 µs is added to the authentic GPS signals collectedusing our multi-receiver setup. This violates the IEEE.C37.118standards, according to which the timing error between PMUsshould not exceed 26.5 µs.

In our first case, the meaconed signals with above specifica-tions are recorded on the rooftop of ECE building and replayedlater in time from the same location.

(a) X-direction (b) Y-direction

Fig. 14: Error in spoofer estimate with time: (a) X-direction;(b) Y-direction; Our LS-MRDTE accurately converges towithin 3 m of the true location of the Spoofer

Fig. 14 demonstrated our LS-MRDTE accuracy in detectingand localizing the spoofer. We observed that our designedParticle Filter converges to 3 m of the true location of thespoofer. In this case, if successfully meaconed, the positioncalculated by the receiver is same as the position of spoofer.Therefore, the spoofer is prone to getting detected by any high-level position check algorithms implemented in the receivers.

In the second case of meaconing which is more stealthy,we recorded GPS signals on the same TL rooftop as ourmulti-receiver setup and later replayed them from the topof ECE building as meaconed signals. By implementing thissophisticated attack, the spoofer surpassed all the positioncheck algorithms with lower probability of being detected.

In Fig. 15, we validated the increased robustness of ourLS-MRDTE as compared to the conventional scalar tracking.Under no meaconing, we observe that both scalar tracking andour LS-MRDTE shows µs time accuracy. Under 2 dB addedmeaconing, the scalar tracking locks to the meaconed signalsand thereby computes an error in the clock residuals of around30 µs which is equivalent to the meaconed delay induced.However, our LS-MRDTE accurately detects these spoofingsignals and estimates the GPS time with 1.5 µs time accuracy.

10

(a) 2 dB added meaconing (b) No meaconing

Fig. 15: Comparison of clock bias residuals: (a) under 2 dB ofadded meaconing that induces a delay of 30µs; (b) under noadded meaconing. The red line corresponds to scalar trackingand blue line corresponds to our LS-MRDTE. Our LS-MRDTEestimates GPS time with 1.5 µs accuracy while the scalartracking shows an error in the clock bias residuals of 30 µsthereby violating IEEE.C37.118 standards.

Fig. 16 shows the time series convergence of our ParticleFilter starting with the initial guess of the spoofer locationto be same as the centroid of our multi-receiver setup. Weobserve that our LS-MRDTE converges to the true location ofthe spoofer in as quick as 0.22 s thereby demonstrating thefast convergence rate of our algorithm.

(a) Time: 0 s (b) Time: 0.02 s (c) Time: 0.04 s

(d) Time: 0.12 s (e) Time: 0.14 s (f) Time: 0.16 s

(g) Time: 0.18 s (h) Time: 0.20 s (i) Time: 0.22 s

Fig. 16: Our LS-MRDTE based Spoofer localization usingParticle Filter: (a),. . . ,(i) show the sequential snapshots of thespoofer location estimated by our Particle Filter. Red crossdenotes the actual location of the spoofer while blue crosscorresponds to the location of our multi-receiver setup. Greenblob depicts the estimate of the spoofer at that time instant. Weobserve that our LS-MRDTE based Particle Filter convergesto within 2.85 m the true spoofer.

IV. CONCLUSIONS

In conclusion, we presented our novel joint estimation ofGPS time and spoofer location for PMUs using MRDTE.We utilized the geometry of spatially distributed receiversand carried out multi-peak vector correlation to detect anddistinguish spoofing attacks. Later, we theoretically estimatedthe CRLB of the localization accuracy achieved for a givenconfiguration of multi-receiver setup. In addition, we alsocomputed the probability of spoofing detection using our LS-MRDTE algorithm.

Our experimental results obtained from joint Particle andKalman Filter validated the localization of spoofer to within3 m and the GPS time to within 1µs accuracy. This iscompliant with the IEEE.C37.118 requirements specified bythe power community. Our LS-MRDTE estimated the spooferlocation in 0.22 s, thereby demonstrating fast convergence ofour algorithm.

ACKNOWLEDGMENT

The authors would like to thank their lab members at theUniversity of Illinois: Arthur Chu, Shubhendra Chauhan andJames Kok for helping with the experimental data collection.

This material is based upon work supported by the Depart-ment of Energy under Award Number DE-OE0000780.

This report was prepared as an account of work sponsoredby an agency of the United States Government. Neither theUnited States Government nor any agency thereof, nor any oftheir employees, makes any warranty, express or implied, orassumes any legal liability or responsibility for the accuracy,completeness, or usefulness of any information, apparatus,product, or process disclosed, or represents that its use wouldnot infringe privately owned rights. Reference herein to anyspecific commercial product, process, or service by tradename, trademark, manufacturer, or otherwise does not neces-sarily constitute or imply its endorsement, recommendation,or favoring by the United States Government or any agencythereof. The views and opinions of authors expressed hereindo not necessarily state or reflect those of the United StatesGovernment or any agency thereof.

REFERENCES

[1] J. Hazra, R.K. Reddi, K. Das, P. Seetharam, “Power Grid TransientStability Prediction Using Wide Area Synchrophasor Measurements”,3rd IEEE PES Innovative Smart Grid Technologies, 2012.

[2] R.O. Burnett, M.M. Butts, P.S. Sterlina, “Power system applicationsfor phasor measurement units”, IEEE Computer Applications in Power,1994.

[3] P. Kundur, N. J. Balu, and M. G. Lauby, “Power system stability andcontrol”, McGraw-hill New York, 1994, vol. 7.

[4] Schweitzer Engineering Laboratories, “Improve Data Analysis byTimeStamping Your Data”, The Synchrophasor Report, May 2009, vol.1, no. 3. Retrieved June 14, 2015 from https://www.selinc.com/issue3/.

[5] “IEEE Standard for Synchrophasors for Power Systems”, IEEE StdC37.118-2005 (Revision of IEEE Std 1344-1995) , vol., no., pp.0 1-57,2006.

11

[6] K.E Martin, D.Hamai, M.G Adamiak, S. Anderson, M. Begovic, G.Benmouyal, G. Brunello, J. Burger, J. Y. Cai, B. Dickerson, V. Ghapure,B. Kennedy, D. Karlsson, A.G. Phadke, J. Salj, V. Skendizic, J. Sperr,Y. Song, C. Huntley, B. Kastenny and E. Price, “Exploring the IEEEStandard C37.118-2005 Synchrophasors for Power Systems”, IEEETrans. on Power Del.,Vol. 23, no. 4, pp 1805-1811, Oct, 2008.

[7] M. Lixia, C. Muscas, and S. Sulis, “On the accuracy specificationsof phasor measurement units”, in Proc. IEEE I2MTC, May 2010, pp.14351440.

[8] GPS Wing, Interface Specification IS-GPS-200E, Jun. 2010.[9] J. Warburton and C. Tedeschi, “GPS Privacy Jammers and RFI at

Newark: Navigation Team AJP-Results”, in 12th International GBASWorking Group Meeting (I-GWG-12), Atlantic City, New Jersey, 2011.

[10] M. G. Amin, L. Zhao, A. R. Lindsey, “Subspace array processing forthe suppression of FM jamming in GPS receivers”, IEEE Transactionson Aerospace and Electronic Systems. 2004 Jan;40(1):80-92.

[11] J. S. Warner and R. G. Johnston, “A simple demonstration that theGlobal Positioning System (GPS) is vulnerable to spoofing”, Journal ofSecurity Administration, vol. 25, no. 2, pp. 19-27, 2002.

[12] N. White, P. Maybeck, S. De Vilbiss, “Detection of interfer-ence/jamming and spoofing in a DGPS-aided inertial system”, IEEETransactions on Aerospace and Electronic Systems, vol. 34, no. 4, pp.1208-1217, 1998.

[13] L. Heng, J. Makela, A. Dominguez-Garcia, R. Bobba, W. Sanders, andG. X. Gao, “Reliable GPS-based Timing for Power System Applica-tions: A Multi-Layered Multi-Receiver Approach”, in Proceedings ofthe 2014 IEEE Power and Energy Conference at Illinois (IEEE PECI2014), Champaign, IL, Feb 2014.

[14] D. Chou, Y. Ng, and G. X. Gao, “Robust GPS-Based Timing for PMUsBased on Multi-Receiver Position-Information-Aided Vector Tracking”,ION International Technical Meeting 2015, Dana Point, California,January 2015.

[15] T. E. Humphreys, B. M. Ledvina, M. L. Psiaki, B. W. OHanlon, P. M.Kintner Jr, “Assessing the spoofing threat: Development of a portableGPS civilian spoofer”, In Proceedings of the ION GNSS internationaltechnical meeting of the satellite division 2008 Sep 16 (Vol. 55, p. 56).

[16] N. O. Tippenhauer, C. Ppper, K.B. Rasmussen, S. Capkun, “On therequirements for successful GPS spoofing attacks”, In Proceedings ofthe ACM Conference on Computer and Communications Security (pp.7586), 2011, Chicago, IL. Association for Computing Machinery.

[17] J. Bhatti, T. Humphreys, “Hostile control of ships via false GPS signals:Demonstration and detection”, Navigation, 2016.

[18] D. P. Shepard and T. E. Humphreys, “Evaluation of the Vulnerability ofPhasor Measurement Units to GPS Spoofing Attacks”, in InternationalJournal of Critical Infrastructure Protection, 5(3-4), 146153.

[19] L. Heng, J. J. Makela, A. D. Dominguez-Garcia, R. B. Bobba, W.H. Sanders, and G. X. Gao, ”Reliable GPS-based timing for powersystems: A multi-layered multi-receiver architecture”, in Power andEnergy Conference at Illinois (PECI), 2014. IEEE, 2014, pp. 1-7.

[20] P. F. Swaszek, R. J. Hartnett, M. V. Kempe and G. W. Johnson,“Analysis of a simple, multiple receiver GPS spoof detector”, inproceedings of ION NTM, San Diego, CA, Jan. 2013.

[21] K. Jansen , N. O. Tippenhauer , C. Ppper, “Multi-receiver GPS spoofingdetection: error models and realization”, Proceedings of the 32ndAnnual Conference on Computer Security Applications, December 05-08, 2016, Los Angeles, California

[22] P. Y. Montgomery, T. E. Humphreys, and B. M. Ledvina, “Receiver-autonomous spoofing detection: experimental results of a multi-antennareceiver defense against a portable civil GPS spoofer”, in Proceedingsof the Institute of NavigationInternational Technical Meeting (ITM ’09),pp. 124130, Anaheim, Calif, USA, January 2009.

[23] D. Yu et al., “Short paper: detection of GPS spoofing attacks in powergrids”, Proceedings of the 2014 ACM conference on Security andprivacy in wireless and mobile networks, 2014.

[24] A. Ranganathan, H. lafsdttir, S. Capkun, “SPREE: a spoofing resistant

GPS receiver”, Proceedings of the 22nd Annual International Confer-ence on Mobile Computing and Networking, Oct, 2016, New York City,New York.

[25] Y. Ng and G. X. Gao, “Robust GPS-Based Direct Time Estimation forPMUs”, in Proceedings of the IEEE/ION PLANS conference, Savannah,2016.

[26] S. Bhamidipati, Y. Ng and G. X. Gao, “Multi-Receiver GPS-basedDirect Time Estimation for PMUs”, in Proceedings of the ION GNSS+conference, Portland, 2016.

[27] D. Chou, L. Heng, and G. X. Gao, “Robust GPS-Based Timingfor Phasor Measurement Units: A Position-Information-Aided VectorTracking Approach, in Proceedings of the ION GNSS+ conference,Tampa, 2014.

[28] S. Bhamidipati and G. X. Gao, “GPS Spoofer Localization for PMUsusing Multi-Receiver Direct Time Estimation”, In Proceedings of theInstitute of Navigation GNSS+ conference (ION GNSS+ 2017), Port-land OR, Sep 2017.

[29] L. Heng and G. X. Gao, “Accuracy of Range-Based Cooperative Posi-tioning: A Lower Bound Analysis”, IEEE Transactions on Aerospaceand Electronic Systems. vol. 53, no. 5, pp. 2304-2316, Oct 2017.

[30] Y. Ng and G. X. Gao, “GNSS Multi-Receiver Vector Tracking”, IEEETransactions on Aerospace and Electronic Systems. vol. PP, no.99, doi:10.1109/TAES.2017.2705338, May 2017.

Sriramya Bhamidipati is a graduate student underProf. Grace Gao in the Department of AerospaceEngineering at the University of Illinois at Urbana-Champaign. She received her M.S degree inAerospace Engineering from University of Illinoisat Urbana-Champaign in 2017. She received herB.Tech. with honors in Aerospace Engineering andminor in Systems and Controls Engineering fromIndian Institute of Technology Bombay, India in2015. Her research interests include GPS, power andcontrol systems, computer vision and UAVs.

Grace Xingxin Gao received the B.S. degree inmechanical engineering and the M.S. degree in elec-trical engineering from Tsinghua University, Bei-jing, China in 2001 and 2003. She received thePhD degree in electrical engineering from StanfordUniversity in 2008. From 2008 to 2012, she was aresearch associate at Stanford University. Since 2012,she has been with University of Illinois at Urbana-Champaign, where she is presently an assistant pro-fessor in the Aerospace Engineering Department.

12