# On the Use of a Feedback Tracking Architecture for Satellite Navigation Spoofing Detection
## 4 Using ECADLL Information for Spoofing Detection
### Classification as Spoofer Presence
#### 4.2.2 Detection by Using the Physical Laws of Propagation  
One of the main differences between the spoofing signal and the multipath signal is that the latter is bounded by the physical laws of propagation. Due to these physical limitations, it is not possible for the multipath signal to increase its relative delay \(\hat{\tau}_{1}\), while maintaining the same amplitude \(\hat{a}_{1}\). This is due to the fact that, in order to have a longer delay, the satellite signal needs to travel a longer physical path, and as a result, its power level will decrease. This consideration means that a single multipath signal will always have a smaller amplitude when the delay is larger. These bounds do not apply to spoofing signals. This remark is also valid the other way around, where a closer delay is bounded to have a greater amplitude.  
A spoofing attack may be able to replicate the signal propagation behavior of the signal when it attempts to align the spoofing signal with the satellite one. Nevertheless, when the spoofing signal takes control of the receiver and the push-off phase starts, the satellite signal will be present in the correlation domain, and it will be bound to the physical laws. The satellite signal in the correlation domain will have the same amplitude regardless of the relative delay to the spoofer.  
This can be defined for time \(t_{k}\) and the i-th channel if:  
\[\text{if }\tau_{1}(t_{k})-\tau_{1}(t_{k}-dt) >\alpha\tau_{1}(t_{k}) \tag{11}\] \[\text{and }a_{1}(t_{k})-a_{1}(t_{k}-dt) <\beta a_{1}(t_{k}) \tag{12}\]  
where \(dt\) is the time difference between the two measures. Coefficients \(\alpha\) and \(\beta\) are smaller than one and are defined using the expected propagation law. When the conditions (11) are met, the decision for spoofing attack is made, i.e., \(D_{i}(t_{k})=2\). In our case, we assumed a conservative linear decay, so both \(\alpha\) and \(\beta\) are defined as 10%, meaning that a 10% increment in delay will require at least a 10% decay of the amplitude in order to not declare it as a spoofer. Once a channel is declared as being spoofed, it will maintain its status as long as the DLL in Unit1 is locked. It is important to mention that these statements hold as long as the units are tracking continuously the signal between times \(t_{k}-dt\) and \(t_{k}\). If for any reason the Unit1 loses track of the signal, then the check is not valid anymore.  
In Figure 6, all of the different regions of the decision are graphically shown. Taking into consideration these behaviors, we can distinguish between generic impairments and spoofing attacks. It is important to notice that these remarks are assuming the spoofer will behave in a specific way,so if the spoofer does not follow these criteria, the receiver will be only able to label it as a generic impairment and not a spoofing attack. Nonetheless, the assumptions presented above are common during spoofing attacks, and in the cases where the spoofer is more harmful, it will likely fall into one of the defined regions.