# GNSS Spoofing Detection Based on Wavelets and Machine Learning
## 3 Methodology
### Features Used for Classification  
The specified features were extracted for all DWT coefficients (approximation \(A\), horizontal \(H\), diagonal \(D\), and vertical \(V\)) for all used datasets. The statistical features were as follows [48; 49]:  
1. The mean (\(\mu\)) represents the arithmetic mean of all the values in the dataset (in this case, the approximation coefficients \(A\)). It provides information about the \"center\" of data distribution. It is defined as: \[\mu=\frac{1}{N}\sum_{i=1}^{N}x_{i}\] (19) where \(N\) is the number of approximation coefficients and \(x_{i}\) is each approximation coefficient. 2. The standard deviation (\(\sigma\)) measures the dispersion of data around the mean. The higher the standard deviation, the farther away the data are from the mean. It is calculated as the square root of the variance: \[\sigma=\sqrt{\frac{1}{N}\sum_{i=1}^{N}(x_{i}-\mu)^{2}}.\] (20)
3. The variance (\(\sigma^{2}\)) shows the average square distance of the value from the mean. It provides insight into the range and variety of data and is crucial for assessing noise or variability in the signal. It is calculated as follows: \[\sigma^{2}=\frac{1}{N}\sum_{i=1}^{N}(x_{i}-\mu)^{2}.\] (21)The maximum value represents the highest coefficient in the dataset. It is useful for detecting peaks in a signal that may indicate sudden changes. \[x_{\max}=\max(x_{1},x_{2},\ldots,x_{N}).\] (22)
5. The minimum value represents the smallest coefficient in the dataset, informs about the lower limit of the signal, and can also indicate exceptions or specific patterns. \[x_{\min}=\min(x_{1},x_{2},\ldots,x_{N}).\] (23)
6. The kurtosis quantifies the \"spikeness\" of a data distribution. A high kurtosis means that most of the values are concentrated around the middle, with the presence of \"heavy tails\" (outliers), while a low kurtosis indicates a more even distribution. the kurtosis is calculated according to the equation \[\text{kurtosis}=\frac{1}{N}\sum_{i=1}^{N}\biggl{(}\frac{x_{i}-\mu}{\sigma} \biggr{)}^{4}.\] (24)
7. The skewness measures the symmetry of a distribution. If the skewness is positive, the tail of the distribution is longer on the right (right-hand asymmetry), while a negative skewness indicates a tail on the left (left-hand asymmetry). The equation for the skewness is the following: \[\text{skewness}=\frac{1}{N}\sum_{i=1}^{N}\biggl{(}\frac{x_{i}-\mu}{\sigma} \biggr{)}^{3}.\] (25)  
All of these features were used on approximation coefficients because they contain most of the energy of the signal and represent its most important structural information at a lower frequency, making them useful for classification and analysis. The extracted spectral features were the following [50; 51]:  
1. The spectral centroid (\(SC\)) indicates the dominant frequency, i.e., where the center of mass of the spectrum is located. Also, it refers to the median of the spectrum and is calculated as follows: \[SC=\frac{\sum_{k=0}^{N-1}f_{k}\cdot|X(k)|}{\sum_{k=0}^{N-1}|X(k)|}\] (26) where \(f_{k}\) is the frequency of the \(k\)th bin, \(X(k)\) is amplitude (or magnitude) of the Fourier spectrum at the frequency \(f_{k}\), and \(N\) is the number of frequency (bins) components in the spectrum. 2. The spectral spread (\(SS\)) is the second central moment of the spectrum. It is the standard deviation around the spectral centroid \[SS=\sqrt{\frac{\sum_{k=0}^{N-1}(f_{k}-SC)^{2}\cdot|X(k)|}{\sum_{k=0}^{N-1}|X(k )|}}.\] (27)
3. The spectral entropy (\(SE\)) is a measure of the disorder or randomness in the spectral power distribution of a signal. It is calculated using the Shannon entropy formula \[SE=-\sum_{k=0}^{N-1}P(k)\cdot\log_{2}(P(k))\] (28) where \(P(k)\) is the normalized spectral magnitude at frequency bin \(k\). The selection of these statistical and spectral features was based on their ability to concisely describe the distribution of frequency components and enable the model to recognize key patterns. These metrics capture underlying patterns and irregularities in the signal that are often introduced by spoofing attacks.