# On the Use of a Feedback Tracking Architecture for Satellite Navigation Spoofing Detection
## 4 Using ECADLL Information for Spoofing Detection
### Improving Computational Load and Detection Latency  
One drawback of the use of basic ECADLL is that when no additional signal is present, Unit1 of each channel is continuously searching for it over random delays. This behavior creates additional computational burden and may cause a delay in the estimation of the real characteristics of the spoofing/multipath signal, because if the delay estimation is wandering randomly, it may take a longer time for it to converge on the right delay once the additional signal is present. In order to improve this situation, in our implementation, we control the turning on/off of the Unit1 detecting distortions on the correlation function using a Ratio Metric (RM).  
Figure 6: Impairment distinction based on soft observations. The signal in red is detected as a spoofing attack because the delay difference \(\tau_{1}-\tau_{0}\) is negative. The green one is detected because the delay increases, but the amplitude is maintained constant, and the yellow one is classified as impairment because there is not enough information to allow discrimination.  
It has been proven that the SQMT using RM works well detecting distortions in the correlation function [14; 33]. Unfortunately, these techniques are not able to estimate the delay of the spoofing signal or mitigate the errors caused by these signals in the position and time solution. Using just one RM to detect distortions in the correlation functions and as an additional input to the monitoring block, the estimation and detection latency of the spoofing signal and the computational load can be improved.  
The RM is defined as:  
\[M(t_{k})=\frac{I_{E}+I_{L}}{mI_{P}} \tag{13}\]  
where \(I_{E}\), \(I_{L}\) and \(I_{P}\) are the early, late and prompt correlator outputs of the coherent DLL at a certain time \(t_{k}\) and \(m\) is the slope of the DLL discriminator. The monitoring block computes the mean value of \(M\) during a 1-s time window, and if it surpasses a pre-defined threshold based on the probability of false alarm, Unit1 is inserted in the feedback loop in order to detect the signal generating the distortion as quickly as possible. A 1-s time window was again chosen as a trade-off to obtain a correct estimation of the mean value and the time needed by the algorithm to make a decision. For spoofing detection, a 1-s time window is still well below the time that a typical spoofing attack will need to gain control of the receiver, which usually extends to several minutes [38].  
In Figure 7, we can observe the impact on the detection latency when using the RM. When using RM inside the monitoring block, the spoofing attack is detected as soon as the push-off phase starts, around 120 s. Following this initial detection, the metric has some misdetection, and then, it recovers and declares the spoofing attack for the duration of the test. Furthermore, in Figure 8, we can observe that the delay estimation does not change and is less noisy during the time when the attack starts. Having Unit1 turned off for the first 120 s will greatly help in the computational time for the scenario.  
In Section 6.3, we provide numerical and analytic results for the improvement of the computational load and the impairment detection latency.  
Figure 7: Decision made for a spoofing attack scenario. In red is depicted the decision when no Ratio Metric (RM) is used and in blue when using RMs inside the monitoring block.