# Detection of Induced GNSS Spoofing Using S-Curve-Bias
## 2 Signal Model  
For most GNSS receivers, the received radio frequency (RF) signals will be converted to intermediate frequency (IF) signals. Subsequent processing will be based on the IF signals. When there is an induced spoofing, for a given receiver with single antenna, the received IF signal can be denoted as:  
\[x\left(t\right)=x_{a}\left(t\right)+x_{s}\left(t\right)+x_{n}\left(t\right), \tag{1}\]  
where \(x\left(t\right)\) is the received IF signal, \(t\) is time in seconds, \(x_{a}\left(t\right)\) and \(x_{s}\left(t\right)\) are separately authentic satellite signal and spoofing, \(x_{n}\left(t\right)\) denotes the additive white Gaussian noise (AWGN) with zero mean and variance \(\sigma^{2}\). The authentic satellite signal is modeled as:  
\[x_{a}\left(t\right)=\sum_{i=1}^{M}\sqrt{p_{i}^{a}}D_{i}^{a}\left(t-\tau_{i}^{a} \right)C_{i}\left(t-\tau_{i}^{a}\right)\cos\left(2\pi\left(f_{0}+f_{d,i}^{a} \right)t+\phi_{i}^{a}\right), \tag{2}\]  
where \(M\) is the number of authentic satellites included in the received signal, \(P_{i}^{a}\) is the received power of the \(i\)-th satellite, and \(D_{i}^{a}\left(t\right)\) is the \(\pm 1\)-valued \(i\)-th signal's data bit stream, \(C_{i}\left(t\right)\) is its \(\pm 1\)-valued spreading code, \(\tau_{i}^{a}\) is the \(i\)-th signal's code phase, \(f_{0}\) is the intermediate frequency, \(f_{d,i}^{a}\) denotes the Doppler shift of the \(i\)-th authentic satellite signal in Hertz, and \(\phi_{i}^{a}\) is its initial carrier phase. It is known that induced spoofing has the same signal structure as the authentic satellite signal. Therefore, the spoofing can generally be modeled as:  
\[x_{s}\left(t\right)=\sum_{i=1}^{N}\sqrt{p_{i}^{s}}D_{i}^{s}\left(t-\tau_{i}^{ s}\right)C_{i}\left(t-\tau_{i}^{s}\right)\cos\left(2\pi\left(f_{0}+f_{d,i}^{s} \right)t+\phi_{i}^{s}\right), \tag{3}\]  
where \(N\) is the number of satellites included in the spoofing, \(P_{i}^{s}\) is the received power of \(i\)-th satellite, and \(D_{i}^{s}\left(t\right)\) is the \(\pm 1\)-valued \(i\)-th signal's data bit stream, \(\tau_{i}^{s}\) is the \(i\)-th signal's code phase, \(f_{d,i}^{s}\) denotes the Doppler shift of the \(i\)-th authentic satellite signal in hertz, and \(\phi_{i}^{s}\) is its initial carrier phase. For notational simplicity, the time indication of some parameters, e.g., \(f_{d,i}^{s}\), have been omitted. For the success of an attack, the spoofing will include most of the satellites in the authentic ones. For the \(i\)-th satellite signal, the core of GNSS signal processing is the correlation of the received signal with local replica:  
\[\ell_{i}\left(t,\tau_{i}\right)=C_{i}\left(t-\tau_{i}^{a}\right)\cos\left(2\pi \left(f_{0}+\hat{f}_{d,i}^{a}\right)t+\hat{\phi}_{i}^{a}\right) \tag{4}\]  
where \(\hat{\tau}_{i}^{a}\), \(\hat{f}_{d,i}^{a}\) and \(\hat{\phi}_{i}^{a}\) are separately the estimated \(\tau_{i}^{a}\), \(f_{d,i}^{a}\), and \(\phi_{i}^{a}\). The goal of a receiver's tracking loops is to accurately drive the estimates \(\tau_{i}^{a}\), \(f_{d,i}^{a}\) and \(\hat{\phi}_{i}^{a}\). It is well known that these parameters are estimated based on the outputs of correlators in tracking loops. However, when there is an induced spoofing, there will be a distortion on the correlator outputs. Therefore, the tracking loops cannot accurately obtain the estimations. For the case of a GPS L1 C/A signal, through carrier wipe-off and coherent integration of one millisecond, the cross-correlation function of the local replica and the authentic signal can be written as:  
\[R\left(\tau^{\prime}\right)= \begin{cases}1-\left|\tau^{\prime}\right|,&\left| \tau^{\prime}\right|\leq 1\\ 0,&\text{otherwise},\end{cases}  \tag{5}\]  
where \(\tau^{\prime}=\hat{\tau}^{a}-\tau^{a}\) denotes the code phase lag in chips. It is noted that, for the sake of simplicity, the subscript \(i\) has been omitted. At the beginning of induced spoofing, it is assumed that the spoofing lags behind the authentic signal \(\Delta_{c}\) chips.