# Blind Spoofing GNSS Constellation Detection Using a Multi-Antenna Snapshot Receiver +
## 1 Introduction  
Spoofing, the transmission of false signals to manipulate a receiver, is a significant threat to the security, reliability, and integrity of the global navigation satellite system (GNSS) users [1; 2]. A spoofer aims to manipulate the position, velocity, and time (PVT) solution of the receiver and is consequently associated with criminal, terrorism, and military activities. Transmitting, and by extension spoofing, in unallocated radio frequency (RF) spectrum, or transmitting without permission is illegal, according to international spectral policies and agreements [3; 4]. However, this does not deter spoofing attacks [5]. There are many anti-spoofing methods and schemes to detect spoofing [2; 6; 7; 8]; however, many of these fail when a spoofing attack is more sophisticated (e.g., a synchronized attack) or cooperative (i.e., the owner of the receiver assists with the attack) [9]. A transmitter in a spoofing attack is usually terrestrial [5]. Therefore, the spatial distribution over the open-sky of real GNSS signals is not emulated. Consequently, spatial detection methods have proven a continued success, independent of the spoofing method used [10; 11]. Spatial detection methods require either the utilization of an array of antennas or a highly directional antenna [12]. Most commonly, an array of antennas that is time and frequency-synchronized is required, such that detection methods, like direction-of-arrival (DOA) estimation, can be applied. This article applies array-based spoofing detection methods to server-based GNSS processing methods. Server-based GNSS processing allows for the remote evaluation of GNSS signals, basedon a signal recording (i.e., baseband samples) made by a receiver [13]. As the processing is done remotely, it is also referred to as cloud GNSS [14], or snapshot processing, as a small snapshot of baseband or intermediate frequency data is sent from the receiver to the server for processing [15; 16]. In turn, the server computes the PVT solution of the snapshot. One aim of this technique is to remove the processing burden from the receiver and to transfer it to the server. Server-based processing can be applied to low-power devices [17; 18], which cannot afford a full GNSS receiver for positioning. This saves on power and weight requirements for the receiver as well as the associated system. Hence, it is often used for low size, weight and power (SWAP) devices. Applications such as remote sensing and animal tracking can benefit from this technique [19]. Mobile devices can also profit from this approach [13]. Another application for server-based processing is the verification of a receiver's position using encrypted GNSS signals [20; 21]. Inexpensive receivers typically do not have the required security module to allow cryptographically protected GNSS signals to be used on-board, but a server containing this security module can outsource the capability without exposing sensitive information. A snapshot of data may be sent to this server for authentication. Snapshot receivers have a limited window of data. Therefore, many popular temporal spoofing detection methods are not applicable [9]. This further emphasizes the need for spatial detection methods for snapshot-based receivers. This article presents multiple spoofing detection methods using an antenna array in conjunction with a snapshot receiver. It extends on the previous snapshot-based blind spoofing detection methods [22], by considering a system of detectors to improve the overall detector performance. An exploratory approach is used with empirical analysis, to identify suitable detection metrics. The snapshot concept aims to transfer the processing load to the server and to maintain receiver complexity and requirements as low as possible. Therefore, the benefits of array processing can be applied to SWAP devices. The drawback of using multiple antennas is that it requires synchronized receiver channels. This increases the system complexity and cost which makes this technique counter-productive for low SWAP devices.