Guardian Satellite X

Guardian Satellite X is a web platform for monitoring the integrity of satellite navigation signals. It takes GNSS receiver readings and RF spectrograms, sends each one to a dedicated classifier (an XGBoost model for spoofing, a ResNet18 network for jamming), stores the verdict with its source, confidence and severity, and gives security analysts one workspace to watch, investigate and report.

GPS spoofing and RF jamming rarely announce themselves: a forged signal can look like an ordinary position fix, and interference only shows up as a pattern in the spectrum. An operator needs to know which receiver is affected, what kind of attack it is and how confident the system is, then keep a record that survives the shift handover. Both detection models were trained outside the product, in notebooks; they had to become a dependable, permissioned tool that people could actually operate.

Treat the two threats as two analysis paths that end in one record. Spoofing and jamming keep their own models, inputs and severity scales, but every result is written to the same detection table, so the overview, analytics, alerts and history all read from a single source of truth.

The watchfloor overview maps registered receivers into the detection pipeline and brings the latest flagged reading forward. Signal Analysis plots detection confidence across recent scans against a 50% threat threshold, with a breakdown by class. The GNSS scan accepts a single 13-feature reading or a CSV or Excel file of up to 200 rows; the RF scan accepts a spectrogram image. When a new result is an attack, a red alert opens with its source, severity and confidence, and an audible alarm sounds until it is acknowledged or times out. History & Reports keeps the full ledger with search, date filters and CSV or PDF export.

The console follows a control-room watchfloor language: monospaced data labels, a restrained slate palette and colour reserved for meaning, with teal for clear signals and amber to coral for rising severity. A low-glare Night shift theme and a high-ambient Day shift theme are both complete, and the navigation and receiver topology adapt down to small screens.

The spoofing service is a FastAPI wrapper around an XGBoost model that scores 13 GNSS observables (satellite PRN, Doppler, pseudorange, carrier phase, correlator outputs, C/N0 and more) as normal, simplistic, intermediate or sophisticated spoofing. The jamming service loads a ResNet18 in PyTorch, normalises the spectrogram exactly as in training and returns one of six classes: no jamming, narrowband, DME, single-tone AM, single-tone FM or chirp. A Python bridge reads UBX-RXM-RAWX measurements from a u-blox receiver on a Raspberry Pi and posts one feature vector per satellite to the ingest API; correlator values a stock receiver cannot provide are sent as explicit placeholders and documented as a limit on accuracy.

A Next.js 16 application serves the public site, the console and its API routes, with Prisma mapping a MariaDB schema of data sources, satellite results, detections, reports and administrators. The two Python inference services run independently on their own ports and are called server-side, so the browser never talks to a model directly. Sessions are signed JWTs in HTTP-only cookies, checked by the Next.js proxy on every API call; inputs are validated with Zod, login attempts are rate-limited, and only the first account can self-register, as System Administrator.

GNSS spoofing detection (4 classes), RF jamming detection (6 classes), single-reading and CSV or Excel batch analysis with PDF export, live red-alert alarm, receiver network topology and source dossiers, confidence timeline and class breakdown, searchable history with date filters and CSV or PDF export, three roles (System Administrator, Security Analyst, Monitor), notification preferences, a Raspberry Pi and u-blox ingest bridge, Night shift and Day shift themes.

The screenshots come from the running local build against a seeded receiver network: station names, readings and detections are mock data generated for demonstration, and the red alert is a test injection from the console's own simulator. The GNSS scan and batch results shown are live model outputs on sample readings. No detection accuracy, field deployment or operational outcome is claimed.