# Detection of Induced GNSS Spoofing Using S-Curve-Bias
## 4 Experiments
### Results of the Proposed Method  
Figure 3 shows the comparisons between the experimental and theoretical SCBs. The time length was 294 s and the induced spoofing attack occurred at 110 s (vertical point-line). Each satellite actually had a theoretical SCB curve, but these theoretical curves coincided with each other and only one theoretical SCB curve is shown in Figure 3. For the experimental SCBs, five curves according to five tracked satellites are shown. From 0 to 110 s, there were almost no fluctuations, except for PRN23 which caused the other curves to be masked by the curve of PRN23. For PRN23, the fluctuation may have been due to poor signal quality or high noise conditions. It is noted that the experimental SCB curves take the fluctuations on both sides of the theoretical value. The main reason is that the theoretical SCB was derived by ommiting the noise \(\hat{n}\) in Equation (8). However, in fact, noise was unavoidable, which lead to fluctuations. On the other hand, the overall trend was consistent with the theoretical curve. In order to reduce the impact of fluctuations, the curves were filtered with a Butterworth digital filter. The coefficient vectors of the filter system function's molecular polynomial and denominator polynomial are \(\mathbf{b}=[9.9419\times 10^{-4},2.0\times 10^{-4},9.9419\times 10^{-4}]\) and \(\mathbf{a}=[1,-1.908,0.9218]\).  
Figure 4 shows the filtered experimental SCB curves. It is more clear to show that the experimental curves were almost consistent with the theoretical curve. It is noted that experimental SCB values had a very small fluctuation around 0 when there was no spoofing in the first 110 s. From 110 s, the curve gradually deviated from zero. It indicates that there was an induced spoofing and it's code phase lagged behind that of the authentic satellite signal. When the maximum negative value was reached, the value of SCB slowly increased to zero. At this time the spoofing was already very close (about within 0.5 chips) to the authentic signal. After arriving at zero point, the receiver tracking loop was controlled by induced spoofing. The tracking loop of the victim receiver locked on the induced spoofing and was slowly pulled out of the authentic signal. Then the value of SCB increases gradually.  
Figure 3: Comparisons between experimental SCB curve and theoretical SCB curve.  
In order to obtain more details, as an example, the SCB curve of PRN23 is shown in Figure 5. The experimental SCB curve had a good fit with the theoretical curve. As stated before, when the spoofing began to induce the victim receiver, the SCB curve changed gradually.  
For PRN23, the first derivative of SCB is shown in Figure 6. It is clear that the theoretical value with spoofing was significantly greater than that without spoofing. When there was spoofing, the experimental values fluctuated around the theoretical ones. The experimental values were close to zero before 110 s where there was no spoofing. More importantly, it was far less than the value with spoofing. Therefore, it was easy to find a reasonable detection threshold \(\gamma\).  
Table 1 summarizes the detection threshold \(\gamma\) corresponding to the false alarm probability \(P_{fa}\) for the proposed algorithm. It is reminded that the thresholds are selected based on Equation (22).  
Figure 4: Comparisons between filtered experimental and theoretical SCB curves.  
Figure 5: Experimental and the theoretical SCB curves for PRN 23.