# Detection of Induced GNSS Spoofing Using S-Curve-Bias
## 3 Detection of Induced Spoofing  
### The Proposed Method  
In the correlation domain analysis of navigation signal quality, SCB is a common index to measure the navigation ranging error [37]. S-curve refers to the code-discriminator curve of the early-late correlation value in the receiver code tracking loop, which varies with the different code-discriminator algorithms. The theoretical zero-crossing point of S-curve was located at the zero point of code tracking error. In fact, due to the influence of channel transmission distortion and nonlinear effect of the power amplifier, the discriminator curve of code loop was usually locked in the place where a code phase deviation existed, resulting in SCB. Assume that correlator spacing is \(d\), the non-coherent power discriminator's S-curve can be defined by the following formula [37]:  
\[S_{c}\left(\varepsilon\left(t\right),d\right)=\left|P\left(\varepsilon\left(t \right)-\frac{d}{2}\right)\right|^{2}-\left|P\left(\varepsilon\left(t\right)+ \frac{d}{2}\right)\right|^{2} \tag{10}\]  
where \(P\left(\cdot\right)\) is the correlation value between the received signal and local replica, the code phase difference between local replica and prompt channel is the argument of the correlation operator, and \(\varepsilon\left(t\right)\), i.e., SCB, satisfied with the following formula:  
\[\varepsilon\left(t\right)=\arg\left\{S_{c}\left(\varepsilon\left(t\right),d \right)=0\right\}. \tag{11}\]  
It should be noted that \(\varepsilon\left(t\right)\) changes with time when there is induced spoofing. According to Equations (8) and (9), we can get:  
\[S_{c}\left(\varepsilon\left(t\right),d\right) =\left|\sqrt{P^{a}}R\left(\varepsilon\left(t\right)-\frac{d}{2} \right)+\sqrt{P^{s}}R\left(\varepsilon\left(t\right)-\frac{d}{2}-\left(\Delta _{c}-\Delta_{r}t\right)\right)\right|^{2}\] \[-\left|\sqrt{P^{a}}R\left(\varepsilon\left(t\right)+\frac{d}{2} \right)+\sqrt{P^{s}}R\left(\varepsilon\left(t\right)+\frac{d}{2}-\left(\Delta _{c}-\Delta_{r}t\right)\right)\right|^{2}, \tag{12}\]  
where the noise \(\bar{n}\) has been omitted. Next, substituting Equations (5) and (6) into (12),  
\[S_{c}\left(\varepsilon\left(t\right),d\right)= \left|\sqrt{P^{a}}\left(1-\left|\varepsilon\left(t\right)-\frac{d }{2}\right|\right)+\sqrt{P^{s}}\left(1-\left|\varepsilon\left(t\right)-\frac{ d}{2}-\left(\Delta_{c}-\Delta_{r}t\right)\right|\right)\right|^{2}\] \[-\left|\sqrt{P^{a}}\left(1-\left|\varepsilon\left(t\right)+\frac{ d}{2}\right|\right)+\sqrt{P^{s}}\left(1-\left|\varepsilon\left(t\right)+\frac{d}{2}- \left(\Delta_{c}-\Delta_{r}t\right)\right|\right)\right|^{2}. \tag{13}\]  
Combined with Equations (11) and (13), SCB can be obtained by solving the following equation:  
\[\left|\sqrt{P^{a}}\left(1-\left|\varepsilon\left(t\right)-\frac{ d}{2}\right|\right)+\sqrt{P^{s}}\left(1-\left|\varepsilon\left(t\right)-\frac{d}{2}- \left(\Delta_{c}-\Delta_{r}t\right)\right|\right)\right|^{2}\] \[=\left|\sqrt{P^{a}}\left(1-\left|\varepsilon\left(t\right)+\frac {d}{2}\right|\right)+\sqrt{P^{s}}\left(1-\left|\varepsilon\left(t\right)+ \frac{d}{2}-\left(\Delta_{c}-\Delta_{r}t\right)\right|\right)\right|^{2}. \tag{14}\]  
For convenience, we denote \(A=\sqrt{P^{a}}\), \(B=\sqrt{P^{s}}\), \(d=1\). In addition, it is noted that \(\Delta_{c}\) is the code phase difference in chips between authentic signal and spoofing at the beginning of the attack. As an example, letting \(\Delta_{c}=-2\) will be consistent with the experiments in reference [39]. Then, since \(R\left(\tau^{\prime}\right)\) is a piecewise function, the solution of Equation (14) needs a piecewise analysis. Therefore, the theoretical formula of SCB can be obtained as:  
\[\varepsilon\left(t\right)=