## 1 Introduction  
The Global Navigation Satellite System (GNSS) has been widely used in many fields, such as positioning, transportation, and meteorological application. In these fields, many modern GNSS technologies have been developed, such as PPP (precise point positioning) [1], integrated navigation technology [2], GNSS Reflectometry [3, 4], and so on. These technologies have played an important role in modern society. However, the security of GNSS has attracted more and more attention in recent years. Due to the weak power of GNSS signals when they reach the ground and the public structure of civilian signals, GNSS is vulnerable to the threat of jamming and spoofing, so there are potential risks. Different from jamming, spoofer secretly broadcasts the wrong navigation information to users, making users calculate the wrong time, position, and speed information, which will cause more serious consequences. The team of Professor [PERSON] of the University of Texas at Austin successfully implemented the spoofing of drones and yachts, making them deviate from the route [5, 6]. In 2017, multiple ships in the Black Sea were affected by GNSS spoofing technology [7]. In 2020, Mit conducted a spoofing attack experiment on the Tesla Model 3 self-driving car. The experimental results show that the existing spoofing attack methods are enough to make the self-driving car deviate from the route and affect its decision-making ability [8]. Facing increasingly serious spoofing attacks, it is imperative to develop anti-spoofing technology. Anti-spoofing technology can be divided into four categories, which are spoofing detection, spoofing identification, spoofing suppression, and spoofer location [9]. The purpose of spoofing detection and identification is to detect whether there are spoofing signals in the current electromagnetic environment and to identify real signals from all signals. Spoofing suppression works to eliminate spoofing signals from received signals and restore the usability of navigation signals. The spoofer location method eliminates the threat of spoofing from the source by estimating the direction or position of the spoofer. For the spoofing detection module, there are mainly methods such as satellite navigation signal authentication technology [10], external equipment assistance [11; 12; 13; 14], and signal processing of the receiver terminal. Among them, the receiver terminal signal processing method has become the easiest method to promote because of its low cost and wide application range. Specifically, receiver terminal signal processing methods can be classified into single-antenna and multi-antenna spoofing detection methods. For the single-antenna methods, most methods use the observations received by the GNSS receiver to design algorithms for spoofing detection. For example, the carrier-to-noise ratio variation of navigation signals [15], the proportional relationship between pseudo-range Doppler and carrier Doppler [16], and receiver autonomous integrity monitoring (RAIM) technology [17] is used. However, such techniques may be difficult to defend against some advanced spoofing attacks, such as traction spoofing [18]. The multi-antenna spoofing detection method utilizes the geometric space difference between real GNSS signals and spoofing signals and is a kind of spoofing detection method based on airspace features. Because the geometric space information of GNSS real signals is almost inimitable, such methods are currently one of the most effective spoofing detection methods. The spoofing detection methods based on multi-antenna have been studied to some extent. [PERSON] proposed a method of spoofing detection using the carrier phase difference of dual antennas, and verified the feasibility of the method from simulation experiments [19]. [PERSON] uses multiple commercial receivers to detect spoofing by comparing the positions of different receivers. The false alarm rate depends on the spatial distribution of receivers and the positioning accuracy [20].