# GNSS Spoofing Detection Based on Wavelets and Machine Learning
## 3 Methodology
### Implementation Details and OAKBAT Datasets  
The experimental part was performed in the software package Matlab R2024a by using the following three toolboxes: Signal Processing, Wavelet Toolbox, and Statistics and Machine Learning Toolbox. The following parameters were used in the DWT: a decomposition level of 1, the optimal duration of the signal segment was 4 ms, the number of segments per iteration was 100, 400 ms of the data was processed during one iteration, and the duration of each OAKBAT dataset was 480 s. Level 1 of the DWT decomposition was used in experiments. The first level of decomposition is the most detailed because it contains the highest frequency components of the signal. As the decomposition depth increases, the temporal resolution of the wavelet coefficients decreases. It means that sudden power jumps or abrupt phase shifts become harder to localize in time because each deeper level effectively doubles the width of the analysis window and reduces the ability to detect  
Figure 1: Block diagram of the proposed approach. short-duration anomalies. Considering this, using the coefficients from level 1 in machine learning classification, as a rule, gives better classification results. Regarding the machine learning models implementation, in image classification, the bag of features (BoF) selection approach was applied. It means that the model used 70% of the strongest features for classification to improve the quality of the visual vocabulary and reduce the influence of noise. The strongest features contain the most informative parts of the image, such as edges or textures. The weakest features (30%) that may represent noise or unimportant details were eliminated and rejected. Overfitting was reduced by using this BoF approach. In the SVM model, the Gaussian (radial base function--RBF) kernel was chosen for its flexibility and robustness in nonlinear classification problems. This kernel exhibits resistance to noise and is less sensitive to isolated outliers than polynomial kernels, which is crucial in real-world GNSS environments. RBF implicitly handles local variations in signal power, critical for spoofing detection with small dB advantages (e.g., 0.4 dB in os4). In the KNN model, the number of neighbors was set to 5, and we used the Euclidean distance, as these values showed the best model performance. The number of trees was set to 100 and 200 in order to see how the model performed when that number was increased. Also, the built-in validation method, Out-Of-Bag (OOB) prediction, was used in random forests for evaluating the model. Each tree was trained on a random bootstrap sample, and OOB samples were left out and then used for the model evaluation, providing an internal estimate of performance without the need for a separate test dataset. When using more than 200 trees, the performance stabilized with negligible improvements in accuracy. Only the execution time and computational complexity increased with the increase in the number of trees. The model achieved stable and reliable results with 100-200 trees, and adding more trees did not significantly improve accuracy or other metrics. In order to prevent the model overfitting, k-fold cross-validation was applied to all machine learning models. The dataset was divided into k folds, in this research K was 5, and used to assess the model's ability as new data became available. With this value of K, 80% of the data were used for training, and 20% were used for testing. Since machine learning models used in this research were supervised, data were divided into folders based on the class they belonged to. Folders \"real\" and \"spoofed\" denoted the labels and output types used for classification. The predicted variable was the class of the signal (type of the signal): real or spoofed. The class distribution was evenly balanced in each 5-fold cross-validation step because the number of samples per class was equal.