# GNSS Spoofing Detection Based on Wavelets and Machine Learning
## 3 Methodology
### Discrete Wavelet Transform  
The discrete wavelet transform breaks down a discrete-time signal into wavelets across different scales, capturing both time and frequency information. Unlike the Fourier Transform, which only reveals frequency content, the DWT also provides time localization. This makes it especially useful for analyzing signals that are non-stationary or contain transient features.  
In the context of GNSS spoofing detection, the Discrete Wavelet Transform can be utilized to identify signal anomalies that may suggest deceptive activity. Its applications in spoofing detection include the following:  
* Decomposing the signal into various frequency components, enabling feature extraction that may indicate spoofing attack.
* Classifying signals as either authentic or fake using machine learning methods.
* Computational efficiency makes it suitable for real-time processing where immediate detection is critical, such as in GNSS receivers.  
The following conditions are applied to the wavelets:  
1. The admissibility condition means that the wavelet function \(\psi(t)\) must have zero mean: \[\int_{-\infty}^{\infty}\psi(t)\,dt=0.\] (1)
2. The normalized condition means that the wavelet function has finite energy: \[\int_{-\infty}^{\infty}\left|\psi(t)\right|^{2}dt=1.\] (2)  
Condition (1) indicates that the wavelet function has equal positive and negative areas so both low and high frequencies can be captured.  
The discrete wavelet transform is defined as  
\[W_{j,k}=\sum_{n=0}^{N-1}x[n]\cdot\psi_{j,k}[n] \tag{3}\]  
where \(\psi_{j,k}[n]\) is a wavelet basis function at a specific scale \(j\) and shift \(k\) for each discrete sample \(n\). The wavelet basis function is created from the mother wavelet \(\psi(t)\)  
\[\psi_{j,k}[n]=\frac{1}{\sqrt{2j}}\,\psi\left(\frac{n-k\cdot 2j}{2^{j}}\right) \tag{4}\]  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Dataset** & **Power Level Advantage [dB]** & **Constellation** \\ \hline cleanStatic & – & GPS, Galileo \\ os2 & +10 & GPS \\ os3 & +1.3 & GPS \\ os4 & +0.4 & GPS \\ os10 & +10 & Galileo \\ os11 & +1.3 & Galileo \\ os12 & +0.4 & Galileo \\ \hline \hline \end{tabular}
\end{table}
Table 1: OAKBAT datasets with the power level advantage of fake signals.  
where scale \(\frac{1}{\sqrt{2}}\) is the normalization factor, \(2^{j}\) is the scale that compresses or spreads the wavelet, \(k\cdot 2^{j}\) moves wavelet in time, \(j\) controls the frequency, and shift \(k\) controls the translation (position) of the wavelet in time [37; 38; 39].  
The decomposition of discrete signal \(x[n]\) is performed by using low-pass and high-pass filters to capture both low- and high-frequency components. The results of the decomposition are approximation and detail coefficients at each level. Approximation coefficients \(A_{j}\) are defined with the following equation:  
\[A_{j}[n]=\sum_{k}x[k]\cdot g[n-2k] \tag{5}\]  
where \(g[n]\) is the output of low-pass filtering.  
Detail coefficients \(D_{j}\) are defined as  
\[D_{j}[n]=\sum_{k}x[k]\cdot h[n-2k] \tag{6}\]  
where \(h[n]\) is the output of high-pass filtering.  
The original signal may be reconstructed by using approximation and detail coefficients as follows:  
\[x[n]=\sum_{k}A_{j}[k]\cdot g[n-2k]+\sum_{k}D_{j}[k]\cdot h[n-2k]. \tag{7}\]  
In this paper, Daubechies db4 and db8 wavelets were integrated with machine learning methods for spoofing detection and signal-type classification. These wavelets enable the efficient analysis of signal changes in time and frequency (good localization), which is crucial for detecting anomalies that occur during spoofing attacks. Furthermore, both db4 and db8 wavelets have the ability to detect subtle but significant differences between authentic and fake signals. As already stated, Daubechies wavelets retain more energy of the signal in the approximation coefficients, resulting in more accurate statistical and texture features. More accurate features give better classification results.