# GNSS Spoofing Detection and Mitigation Based on Maximum Likelihood Estimation
## 6 Performance Evaluation with TEXBAT  
The Texas Spoofing Test Battery (TEXBAT) is a set of digital recordings of GPS L1 C/A spoofing tests. It is provided by the Radio Navigation Laboratory (RNL) at the University of Texas at Austin for evaluating civil GPS spoofing countermeasures [30]. The TEXBAT consists of eight data recordings representing different types of GNSS spoofing attacks at the time of writing. In the paper, Datasets 2 to 7 (ds2 to ds7) are employed to evaluate the proposed anti-spoofing method. They represent \"static overpowered time push\", \"static matched-power time push\", \"static matched-power position push\", \"dynamic overpowered time push\", \"dynamic matched-power time push\" and \"seamless static matched-power time push\", respectively. The lengths of ds2 to ds6 are 400 s, and the length of ds7 is 465 s.  
Ds1 is a \"static switch\" spoofing attack, which removes all of the authentic signals when spoofing signals appear. It cannot be detected by the MLE-based method since authentic and spoofing signals do not exist simultaneously. ds8 represents a security code estimation and replay (SCER) attack, which is identical to ds7, except that the spoofer guesses and generates the navigation data bits in real time. Since our method does not employ the security codes to detect a spoofing attack, ds8 is also not considered in the paper. The Doppler measurements from a conventional receiver are employed in the experiment; therefore, the velocity does not need to be searched, and the search space is \(\{x,y,z,t_{u}\}\). The center of the search space is set to the user position and clock offset results obtained from the conventional receiver. The search range of each dimension and the search step length of the two MLE position modules in Figure 4 are given in Table 2. Shorter search step improves the accuracy of the recovered PVT results. However, it also leads to a higher computational burden. Consequently, a trade-off needs to be made in practical applications. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Num** & **Range (m)** & **Step (m)** \\ \hline
1 & \(-50\sim 50\) & 2 \\
2 & \(-750\sim 750\) & 50 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Search range and step of the MLE-based positioning modules. Figure 8: Detection probabilities versus code phase difference between spoofing and authentic signals for different numbers of satellites. \(C/N_{0}\) of authentic and spoofing signals are 45 dB-Hz and 50 dB-Hz, respectively. Table 3 shows the spoofing detection and validation performance in Scenarios 2 to 7 of TEXBAT. \(M\) denotes the number of the processed signals. Here, the detection performance is measured by the spoofing detection percentage (\(SDP_{i}\)), which is defined as the ratio between the data length of successful detections when \(i\) signals are processed (\(L_{i}\)) and the data length under spoofing attack (\(L_{S}\)). The validation performance is measured by the spoofing validation percentage (\(SVP\)), which is defined as the ratio between the data length of successful validations (\(L_{V}\)) and \(L_{S}\). The improvement of multi-signal processing is also given in Table 3, which is defined as \(Imp=SDP_{M}-SDP_{1}\). The anti-spoofing module is called every second. Therefore, 400 \(T(\mathbf{y})\) are calculated in each dataset of ds2 to ds6, and 465 \(T(\mathbf{y})\) are calculated in ds7. \(L_{S}\) is about 290 in each dataset of ds2 to ds6 and 315 in ds7. Table 3 demonstrates that in all of the scenarios, spoofing attacks can be detected. The detection performance is better when more signals are processed in each scenario. Table 3 also shows that the spoofing detection percentages are lower in ds4 and ds6, which mislead the positioning results of the victim receiver. The reason is that the code phase differences induced by the spoofing signals are smaller in these two scenarios. In addition, two groups of consistent signals are found in all of the scenarios. Thus, the detected evil signals can be judged as spoofing ones.