# GNSS Spoofing Detection and Mitigation Based on Maximum Likelihood Estimation
## 4 MLE-Based GNSS Anti-Spoofing Method
### Estimation-Cancellation Approach
Therefore, \(T(\mathbf{y})\) follows central \(\chi^{2}\) distribution under \(\mathcal{H}_{0}\) and non-central \(\chi^{2}\) distribution under \(\mathcal{H}_{1}\). \[T(\mathbf{y})\sim\left\{ \begin{aligned} \chi^{2}_{2M},\,\,\text{ under}\,\,\mathcal{H}_{0}\\ \chi^{2}_{2M}(\lambda),\,\,\text{ under}\,\,\mathcal{H}_{1}\end{aligned} \right. \tag{19}\]The non-central parameter is given by [25]:  
\[\lambda=\frac{\mathbf{a}^{H}\mathbf{G}(\mathbf{\rho}_{2})^{H}\mathbf{G}(\mathbf{\rho}_{2})\mathbf{a}}{ \sigma^{2}/2} \tag{20}\]  
Thus, the false alarm and detection probabilities are given by [27]:  
\[P_{fa}(\gamma,M)=\exp\{-\frac{\gamma}{2}\}\sum_{i=0}^{M-1}\frac{1}{i!}(\frac{ \gamma}{2})^{i} \tag{21}\]  
\[P_{d}(\gamma,M)=Q_{M}(\sqrt{\lambda},\sqrt{\gamma}) \tag{22}\]  
where \(\gamma\) is the threshold which can be determined by \(P_{fa}\). \(Q_{M}(a,b)\) is the generalized Marcum Q-function [28]. Further, by using the properties of cross-correlation of different satellites' pseudorange codes, we have [29]:  
\[\mathbf{G}(\hat{\mathbf{\rho}}_{2})^{H}\mathbf{G}(\hat{\mathbf{\rho}}_{2})\approx K\mathbf{I}_{M \times M} \tag{23}\]  
Substituting Equation (23) to Equations (18) and (20), we have:  
\[ \begin{split} T(\mathbf{y})&=\frac{\mathbf{y}^{H}\mathbf{G}( \hat{\mathbf{\rho}}_{2})[\mathbf{G}(\hat{\mathbf{\rho}}_{2})^{H}\mathbf{G}(\hat{\mathbf{\rho}}_{2} )]^{-1}\mathbf{G}(\hat{\mathbf{\rho}}_{2})^{H}\mathbf{y}}{\sigma_{0}^{2}/2}\\ &\approx\frac{\frac{1}{K}\mathbf{y}^{H}\mathbf{G}(\hat{\mathbf{\rho}}_{2}) \mathbf{G}(\hat{\mathbf{\rho}}_{2})^{H}\mathbf{y}}{\sigma_{0}^{2}/2}\\ &=\frac{2}{K\sigma_{0}^{2}}\sum_{i=1}^{M}||\mathbf{g}_{i}(\hat{\mathbf{ \rho}}_{2})^{H}\mathbf{y}||^{2}\end{split}  \tag{24}\]  
\[\lambda\approx K\sum_{i=1}^{M}\frac{a_{i}^{2}}{\sigma^{2}/2}=2 KT_{s}\sum_{i=1 }^{M}(C/N_{0})_{i} \tag{25}\]  
where \((C/N_{0})_{i}\) denotes the carrier to noise ratio of the \(i\)-th satellite in Hz. The equations show that the test statistic \(T(\mathbf{y})\) can be viewed as the noncoherent sum of different signals' integration results. The above analysis is based on the assumption that \(\mathbf{\rho}_{s}\) and \(\mathbf{\rho}_{a}\) are separate, and all of the authentic signals are reserved in the residual signal. However, when the peaks of the MLE cost function formed  
Figure 3: MLE cost function after estimation-cancellation. by spoofing and authentic signals are close, parts of the authentic signals will be subtracted in the cancellation procedure. Consequently, the signal components in Equation (15) under \(\mathcal{H}_{1}\) will be fewer. Thus, the detection performance, which is given by Equation (22), can be viewed as the upper bound. The detection performance will improve when the distance between \(\mathbf{\rho}_{s}\) and \(\mathbf{\rho}_{a}\) increases, and it will approach the upper bound after the peaks formed by the spoofing and authentic signals are separated completely. The detection performance of the second case is very similar to that of the first one. It can also be evaluated with Equations (21), (22) and (25). Different from the first case, the \((C/N_{0})_{i}\) in Equation (25) represents the carrier to noise ratio of the \(i\)-th spoofing signal. As for the third case, as long as spoofing signals are present and mislead the PVT results of a receiver (i.e., \(\mathbf{\rho}_{s}\
eq\mathbf{\rho}_{a}\)), \(\mathbf{y}\) will include residual signal components. Therefore, the test statistic \(T(\mathbf{y})\) will exceed the threshold and can also be used for spoofing detection in this case. However, the method may fail to detect the spoofing attacks when \(\mathbf{\rho}_{s}\) is very close to \(\mathbf{\rho}_{a}\). Therefore, it is not fit for the applications that require high-precision PVT results. It should be noted that there is no exact expression for the detection performance of the third case. Nevertheless, since most of the spoofing and authentic signals that are superimposed in the PVT domain are eliminated, Equation (22) can still be viewed as the upper bound of the detection performance.