Integrity-Aware Hierarchical Navigation for UAVs Under GNSS Spoofing and Multi-Sensor Degradation

Global navigation satellite system (GNSS) navigation-measurement spoofing is a critical threat to autonomous unmanned aerial vehicles (UAVs) because deceptive measurements may remain numerically plausible while progressively corrupting the navigation state. This paper presents an integrity-aware hierarchical navigation framework designed to maintain mission continuity under GNSS spoofing and subsequent degradation of the LiDAR–inertial fallback. During nominal operation, GNSS is cross-validated against an independent LiDAR–IMU error-state Kalman filter solution using normalized innovation squared (NIS), persistence logic, and cumulative change evidence. Suspect GNSS measurements are quarantined, after which LiDAR–inertial navigation maintains local continuity while a secondary integrity monitor evaluates innovation consistency, estimator uncertainty, feature quality, and inertial plausibility. If the fallback loses integrity, the UAV transitions to a map-referenced visual recovery layer that combines altitude-constrained Google Earth tile selection, deep cross-view retrieval, geometric verification, and visual SLAM. The experiments used controlled navigation-measurement spoofing introduced in the ROS 2 navigation path rather than radiated RF spoofing. In the replay-based detector analysis, the complete detector achieved an AUC of 0.984, a detection probability of 0.963, and a mean gradual-attack detection latency of 2.25 s (standard deviation 0.68 s). These descriptive results were obtained from repeated replay instances derived from 20 source missions. Under sequential GNSS and LiDAR–inertial degradation, the proposed integrity manager achieves 95% recovery success in the evaluated campaign, reduces the full sequential-mission 95th-percentile horizontal position error from 5.31 m to 2.31 m relative to hard switching, and obtains an accepted visual fix in 1.92 s (standard deviation 0.67 s). End-to-end horizontal localization RMSE is 1.39 m, while bounded state reconciliation reduces the peak commanded-state jump by 89.1% and post-recovery cross-track RMSE by 71.4%. These results support explicit integrity monitoring and controlled transitions between navigation sources under sequential sensor degradation.