# GNSS Spoofing Detection and Mitigation Based on Maximum Likelihood Estimation
## 4 MLE-Based GNSS Anti-Spoofing Method
### Estimation-Cancellation Approach  
After obtaining the ML estimate of \(\mathbf{\rho}\), which is denoted as \(\hat{\mathbf{\rho}}_{1}\), the composite signal can be reconstructed as follows:  
\[\mathbf{\hat{x}}=\mathbf{G}(\hat{\mathbf{\rho}}_{1})\mathbf{\hat{a}}_{1}=\mathbf{G}(\hat{\mathbf{\rho }}_{1})[\mathbf{G}(\hat{\mathbf{\rho}}_{1})^{H}\mathbf{G}(\hat{\mathbf{\rho}}_{1})]^{-1}\mathbf{G} (\hat{\mathbf{\rho}}_{1})^{H}\mathbf{x} \tag{12}\]  
Figure 1: MLE cost function in a scenario with eight authentic signals and eight spoofing ones. Then, we subtract the reconstructed signal from the original signal. The residual signal plus noise is given by:  
\[\mathbf{y}=\mathbf{x}-\hat{\mathbf{x}} \tag{13}\]  
When there is no spoofing signal, \(\hat{\mathbf{\rho}_{1}}\) is equal to \(\mathbf{\rho}_{a}\), and \(\hat{\mathbf{x}}\) is the estimation of the sum of the authentic signals. Thus, \(\mathbf{y}\) mainly consists of noise. When spoofing signals are present, \(\mathbf{y}\) will consist of residual signals and noise because \(\mathbf{\rho}_{s}\) is different from \(\mathbf{\rho}_{a}\). Based on the above analysis, \(\mathbf{y}\) can be expressed as follows:  
\[ \begin{split}&\mathcal{H}_{0}:\mathbf{y}=\mathbf{w}\\ &\mathcal{H}_{1}:\mathbf{y}=\mathbf{G}(\mathbf{\rho}_{s})\mathbf{a}_{s}+\mathbf{G}( \mathbf{\rho}_{a})\mathbf{a}_{a}-\mathbf{G}(\hat{\mathbf{\rho}_{1}})\hat{\mathbf{a}}_{1}+\mathbf{w} \end{split}  \tag{14}\]  
where \(\mathcal{H}_{0}\) denotes that spoofing signals are absent and \(\mathcal{H}_{1}\) denotes that spoofing signals are present. A spoofing attack can be detected by detecting signal components in \(\mathbf{y}\), and we call it the estimation-cancellation approach. The alternative hypothesis \(\mathcal{H}_{1}\) consists of three cases, which are illustrated in Figure 2. Figure 2 is an abstract expression of the PVT domain. Spoofing and authentic signal components form peaks at different positions of the domain. Figure 1 shows that the spoofing and authentic signal components are distributed around \(\mathbf{\rho}_{s}\) and \(\mathbf{\rho}_{a}\), and the corresponding PVT domains are represented with circles centered at \(\mathbf{\rho}_{s}\) and \(\mathbf{\rho}_{a}\) in Figure 2, respectively. The highest peak of the MLE cost function at \(\hat{\mathbf{\rho}_{1}}\) is superimposed by the signal components in the area emphasized by dashed lines. Figure 2a represents the first case. The total power of the spoofing signals is higher than that of the authentic ones. Therefore, the MLE cost function is maximized at \(\mathbf{\rho}_{s}\) and the residual signal \(\mathbf{y}\) mainly consists of authentic signals and noise. The spoofing scenario shown in Figure 1 is a good illustration for this case. It should be noted that when the designated falsified PVT parameter \(\mathbf{\rho}_{s}\) is close to \(\mathbf{\rho}_{a}\), parts of authentic signals will also contribute to the peak, which corresponds to the overlapped part of the circles in Figure 2a. Figure 2b represents the second case, which is opposite the first case. It happens when the total power of the spoofing signals is lower than that of the authentic ones. Consequently, the MLE cost function is maximized at \(\mathbf{\rho}_{a}\), and the residual signal \(\mathbf{y}\) mainly consists of spoofing signals and noise. In this case, the authentic PVT results can be obtained with the MLE-based positioning method directly. In particular, when \(\mathbf{\rho}_{s}\) is far away from \(\mathbf{\rho}_{a}\), the two circles representing spoofing and authentic signal components will be separate in Figure 2a,b. Figure 2c represents the third case. \(\hat{\mathbf{\rho}_{1}}\) is different from both \(\mathbf{\rho}_{s}\) and \(\mathbf{\rho}_{a}\). Thus, the residual signal consists of residual authentic signals, spoofing signals and noise. Figure 2: Three different cases when spoofing signals are present. The circles represent the PVT domains in which spoofing signals or authentic signals are present.