## 4 Experimental Verification
### Experiment of New GNSS Spoofing Signal Power Control Algorithm  
In experiment 2, a new power control algorithm is performed for the spoofing signal. The design experimental procedure is as follows: 1 First, the PolaRx5 receiver is cold-started to ensure that receiver is in the state of signal loss-locking after the receiver is suppressed for a long duration by the signal; 2 after a cold start, a signal simulator is used to generate 6 channels of L1 authentic signals and 6 channels of same SVID spoofing signals, each branch spoofing signal has an initial code phase offset of 500 m and an initial carrier phase offset of 500 m with respect to the authentic signal, the spoofing signal is consistent with the code rate and carrier phase rate of the authentic signal, the power of spoofing signal relative to the authentic signal is set according to the power allocation optimization algorithm, all signals are simultaneously injected into the receiver from the connected feeder to simulate the spoofing of receiver in the signal acquisition phase. The process lasts for 3 min; 3 after 3 min, the other parameters of each spoofing signal are kept unchanged, only the code rate is adjusted to 1 m/s and the carrier phase rate is adjusted to 1 m/s, which increases code phase and carrier phase by a fixed slope. The duration of this process is 3 min. After 246 s, the experimental key instruction design is depicted in the figure below. In Figure 12, \"OFFSET\" indicates the code phase offset, carrier phase offset, relative power gain relative to authentic signal, command start time, and duration time; \"RAMP\" indicates the initial code phase offset, initial carrier phase offset, initial relative power gain, code rate and carrier phase rate, power increase/decrease rate, relative to authentic signal, and command start time and duration time. The following analyzes the changes of Doppler frequency, carrier-to-noise ratio, and ECEF of the receiver in the test process. The ground truth in ECEF has been set, the reference position in ECEF is \(-1\),448,700 m in the \(X\)-axis direction, 6,209,100 m in the \(Y\)-axis direction, 175,000 m in the \(Z\)-axis direction. The ECEF coordinate given in this experiment is the positioning error vector subject to the reference position. The statistical results of Doppler frequency range (difference between maximum and minimum), maximum \(C/N_{0}\), minimum \(C/N_{0}\) and average \(C/N_{0}\) of six signals received by test receiver are shown in Table 2.  
Figure 12: Experimental instruction design in experiment 2. Figures 13 and 14 show the change of Doppler frequency with time of six signals received by the test receiver. During the period of 4-184 s, spoofing signal and authentic signal affect receiver at the same time, and Doppler frequency of six signals fluctuates. Compared with experiment 1, Doppler frequency fluctuation period is only 0-50 s, and the duration is shortened by 130 s, with a reduction percentage of 72.2%, the average value of Doppler frequency range is 21,183 Hz from 0 s to 200 s. Compared with experiment 1, Doppler frequency range is reduced by 66,717 Hz, with a reduction percentage of 75.9%; During 184-200 s, code rate and carrier phase rate of spoofing signals change, and Doppler frequency of the signal remains stable. Figures 15 and 16 show the change of \(C/N_{0}\) of six signals received by test receiver with time. During the period from 0 s to 200 s, \(C/N_{0}\) changes smoothly. If the maximum \(C/N_{0}\) of six signals is less than the threshold \(C/N_{0}\) of receiver for 45 dB/Hz, received signal \(  
Figure 14: Changes in Doppler frequency of SVID29, 30, 31 in experiment 2. Figure 15: Changes in \(C/N_{0}\) of SVID9, 14, 18 in experiment 2. Figure 17 shows the change of ECEF coordinate positioning results with time. During the period from 4 s to 184 s, the spoofing signal and authentic signal affect the receiver at the same time. The range of ECEF three-dimensional coordinates is 13.64 m, 194.7 m and 33.81 m, respectively.