# Detection of Induced GNSS Spoofing Using S-Curve-Bias
## 3 Detection of Induced Spoofing
### Probability Analysis  
The detection of induced spoofing can be regarded as a binary detection problem, that is, to determine whether spoofing exists or not. Two hypotheses are defined as \(\mathcal{H}_{0}\) if an induced spoofing does not exist and \(\mathcal{H}_{1}\) if an induced spoofing does exist. Thus, given that (17) is the decision test, the hypothesis test can be expressed as:  
\[\left\{\begin{array}{ll}\mathcal{H}_{0}:&|\delta_{t}|\leq\gamma,\quad\text{ without spoofing}\\ \mathcal{H}_{1}:&|\delta_{t}|>\gamma,\quad\text{with spoofing}.\end{array}\right. \tag{19}\]  
The probability of false alarm \(P_{fa}\) is the probability that the hypothesis of the presence of an induced spoofing attack is accepted, but in fact, it is not present. The detection probability \(P_{d}\) is the probability that the hypothesis of the presence of a spoofing attack is accepted, and it is present. For the calculation of \(P_{fa}\) and \(P_{d}\), we should obtain the distribution of SCB under the spoofing-present situation. However, according to the analysis above, for the induced spoofing, the inducing process has time-varying characteristics. In addition, the distribution of SCB depends on the tracking loop configuration of the victim receiver and the specific form of spoofing, i.e., changing speeds of code phase and power. But it is unknown to the receiver how code phase and power (carrier-to-noise ratio, \(\frac{C}{N_{0}}\)) of the spoofing will vary. Thus it is difficult for the victim receiver to predict the behavior of induced spoofing. It is also difficult to determine the specific distribution of SCB [37] when there is an induced spoofing. Under this circumstance, it is difficult to derive the analytical expression of the probability density function to compute \(P_{fa}\) and \(P_{d}\).  
If the pattern of induced spoofing is given, \(P_{fa}\) is also a function of the threshold value \(\gamma\). Thus the probability of false alarm \(P_{fa}\) can be calculated as the following:  
\[P_{fa}=\int_{\gamma}^{+\infty}p\left(\mathcal{T};H_{0}\right)d\mathcal{T}, \tag{20}\]  
where \(\mathcal{T}=|\delta_{t}|\), \(p\left(\mathcal{T};H_{0}\right)\) denotes the probability density function of \(\mathcal{T}\) when there is no induced spoofing.  
Similarly, the detection probability \(P_{d}\) can be calculated as the following:  
\[P_{d}=\int_{\gamma}^{+\infty}p\left(\mathcal{T};H_{1}\right)d\mathcal{T}, \tag{21}\]  
where \(p\left(\mathcal{T};H_{1}\right)\) is the probability density function of \(\mathcal{T}\) when there is an induced spoofing.  
In experiments, as that in [3; 34], the probability of false alarm \(P_{fa}\) will be obtained when there is no induced spoofing as the following:  
\[P_{fa}=\frac{\#\left\{\mathcal{T}>\gamma\right\}}{M}, \tag{22}\]  
where \(\#\left\{\cdot\right\}\) is the total number of satisfied argument conditions. \(P_{fa}\) is explained as a relative frequency, that is a ratio between the number of times the test statistic exceeds the given threshold out of the total number of experiment realizations \(M\).  
When there is an induced spoofing, the detection probability \(P_{d}\) will be obtained as the following:  
\[P_{d}=\frac{\#\left\{\mathcal{T}>\gamma\right\}}{M} \tag{23}\]\(P_{d}\) is similarly explained as a relative frequency, that is a ratio between the number of times the test statistic exceeds the given threshold out of the total number of experiment realizations \(M\).  
For a given \(P_{fa}\), the threshold is first calculated based on Equaiton (22). In addition, a similar hypothesis testing can be performed for the ratio method. In this paper, we calculated the detection probability every 10 s where the number 10 is selected as an experience value. That is to say, spoofing detection was performed within each small detection window. The performance of the proposed algorithm will be evaluated and compared with the ratio method.