## 2 Literature Review
The random motion between the transmitted and received GPS signals differs from the live sky-generated Doppler patterns that are used to find the presence of abnormal behaviour in the Doppler frequency or malicious attackers to analyze the spoofing threats in GNSSs. In another study [26], a training dataset obtained from the daily live record data uploaded by NASA was used to train the LSTM models for spoofing detection. The architecture implemented consisted of two LSTM layers with 32 neurons, with one dropout layer and one dense layer, for predicting the spoofing attacks. The Doppler shift detected from the post-processing of the GPS signal is used for training. The hybrid learning framework of GNSS observations using anomaly detection via the hierarchical density-based spatial clustering of applications with noise (HDBSCAN) technique has been used by [PERSON] et al. [27]. The ComNav K508 GNSS OEM receiver was used to log the Receiver INdependent EXchange (RINEX) data that are used for training purposes, and the NovAtel ProPak6 receiver was used to collect the test set for real-time anomaly detection. Anomaly detection in the transponder frequency spectra of satellite communications systems with high-dimensional time series data using LSTM networks is implemented by [PERSON] et al. [28]; this provides a lower reconstruction error, but the time-frequency approach for collecting the images for each snapshot increases the data handling and the data storage complexity. A machine learning-based identification of the clean, non-line of sight (NLOS), and multipath signals in a GNSS is presented in [29]. The variations in the received power level, the pseudorange residue, and changes in the variance between the pseudorange and delta pseudorange obtained from the National Electrical Manufacturers Association (NEMA) and RINEX are used to train the machine learning algorithm. To handle the time synchronization attacks, a three-layer multi-layer perceptron neural network was implemented in [30] to nullify jamming in stationary GPS receivers. The authors prepared the clock offset dataset of 200 samples used as an input to the model for training, with different threshold conditions that lead to spoofing detection and positioning error reduction. Spoofing detection in GNSS signals with the aid of the LSTM prediction model has been implemented by [PERSON] et al. [31] using a publicly available real-world driving dataset. The data captured from the controlled area network (CAN), GNSS, and IMU sensors with different parameters such as acceleration, steering wheel angle, speed, and distance are used to detect spoofing attacks in autonomous vehicles. To the best of our knowledge, most of the methods listed above used either traditional statistical methods [32; 33] or spectrogram images, post-processed data, correlation outputs, and data collected at the navigation level to train an ML/DL model to identify possible trends in the signal quality and abnormalities in GNSS data. However, there is still a need to determine the reason behind these changes in the signal behaviour, and the cause of abnormalities detected at the RF signal level has to be identified before the signal is fed into the receiver signal processing chain. Nevertheless, the aforementioned literature studies used several ML/DL models and collected the most influential features by suitably classifying or predicting the anomalous GNSS signals with proper justification. However, their AI models failed to provide the reasons behind the classification/prediction and how the classification decisions were made. Also, it is hard to know on what basis the AI model is functioning and what aspects the model uses to determine the result. Because of the lack of transparency and trustworthiness of these AI models, they are called black-box models, and therefore, it is necessary to know the causes and effects of signal disruption or what would happen if the signal attributes changed. To solve this problem, XAI methods are used.