## 2 Problem Definition and Use-Case Example  
Most of the GNSS signals use the code-division multiple access (CDMA) technique, with a received signal power around \(-160\) dBW. This means that the received signals are usually below the noise floor. For this reason, the direct observation of the signal is in general not feasible, if not using extremely high gain antennas. Therefore, when applying RF fingerprinting it is essential to evaluate the capability of the technique to operate at low SNR. A spoofing scenario is illustrated in Figure 2. In this example scenario, both the drone-based spoofer and the GNSS target receiver (e.g., a civil aircraft such as a flying taxi or a rescue helicopter) receive the broadcasting GNSS signals from satellites. During the spoofing attack, the GNSS target receiver receives the spoofing signals from the spoofer as well as together with the genuine GNSS signals from sky satellites and its task is to identify and mitigate the spoofing interference for attaining optimal positioning performance. Based on the GNSS signal received from the genuine satellites on sky, the spoofer is able to create fake GNSS-like signals which it will broadcast in the air. There are many ways in which a spoofer can generate a GNSS signal, as described below, whether these involve simplistic, intermediate, and sophisticated attacks. Figure 2 illustrates only one of the many possible scenarios one could imagine when a GNSS receiver is spoofed by one or several malicious transmitters. More details about spoofing classes and possible mitigation solutions are addressed below. * _Sophisticated spoofing attacks_[32]: these are the most complex spoofing attacks to mitigate, as they are an extension of the intermediate spoofing attack, where the signals received from multiple GNSS antennas (sometimes placed at different locations) are modified (e.g., through random delays and Doppler shifts) and re-transmitted in a combined manner, in such a way that the receiver is duped to believe the signals are obtained from various genuine satellites. Spoofing attacks adversely affect the quality of positioning, navigation and timing (PNT) services of GNSS receivers, by introducing errors in the estimated PVT. For example, as shown in [31], an intermediate spoofer with a spoofer-to-signal ratio of 0 dB (i.e., equal spoofer and GNSS signal power) introducing a code delay of 0.5 chips can deteriorate the detection probability of the GNSS signal by 20% and with a code delay of only 0.25 chips, the detection probability decreases with 75% (i.e., from 100% to 25%). The spoofing impact on the good functionality of a GNSS receiver can be thus significant and it is of utmost importance to devise counter-spoofing methods, especially in life-critical applications such as aviation applications. Current counter-spoofing methods can be classified into three main categories [11; 33], according to the three GNSS-receiver domains depicted in Figure 1:  
* _Pre-correlation link-level methods_ relying on signal samples before the acquisition stage, i.e., on I/Q data. This is the case addressed in this paper. Such pre-correlation anti-spoofing methods are still very rare in the literature;
* _Post-correlation link-level methods_ relying on the despread signal, at the output of the tracking stage for a single satellite. Examples can be found in [33; 34] and they are out of the scope of this paper;
* _Navigation or system-level methods_ relying on the pseudorange signals coming from all visible satellites. These are by far the most encountered anti-spoofing methods in the current literature and a few examples can be found in [27; 28; 29] (they are also outside the scope of this paper). Our paper focuses on the pre-correlation spoofing identification approaches, taking as the input the I/Q raw data (at sample level) and aiming to identify, based on RF fingerprinting approaches, whether the received signal comes from a genuine GNSS transmitter or from a spoofing transmitter.