## 2 Literature Review  
The physical layer spoofing attack detection method, as presented in [11], relies on a reinforcement learning model. This approach involves the detection of spoofingattacks during the authentication process, which then determines a test threshold through reinforcement learning. Specifically, the method utilizes Q-learning and Dyna-Q techniques, which are tailored for dynamic wireless networks. These techniques are applied to assess the channel states of data packets, thus enabling the detection of spoofing attacks. The overall process can be likened to a zero-sum authentication game that involves both the spoofers and the receiver. The investigation into detecting GPS spoofing attacks for UAVs presented in [12] focused on a novel approach. In this study, the authors present a GPS spoofing detection method that does not rely on prior knowledge and is based on a derived dataset. Notably, this approach minimizes the need for extensive training data. The proposed model utilizes several key features, including the relative position of the spoofer, variations in the spoofer's distance, and the angle of arrival of the signal. These features are instrumental in the detection process. In [13], the authors introduced a technique for estimating the spoofer's location based on audibility information. This technique leverages a node's two states: audible and inaudible. By utilizing this audibility information, the problem of location estimation can be re-defined as a stochastic censoring model. Subsequently, the authors derived the maximum likelihood rstimator (MLE) based on the difference time of arrival (DToA) principle. The detection of Wi-Fi spoofing attacks was the subject of investigation in [14]. The authors focused on detecting spoofing in Wi-Fi networks using on-site channel state information (CSI) data. The PHYAlert method presented in this work achieved single-station-based authentication in both stationary and mobile environments. Detecting and locating spoofing attacks in IoT networks that are based on RSS and the number of connected neighbors (NCN) is discussed in [15]. The authors leverage RSS, delay parameters, and negative acknowledgments to identify spoofing attacks. The analysis employs cluster analysis, which is divided into inter-cluster and intra-cluster detection. In inter-cluster analysis, RSS is employed for detecting and localizing the attacker, while intra-cluster analysis utilizes NCN for localization and detection. Clusters are composed of nodes with similar interests and are maintained by a core node through a status declaration (SD) message or Hello message. Each cluster is further divided into intra-cluster and inter-cluster subsets. To detect spoofing attacks using RSS, the calculated energy between two adjacent nodes is compared to a predefined threshold. If it surpasses the threshold, spoofing detection is triggered. Once the attack is detected, the localization method is initiated through unicasting, as unicasting is unreliable for larger distances in wireless environments. For detecting and localizing spoofing attacks within a cluster, a neighbor detection technique is introduced. In a cluster-based approach, a core node is selected based on various parameters, such as its central position within the group. The prevention and detection of GPS spoofing attacks on UAVs are discussed in [16]. The MLP model processes flight parameters and various features, such as GPS coordinates, position and orientation logs, and system and control status, to generate alarms signaling a GPS spoofing attack. The intrusion detection system is capable of identifying the spoofer when reading the flight parameters collected during one measurement cycle. The abovementioned algorithms use centralized techniques to detect spoofing attacks in two-dimensional space, as shown in Table 1; however, these approaches increase the communication overhead in IoT networks.