# On the Use of a Feedback Tracking Architecture for Satellite Navigation Spoofing Detection
## 5 Experimental Setup and Initial Results  
In order to assess the capabilities of the ECADLL technique under spoofing attack, the Texas Spoofing Test Battery (TEXBAT) was used [38]. The battery consists on a set of high-fidelity datasets that include spoofing attacks in different configurations. The scenarios are based on two clean recordings, free of impairments, one static and one dynamic. Different configurations for the type of attack, relative power to the real signal and targeted variable, either time or position, are distributed between the different scenarios. In Table 1, the basic description of the datasets and the nomenclature used for the remainder of the paper can be found. Results for TEXBAT ds3 are presented hereafter. This scenario is a static matched-power time push, where the spoofer is inserted after 80 s aligned with the LOS signal, and the initial pull-off is done at around 110 s.  
It is important to notice that the results presented here were obtained transmitting the TEXBAT dataset by cable connection to a GPS L1 front-end, named SIGE2 [39], and processing the results using the ECADLL software receiver. By doing so, the signal was filtered through a front-end filter, which has a 4-MHz bandwidth and a resolution of two bits. Furthermore, the sampling frequency is around 16.3676 MHz, and the data were processed at an intermediate frequency of 4.1314 MHz. This configuration provides a lower resolution than the original TEXBAT files, but gives a more common front-end configuration similar to the ones found on commercial receivers. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Name** & **Place** & **Date** & **Description** \\ \hline clean & Austin, Texas & January 2011 & Base scenario for static datasets \\ ds3 & Austin, Texas & January 2011 & Static matched-power time push \\ ds4 & Austin, Texas & January 2011 & Static matched-power position push \\ ds6 & Austin, Texas & January 2011 & Dynamic matched-power evolved position push \\ ds7 & Austin, Texas & June 2015 & Static matched-power evolved time push \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Texas Spoofing Test Battery (TEXBAT) scenarios description. Figure 8: Delay estimation for a spoofing attack scenario. In red is depicted the decision when no RM is used and in blue when using RMs inside the monitoring block. Results are presented for one of the channels, but similar behaviors are obtained for the others. In Figure 9, the estimated \(C/N_{0}\) of Satellite 6 is presented. It can be observed that it has a similar trend to the one shown in [38], but with a small loss of power, of a few dB, due to the different front-end configuration and re-transmission. In Figure 10, the delay difference \(\delta\tau=\tau_{1}-\tau_{0}\) is plotted. In this figure, the working of the ECADLL can be observed: during the first 120 s, the estimated delay is zero, as Unit1 is still turned off. When the asymmetry is revealed, after 120 s, it locks in to the signal that is separated from the spoofing signal being tracked by Unit0. After 100 s of pull-off time, Unit1 estimates the correct delay difference of the real signal as \(\approx\)2000 ns, which corresponds to the 600 m of error introduced by the spoofing attack, as stated in [38]. Figure 10: Delay difference between Unit1 and Unit0 for TEXBAT ds3. Figure 9: \(C/N_{0}\) for Satellite 6 using TEXBAT ds3. In Figures 11 and 12, the estimated amplitudes \(\hat{a}_{0}\) and \(\hat{a}_{1}\) and the estimated phase differences \(\hat{\theta}_{0}\) and \(\hat{\theta}_{1}\) are presented for Unit0 on the top panel of each figure and Unit1 on the bottom one. For the amplitude, we observe that the final values correspond to \(\hat{a}_{0}=0.35\) and \(\hat{a}_{1}=0.28\); the difference between them is close to the 1.3 dB of spoofing advantage set for the matched-power scenario. Observing these values, we know that Unit0 is tracking the spoofing signal, and Unit1 is tracking the satellite signal.