# Detecting and Mitigating Attacks on GPS Devices
## 5 Detection Techniques and Their Comparison
### GPS Spoofing Detection
The primary drawback to these approaches is the need for multiple antennas, which may not be practical for small systems. Other researchers proposed using approaches based on tracking the UAS movement history for GPS spoofing detection. For example, the authors of [92] proposed a multi-sensor approach that combined the onboard IMU sensor with vision methods using a monocular camera onboard the UAS. The proposed approach would use the camera's video stream and IMU sensor to calculate a velocity vector for the UAS. The video feed would be used to estimate platform velocity, and that information would be used to reset IMU error accumulation. Simultaneously, a velocity vector would be calculated based on GPS alone. Those two velocity vectors would be compared, and spoofing would be declared if they were sufficiently different. This approach was implemented on a DJI Phantom 4 UAS and could be detected within an average of five seconds. The authors of [93] also proposed using IMU sensors to detect GPS spoofing attacks. This approach was implemented by integrating an IMU/GNSS into a Kalman filter that monitors anomalies. Several papers exist in the literature that analyze various aspects of signal statistics, of both the authentic signal and the spoofed signal, in detecting the presence of a spoofing threat. As an example, the authors of [94] considered the use of Doppler frequency and carrier-to-noise (C/N) density ratio as the primary metrics to discern a spoofed signal from an authentic signal. The authors then used numerous types of ML and analytical models to analyze performance utilizing these metrics, including SVM, KNN, RF, Gradient Boosting Decision Tree (GBDT), DT, and XGBoost. The authors of [94] reported accurate spoofing detection rates of 84.88-95.56%, with KNN providing the best results in terms of accuracy for their datasets. SVM provided nearly as good accuracy, with slightly better true positive rate (TPR) performance. Many other existing approaches do not cleanly fit into a taxonomy. The authors of [95] proposed an approach to GPS spoofing detection that treats GPS spoofing detection as an outlier detection problem, analyzing the time-series history of the position estimates and identifying outlier values through the Grubbs outlier test. Any outlier is a spoofed position estimation in this approach. The authors of [96] also treated GPS spoofing as an outlier problem. They implemented a navigation filter based on a constant velocity model. This model employed a 3D Kalman filter to identify and remove outlier values, which were presumed to be spoofed locations. The authors of [97] also viewed GPS spoofing detection (in part) as an outlier detection problem, employing a Kullback-Leibler divergence measure to search for anomalies in data. The authors coupled this anomaly detection approach with an entropy-based method for spoofing detection. The outstanding question regarding outlier removal approaches is how they would work in dynamic mobile scenarios that do not have a constant velocity model or where signal fading causes rapid signal power fluctuations, both actual and spoofed GPS signals. Other proposed approaches utilize ADS-B broadcasts from aircraft and UASs to detect GPS spoofing attacks. Ground sensors monitor ADS-B broadcasts while geolocating the corresponding aircraft. It is assumed that the aircraft is a victim of GPS spoofing if the ADS-B broadcast reflects a different position than its actual position. The authors of [98] claimed that this approach can globally detect GPS spoofing attacks in under two minutes, and they can localize the attacker with an accuracy of 150 m within 15 min of monitoring time. The authors of [99] claimed an average detection accuracy and precision of 81.7%and 85.3%, respectively, based on real-world air traffic control (ATC) data crowdsourced by the OpenSky Network. A potential limitation of these approaches is that, like GPS, ADS-B broadcasts are unauthenticated and can be spoofed.