# Detection of Induced GNSS Spoofing Using S-Curve-Bias
## 1 Introduction  
Global navigation satellite system (GNSS) is a general term for various satellite-based navigation systems and their augmentation systems. The application of GNSS is omnipresent, including mobile phone location, the smart grid, emergency rescue, fishing operation, precision guidance and strike of weapons, the transport and management of air, sea and ground and so on [1]. In addition, a great deal of new applications based on GNSS are constantly emerging. Taking into account the significance of GNSS applications, its security becomes a pressing issue [2]. GNSS signals broadcasted by the constellations arrive at the antenna with an extremely low signal power level, e.g., approximately 20 dB lower than the noise. Therefore, it is highly susceptible to various types of interferences. As a special form of interference, spoofing does great harm to GNSS. Recent successful implementations of spoofing tests have further enhanced the awareness of the harm of spoofing attacks [3, 4]. Spoofers utilize the open transparency and predictability of GNSS civilian signals to generate spoofing signals which have similar signal structure as authentic ones. Thus they can induce a victim receiver to believe that they are authentic signals and provide incorrect navigation messages or incorrect pseudo-ranges to forge a localization solution at the receiver. It is hard for a conventional GNSS receiver to detect the spoofing attack, which may lead to incorrect position or timing information. There is a rich literature studying this issue. A representative team comes from the radionavigation laboratory in the University of Texas at Austin [5, 6, 7, 8]. According to references [9, 10], the type of spoofing is classified as simplistic, intermediate, and sophisticated, depending on their complexity and the level of robustness required to the related anti-spoofing techniques. A simplistic spoofing basically consists of a GNSS signal generator that emits signals which are visually inconsistent (in frequency, phase, code,and data message) with authentic satellite signals. For the simplistic spoofing, in order to successfully attack the victim receivers, it usually needs to first use jamming to unlock the receiver. Then the victim receivers will lock on the forced signal in the process of recapture. The intermediate and sophisticated spoofing adds synchronization blocks, which makes the counterfeit signals consistent with the real ones and result in spoofing attacks which are more difficult to detect. Furthermore, the sophisticated spoofing attack can be accomplished by using multiple transmitting antennas [11], in which case different forged satellite signals can come from different directions. The design and implementation of a multiple-antenna spoofing device is not simple and may seem laborious. In this paper, we focus on the induced spoofing, e.g., GPS L1 C/A signals, where the counterfeit signals are consistent with the real ones, but transmitted with a single antenna. Thus the induced spoofing belongs to intermediate spoofing [12]. The induced spoofing captures the victim tracking loops by gradually adjusting it's parameters, e.g., code phase and power. Then the victims smoothly deviate from the correct position or timing [13; 14]. Therefore, for the conventional receiver, this kind of spoofing is more subtle and will not lead to an unlock in the tracking loop. Figure 1 shows the correlation peak superposition process of the tracking loop correlator in a victim receiver. Figure 1a is the beginning of adjustment process, the spoofing lags the authentic signal by two chips with a lower power and the same frequency, but a different code rate. From Figures 1a-c, the spoofing gradually approaches the authentic signal in code phase. At the same time, the power is gradually increased but is still lower than that of the authentic signal until it is synchronized with the authentic signal in code phase and carrier frequency.