A Spoofing Detection and Direction-Finding Approach for Global Navigation Satellite System Signals Using Off-the-Shelf Anti-Jamming Antennas

Abstract

Global Navigation Satellite System (GNSS) spoofing induces the target receiver to obtain the wrong positioning and timing results, which is very harmful. It is necessary to develop high-precision GNSS spoofing detection and associated direction-finding methods. In order to achieve sensitive and high-precision direction-finding for GNSS spoofing, it is necessary to realize the spoofing signal detection in the capture phase. This paper first proposes a method of GNSS spoofing detection, based on machine learning, that extracts features in the capture phase, which realizes various types of spoofing detection such as matching power, carrier phase alignment, and frequency locking. Notably, existing spoofing-direction-finding methods are mainly based on dedicated antenna arrays, which incur high costs and are not conducive to large-scale deployments. The basis of the spoofing detection proposed by this paper consists of a differential phase-center correction method, which is proposed in the context of an off-the-shelf anti-jamming array antenna, which effectively reduces the impact of the phase-center jitter introduced by the mutual coupling between antenna arrays on the direction-finding. The publicly accessible Texas Spoofing Test Battery (TEXBAT) dataset and actual measured data are both used for test verification. The results demonstrate that the proposed spoofing detection method can achieve success rates of over 97% on the TEXBAT dataset and more than 96% on the measured dataset, and the accuracy of the proposed direction-finding method can reach 1°, which can realize the effective detection and direction-finding of GNSS spoofing.

1. Introduction

GNSS has been widely applied in fields such as transportation, electricity, and finance. However, GNSS signals are weak, and the format of its civilian signals is open, making them extremely vulnerable to various forms of electromagnetic interference, including jamming and spoofing.

GNSS security has garnered increasing attention in recent years. Unlike jamming, spoofing employs techniques such as pseudo-range scanning, synchronous regeneration, and signal forwarding to generate and broadcast signals that closely mimic those of GNSS signals. Spoofing requires less transmission power and is more difficult to detect. It can cause the target receiver to produce inaccurate positioning and timing data, potentially leading to significant safety risks in aviation and maritime contexts, as well as other security-critical sectors. In 2012, ‘a group of researchers from the University of Texas successfully controlled a drone at the White Sands Missile Range in New Mexico, U.S.A., using a spoofing test platform made of computers, external reference clocks, spoofing devices, and transmitting antennas [1]. In 2013, Todd led a spoofing test on the White Rose yacht, installing a Global Positioning System (GPS) spoofing device on the deck, which caused the yacht to deviate from its planned route [2]. In 2017, at least 20 ships near the Black Sea commercial port of Novorossiysk reported anomalies in GPS signals. Although the ships were at sea, their Automatic Identification System (AIS) tracks indicated they were on land, about 32 km inland [3]. Given the growing frequency and severity of spoofing attacks, it is crucial to develop high-precision spoofing detection and direction-finding technologies.

T. Pany et al. [4] and J. Dampf et al. [5] proposed spoofing detection and direction-finding methods based on the synthetic aperture of a moving antenna. However, these methods require antenna movement to achieve direction-finding for the spoofing interference and necessitate additional equipment, such as a turntable, making them costly and not suitable for widespread application. Pengrui Mao et al. [6] proposed a spoofing detection and direction-finding method using low-cost commercial GNSS receivers, which addresses issues such as antenna phase-center instability and inconsistent sampling times among multiple receivers. The direction-finding accuracy of this method can reach 5 degrees. Although low-cost, this method requires complete spoofing of the commercial receivers to enable direction-finding of spoofing, and its sensitivity and accuracy are limited. Huiyun Yang et al. [7] proposed a technique combining long- and short-baseline direction-finding of spoofing which can detect and locate spoofing sources which are weaker than normal satellite navigation signals. However, this method requires the use of a large, dedicated antenna. This paper introduces a novel spoofing detection and direction-finding method using an off-the-shelf anti-jamming array antenna.

To detect spoofing using the off-the-shelf anti-jamming antenna, the spoofing signal must first be separated from the real signal. Current spoofing detection methods include signal characterization [8,9,10,11,12], airspace analysis [13,14,15,16], external information-assisted detection [17,18,19], navigation information authentication [20,21], and machine learning detection [22,23,24]. Machine learning-based spoofing detection methods can reduce dependence on human intervention, adapt to new attack patterns, and achieve high accuracy with low false alarm rates. Among them, References [22,23] used the same seven feature parameters based on Radio Frequency (RF) and tracking phases. Reference [22] employed a spoofing detection model that used a Variational Autoencoder (VAE) and a Generative Adversarial Network (GAN), while Reference [23] utilized a two-stage artificial neural network model. Reference [24] used a Support Vector Machine (SVM) machine learning model with nine feature covariates in the tracking and positioning phases. These methods detect GNSS spoofing by integrating features from the RF capture, tracking, and positioning phases. However, to enable direction-finding and localization of the spoofing sources, it is essential to detect spoofing interference during the capture phase. This allows real signals and spoofed signals to be processed separately during the tracking phase and subsequent phases.

This paper presents a novel GNSS spoofing detection technique based on the LightGBM machine learning method and utilizing 13 features accessible during the receiver’s capture phase. This method can detect spoofing without relying on the tracking and positioning phases. The proposed feature set includes the receiver’s motion state, the number of captured correlation peaks, the average noise level, the captured reference value, the maximum correlation peaks, and ±9 correlation peak sampling values within a single code slice. These features account for factors such as the receiver’s motion state, multiple peaks caused by large delay spoofing, peak distortion from small delay spoofing, and noise increases due to spoofing. The LightGBM method, which supports efficient parallel training, is chosen in this paper. The model is trained using the publicly available TEXBAT dataset to prepare the 13 features for detection. Validation with the TEXBAT test dataset and real-world measured data demonstrates a detection accuracy of up to 97%, offering a highly efficient solution for spoofing detection during the capture phase.

After detecting the presence of spoofing signals among the real signals, a spoofing-direction-finding method can be employed; this paper presents a method, based on the differential phase-center correction technique, for off-the-shelf anti-jamming array antennas. Since the array elements in such antennas typically use conventional microstrip or helical designs, phase-center deviations can be significant, adversely impacting the accuracy of spoofing direction measurements. The proposed differential phase-center correction method effectively addresses both average and instantaneous phase-center deviations, reducing the errors caused by mutual coupling between antenna elements. Real-world tests demonstrate that this approach achieves a spoofing-direction-finding accuracy of up to 1 degree, enabling precise localization of spoofing sources.

The structure of this paper is organized as follows: Section 2 introduces the detection and direction-finding framework, Section 3 outlines the methods and underlying principles, Section 4 presents the experiments and results, Section 5 discusses the proposed method in detail, and Section 6 concludes the paper.

2. Detection and Direction-Finding Framework

Figure 1 illustrates the system architecture presented in this paper, which leverages off-the-shelf anti-jamming array antennas to achieve GNSS spoofing detection and direction-finding. The anti-jamming array antennas receive both real GNSS and spoofing signals. The RF module processes the received navigation signals and outputs intermediate frequency (IF) data. The capture module scans for frequency and code phase to identify and lock onto GNSS signals. The spoofing detection module detects spoofing by analyzing the characteristics of the captured signals. The tracking modules for both spoofing and real GNSS signals ensure continuous and precise synchronization of the spoofing signals and the authentic signals. The spoofing-direction-finding module determines the direction of the spoofing signal and outputs the corresponding results. Finally, the real position calculation module computes the actual position and provides the monitoring station’s real-time location, enabling the localization of the spoofing source.

The RF module, capture module, real signal tracking module, spoofing tracking module, and real position module all utilize mature methods. As shown in Figure 2, the spoofing detection module employs a LightGBM-based detection approach, utilizing 13 features derived from the capture stage, as proposed in this paper. Additionally, the spoofing-direction-finding module utilizes a direction-finding method based on differential phase-center correction, which is also proposed in this paper.

3. Spoofing Detection Method Based on LightGBM

3.1. Capturing Phase Signal Model

In a spoofing environment, the signals received by a GNSS receiver consist of real signals, spoofing signals, and noise. The signal model is expressed as follows:

$$\begin{array}{ccc}s(t)& =& s^T(t)+s^S(t)+n(t)\\ \hspace{1em}& =& {\displaystyle \sum _{i=1}^N{P_i}^T(t)C_i(t-{{\tau }_i}^T)\times D_i(t-{{\tau }_i}^T)\cos (2\pi ({f_i}^T+\Delta {f_i}^T)t+{{\theta }_i}^T)}\\ \hspace{1em}& +& {\displaystyle \sum _{k=1}^m{P_k}^S(t)C_k(t-{{\tau }_k}^S)\times D_k(t-{{\tau }_k}^S)\cos (2\pi ({f_k}^S+\Delta {f_k}^S)t+{{\theta }_k}^S)}+n(t)\end{array}$$

(1)

where $s^T(t)$ is the real GNSS signal, $s^S(t)$ is the spoofing signal, $n(t)$ is the additive Gaussian white noise, $N$ is the number of visible satellites, $i$ is the index for the i-th satellite, ${P_i}^T(t)$ is the real GNSS signal power of the i-th satellite, ${\tau }_i^T$ is the propagation delay of the i-th satellite signal, $C_i(t-{{\tau }_i}^T)$ is the pseudo code sequence of the i-th satellite signal, ${{\tau }_i}^T$ is the propagation delay of the i-th satellite signal, $D_i(t-{{\tau }_i}^T)$ is the data code information modulated by the i-th satellite signal, $f_i^T$ is the intermediate frequency of the i-th satellite signal, $\Delta {f_i}^T$ is the Doppler frequency shift of the i-th satellite signal, ${\theta }_i^T$ is the initial carrier phase of the i-th satellite signal, $m$ is the number of spoofing signals, ${P_k}^S(t)$ is the signal power of the k-th spoofing signal, $C_k(t-{{\tau }_k}^S)$ is the pseudo code sequence of the k-th spoofing signal, ${\tau }_k^S$ is the propagation delay of the k-th spoofing signal, $D_k(t-{{\tau }_k}^S)$ is the data code information modulated by the k-th spoofing signal, $f_k^S$ is the intermediate frequency of the k-th spoofing signal, $\Delta {f_k}^S$ is the Doppler frequency shift of the k-th spoofing signal, and ${\theta }_k^S$ is the initial carrier phase of the k-th spoofing signal.

The coherent integrator output during the capture phase is influenced by the Doppler frequency of the local carrier and the code phase of the local C/A code. The integrator output for the i-th satellite channel is expressed as

$$\begin{array}{c}{y}_i({\tau }_i^l,f_i^l)={\displaystyle \underset{T_{coh}}{\int }s(t)l_i(t,{\tau }_i^l,f_i^l)}dt\\ =\sqrt{P_i^T}{T}_{coh}\sin \mathrm{c}(\pi \Delta f_i^T{T}_{coh})\exp \{j(\pi \Delta f_i^T{T}_{coh}+\Delta {\theta }_i^T)\}\\ \hspace{1em}R({\tau }_i^l-{\tau }_i^T)+\sqrt{P_i^s}{T}_{coh}\sin \mathrm{c}(\pi \Delta f_i^s{T}_{coh})\\ \hspace{1em}\exp \{j(\pi \Delta {f_i}^S{T}_{coh}+\Delta {\theta }_i^s)\}R({\tau }_i^l-{\tau }_i^s)+n({\tau }_i^l,f_i^l)\end{array}$$

(2)

where $\Delta f_i^T$ and $\Delta {\theta }_i^T$ are the frequency difference and phase difference between the real signal of the i-th satellite and the local carrier, respectively; $\Delta f_i^S$ and $\Delta {\theta }_i^S$ denote the frequency difference and phase difference between the spoofing signal corresponding to the i-th satellite and the local carrier. $T_{coh}$ is the coherent integration time; and $R(\tau )$ is the normalized autocorrelation function of the C/A code, expressed as

$$R(\tau )=\left\{\begin{array}{cc}1-\left|\tau \right|,& \left|\tau \right|<1\\ 0,& \mathrm{other}\end{array}\right.$$

(3)

$n({\tau }_i^l,f_i^l)$ represents the correlated noise, which consists of the coherent integration results of noise, real signals from other satellites, spoofing signals, and locally generated signals. It can be expressed as

$$\begin{array}{cc}n({\tau }_i^l,f_i^l)& ={\displaystyle \underset{T_{coh}}{\int }n(t)l_i(t,{\tau }_i^l,f_i^l)}dt+{\displaystyle \sum _{j\ne i}{\displaystyle \underset{T_{coh}}{\int }{s}_j^T(t)l_i(t,{\tau }_i^l,f_i^l)}dt}\\ \hspace{1em}& \hspace{1em}+{\displaystyle \sum _{j\ne i}{\displaystyle \underset{T_{coh}}{\int }{s}_j^S(t)l_i(t,{\tau }_i^l,f_i^l)}dt}\end{array}$$

(4)

where $s_j^T(t)$ and $s_j^S(t)$ represent the real signal and the spoofing signal of the j-th satellite, respectively.

3.2. Feature Extraction

We propose a GNSS spoofing detection method based on 13 features extracted during the capture phase. Details of the extraction methodology are provided below.

3.2.1. Receiver Status

The receiver’s status, whether stationary or moving, influences the frequency domain search during the acquisition phase. Therefore, the receiver’s state is used as one of the features, and referred to as “status”.

3.2.2. Number of Correlation Peaks

In the absence of spoofing, the receiver’s capture result, as shown in Figure 3, exhibits only a single correlation peak.

In a spoofing scenario, when the time delay of the spoofing signal ${\tau }_s$ differs from the time delay of the real signal ${\tau }_a$ by more than 1 chip, a double-peak phenomenon occurs during the capture phase. Figure 4 illustrates the capture result when the time delay difference between the spoofing and real signal is 1.1 chips.

Hence, the number of correlation peaks is selected as one of the features and denoted by “CPN”.

3.2.3. Mean Noise

As seen in Equation (4), spoofing affects the receiver’s noise characteristics. Therefore, the mean noise value over a period of time is selected as one of the features and denoted by “NP”.

3.2.4. Capture Parameter

To determine whether a satellite has been captured, we assess whether the capture parameter exceeds a certain threshold. One type of capture parameter can be expressed as

$$acqPeakMetric={\displaystyle \frac{MaxCorPeak-MeanCor}{StdCor}}$$

(5)

where $MaxCorPeak$ is the maximum value of the correlation peak, $M\mathrm{ean}Cor$ is the mean of all correlation peaks outside the maximum value within one chip, and $\mathrm{Std}Cor$ is the standard deviation of all correlation peaks within one chip around the maximum value. In the presence of spoofing interference, this phenomenon affects both the maximum value of the correlation peak and the noise, thereby impacting the capture parameters. This value is taken as a feature and denoted by “CPM”.

3.2.5. Nine Correlation Peak Sampling Points Within ±1 Chip of the Maximum Correlation Peak Value

When ${\tau }_s-{\tau }_T\le 1chips$, although there is no double peak phenomenon, the captured correlation peaks are distorted due to the superposition of the spoofing. Figure 5 shows the captured correlation peaks with a 0.5 chip delay difference between the spoofing signal and the real GNSS signal. It can be observed that when there is spoofing, the correlation peak will be distorted.

In order to realize the spoofing detection of ${\tau }_s-{\tau }_{\mathrm{T}}\le 1\mathrm{chips}$, nine correlation peaks with chip differences of −1, −0.75, −5, −0.25, 0, 0.25, 0.5, 0.75, and 1 from the maximum correlation peak are selected as nine features. These are denoted by CPV1, CPV2, CPV3, CPV4, CPV5, CPV6, CPV7, CPV8, and CPV9.

3.3. Machine Learning Classifier and Model Training

LightGBM (Light Gradient Boosting Machine) is a framework for implementing the GBDT (Gradient Boosting Decision Tree) algorithm. It supports efficient parallel training and offers advantages such as faster training speed, lower memory consumption, and better accuracy. In this paper, we use the LightGBM method for spoofing detection.

The publicly available dataset TEXBAT [25] was chosen to create the feature dataset for the model. This dataset is widely recognized as an authoritative GNSS spoofing dataset and provides a critical foundation for spoofing detection research. TEXBAT is provided by the Radio Navigation Laboratory (RNL) at the University of Texas at Austin and covers various spoofing scenarios on the civil GPS L1 C/A signal. The dataset is centered around a carrier frequency of 1575.42 MHz, with a bandwidth of 20 MHz, a sampling rate of 25 Msps, and 16-bit data storage.

Table 1. Description of TEXBAT data involved in modeling and training.

Abrv.	Scenario Info	Spoofing Type	Mobility	Power Adv. (dB)	Synchronization	Onset (s)
DS-0	0: Clean-Static	N/A	Static	N/A	N/A	N/A
DS-1	1: Clean-Dynamic	N/A	Dynamic	N/A	N/A	N/A
DS-2	2: Static Overpowered	Time Push	Static	10	Code Phase Prop.	110
DS-3	3: Static Matched-Power	Time Push	Static	1.3	Frequency Lock Mode	120
DS-4	4: Static Matched-Power	Position Push	Static	0.4	Frequency Lock Mod	114
DS-5	5: Dynamic Overpowered	Time Push	Dynamic	9.9	Code Phase Prop.	102
DS-6	6: Dynamic Matched-Power	Position Push	Dynamic	0.8	Frequency Lock Mod	105
DS-7	7: Static Matched-Power	Time Push	Static	Matched	Carrier Phase Aligned	110
DS-8	8: Static Matched-Power	Time Push	Static	Matched	Zero-Delay Security Code Estimation and Replay	110

below presents the TEXBAT data and descriptions used for the model training in this paper.

The TEXBAT data were processed using a MATLAB 2023 MATLAB 2023 version software receiver to generate the datasets. Each TEXBAT dataset lasts approximately 420 s, and a set of feature values was computed every 0.5 s for all visible satellites. Within the time duration in which spoofing was imposed and sustained, the labels for real GNSS signals and spoofing signals were assigned as follows: real signals were labeled as 1, and spoofing signals were labeled as 2. The distribution of real GNSS and spoofing signals in the constructed dataset is shown in Figure 6.

The resulting dataset was randomly divided, with 70% being allocated to the training set and 30% to the test set. The optimization parameters for LightGBM were determined via grid search. The correlations of the selected feature values are shown in Figure 7. The ellipses and colors visually represent the correlations between different features: the orientation of the ellipses indicates the direction of correlation (‘/’ for positive, ‘\’ for negative, and circular for no correlation), the size of the ellipses represents the strength of correlation (larger for stronger, smaller for weaker). As seen in the figure, the selected features are reasonable and exhibit low redundancy.

The Receiver Operating Characteristic Curve (ROC) and Area Under the Curve (AUC) values obtained are shown in Figure 8; AUC = 0.9952.

We applied several kinds of classification assessment criteria to evaluate the performance of the classifiers, including accuracy, precision, recall, and F1-measure. The formulae associated with these criteria are presented in Equations (6)–(9), in which TP is the true positive, TN is the true negative, FN is the false negative, and FP is the false positive.

The confusion matrices for the training and test sets were obtained by calculation and are shown in Figure 9 and Figure 10, respectively. For the test set, the recognition accuracy is 99.32%, while for the training set, the recognition accuracy is 97.15%. The TEXBAT dataset includes various types of spoofing, such as a spoofing signal with higher power than the real signal, carrier phase alignment, frequency locking, etc. The spoofing detection algorithm proposed in this paper effectively distinguishes between spoofing and real GNSS signals.

$$Accuracy={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(6)

$$\mathrm{Precision}={\displaystyle \frac{TP}{TP+FP}}$$

(7)

$$\mathrm{Recall}={\displaystyle \frac{TP}{TP+FN}}$$

(8)

$$F1={\displaystyle \frac{2\mathrm{Pr}ecision\ast \mathrm{Re}call}{\mathrm{Pr}ecision+\mathrm{Re}call}}$$

(9)

Reference [24] proposed a spoofing detection method based on SVM machine learning and utilizing TEXBAT data for both training and validation. The extracted features include nine based on the tracking phase and the solution phase: signal quality metric (SQM), SQM moving mean, SQM moving variance, C/N0 moving variance, pseudo-range Doppler, positioning residuals, velocity residuals, receiver clock offset, and receiver clock offset rate. A comparison of the spoofing detection results for the method proposed in this paper with the results for the method described in Reference [24] is shown in

Table 2. Comparison of the spoofing detection results.

Method	Feature Extraction Phase	AUC	Accuracy	Precision	Recall	F1
Proposed	Acquisition	0.9952	97.15	98.82	96.27	97.09
Ref. [24]	Tracking and PVT solution	0.99	97.02	96.77	97.24	97.00

.

4. Spoofing-Direction-Finding Method Based on Differential Phase-Center Correction

4.1. Analysis of Spoofing-Direction-Finding Errors

Once the real and spoofing signals are identified during the capture phase, both the real GNSS signals and the spoofing signals can be tracked simultaneously. Assuming the spoofing signal is incident on the seven-element array antenna (OABCDFG) from the OE direction, as shown in Figure 11, the carrier phase difference of the spoofing signal, obtained from the array antenna baselines OA, OC, OF, OG, OD, and OB with O as the origin, can be expressed as

$$\left\{\begin{array}{l}\Delta f_{OA}=\lambda /2\cos \phi \sin \theta +{\eta }_{OA}+{\theta }_{OA}+n_{OA}\\ \Delta f_{OB}=2\lambda \cos \phi \sin \theta +{\eta }_{OB}+{\theta }_{OB}+n_{OB}+N_{OB}\times 2\pi \\ \Delta f_{OC}=\lambda /2\sin \phi \sin \theta +{\eta }_{OC}+{\theta }_{OC}+n_{OC}\\ \Delta f_{OD}=2\lambda \sin \phi \sin \theta +{\eta }_{OD}+{\theta }_{OD}+n_{OD}+N_{OD}\times 2\pi \\ \Delta f_{OF}=-\lambda /2\sin \phi \sin \theta +{\eta }_{OF}+{\theta }_{OF}+n_{OF}\\ \Delta f_{OG}=-\lambda /2\cos \phi \sin \theta +{\eta }_{OG}+{\theta }_{OG}+n_{OG}\\ \left(\Delta f_{OA},\Delta f_{OB},\Delta f_{OC},\Delta f_{OD},\Delta f_{OF},\Delta f_{OG}\right) \hat{\mathit{I}} [-\pi ,\pi ]\end{array}\right.$$

(10)

where $\Delta {\varphi }_{OA}$, $\Delta {\varphi }_{OB}$, $\Delta {\varphi }_{OC}$, $\Delta {\varphi }_{OD}$, $\Delta {\varphi }_{OF}$, and $\Delta {\varphi }_{OG}$ are the observed carrier difference values of the spoofing signal between antennas A/B/C/D/F/G and antenna O; and ${\eta }_{OA}$, ${\eta }_{OB}$, ${\eta }_{OC}$, ${\eta }_{OD}$, ${\eta }_{OF}$, and ${\eta }_{OG}$ are the carrier phase differences introduced by the inconsistency of channel group delay between antennas A/B/C/D/F/G and antenna O. The values are independent of the spoofing direction and are fixed values under the stable working conditions of the channel. Values $n_{OA}$, $n_{OB}$, $n_{OC}$, $n_{OD}$, $n_{OF}$, and $n_{OG}$ are the channel thermal noise differences between antennas A/B/C/D/F/G and antenna O, which are influenced by the receiver tracking filter bandwidth and can be effectively reduced by limiting the noise bandwidth. Values ${\theta }_{OA}$, ${\theta }_{OB}$, ${\theta }_{OC}$, ${\theta }_{OD}$, ${\theta }_{OF}$, and ${\theta }_{OG}$ are the carrier phase-center deviations between antenna A/B/C/D/F/G and antenna O. This factor is dependent on the spoofing signal’s incidence direction (i.e., azimuth, elevation) and is a primary contributor to the accuracy of the array’s direction-finding measurements.

The direction-finding baseline shown in Reference [7] consists of O-A-B-C-D, where OD = 4 × OC and OB = 4 × OA. The result of the spoofing signal direction-finding in the OE direction, using the OAC and OBD baselines, can be expressed as

$$\begin{array}{l}{\phi }_{AOC}=a\tan ({\displaystyle \frac{\lambda /2\sin \phi \sin \theta +{\eta }_{OC}+{\theta }_{OC}{+\mathrm{n}}_{OC}}{\lambda /2\cos \phi \sin \theta +{\eta }_{OA}+{\theta }_{OA}{+\mathrm{n}}_{OA}}})\\ {\phi }_{BOD}=a\tan ({\displaystyle \frac{\lambda /2\sin \phi \sin \theta +\frac{{\eta }_{OD}+{\theta }_{OD}{+\mathrm{n}}_{OD}}{4}+\frac{\pi N_{OD}}{2}}{\lambda /2\cos \phi \sin \theta +\frac{{\eta }_{OB}+{\theta }_{OB}{+\mathrm{n}}_{OB}}{4}+\frac{\pi N_{OD}}{2}}})\end{array}$$

(11)

where $\theta$ and $\phi$ are the true pitch and azimuth angle of the spoofing signal. The direction-finding results based on the AOC baseline and BOD baseline are exactly the same when the channel group delay difference, antenna phase-center error, and thermal noise error are all zero. When the above errors are not zero, assuming that the amount of noise, random bias, and antenna phase-center error for each antenna and channel are statistically the same, the measurement error of the BOD baseline is 1/4 of the AOC baseline measurement error. Correspondingly, the direction-finding error can be effectively reduced more than fourfold. However, the distance between antenna B/D and antenna O is twice the wavelength, and the array size for antennas OABCD is much larger than those of traditional anti-interference array antennas (which typically use a half-wavelength array). This size difference limits the applicability of direction-finding of spoofing in certain scenarios.

Assuming the array antennas use five OACFG array elements for the direction-finding solution, with the distance between the AOG and COF baselines being one wavelength, the direction-finding solution equation can be expressed as follows:

$${\phi }_{AOCFG}=a\tan ({\displaystyle \frac{\lambda /2\sin \phi \sin \theta +\frac{{\eta }_{OC}-{\eta }_{OF}}{2}+\frac{{\theta }_{OC}-{\theta }_{OF}}{2}+\frac{{\mathrm{n}}_{OC}{-\mathrm{n}}_{OF}}{2}}{\lambda /2\cos \phi \sin \theta +\frac{{\eta }_{OA}-{\eta }_{OG}}{2}+\frac{{\theta }_{OA}-{\theta }_{OG}}{2}+\frac{{\mathrm{n}}_{OA}{-\mathrm{n}}_{OG}}{2}}})$$

(12)

To ensure the accuracy of the direction-finding of spoofing in the half-wavelength array antennas, it is essential to eliminate antenna phase-center differences, channel inconsistency phase differences, and random thermal noise phase differences between antennas O and A/C/F/G at different elevation angles. Among these three types of noise, the channel inconsistency phase differences between antennas can be effectively calibrated using the signal source and can be ignored once eliminated. The random thermal noise differences between antennas can be minimized by reducing the carrier loop tracking bandwidth. After data smoothing, the angular jitter introduced is less than 1°. The phase-center deviations between antennas constitute the primary factor affecting the accuracy of short-baseline direction-finding. This is largely due to the fact that the antenna elements used in GNSS anti-interference antennas are typically conventional microstrip or helical antennas, the phase-center stabilities of which are usually within λ/10 (approximately 2 cm). The carrier phase measurement variation introduced by the phase deviation of a single antenna (under different incidence azimuths and pitch angles) is approximately 40°, significantly impacting the accuracy of short-baseline direction-finding.

4.2. Array Differential Phase-Center Correction

References [26,27,28] have investigated the phase center of a single antenna, explaining how the antenna phase pattern varies with frequency, pitch angle, and azimuth angle. The International GNSS Service (IGS) has developed both relative and absolute phase-center correction models for antennas. The phase-center correction (PCC) includes the antenna phase-center offset (PCO) and the associated phase-center variation (PCV). When multiple antennas are used in an array, the mutual coupling between the antennas and the edge effects between the antennas and the reflector can further degrade phase-center variations between the array elements. As shown in Equation (12), it is necessary to eliminate the directional measurement deviation $({\theta }_{OA},{\theta }_{OB},{\theta }_{OC},{\theta }_{OD},{\theta }_{OF},{\theta }_{OG})$ in different incident directions to improve the accuracy of spoofing-direction-finding measurements.

A schematic diagram of a differential phase-center array is shown in Figure 12. The reference point positions of antenna O and antenna A are determined by the antenna geometry. The phase center of the array element OA and the differential phase-center of the baseline OA are not fixed points. Even if antenna O and antenna A use the same batch of array elements, their phase centers will deviate due to mutual coupling and scattering between the array elements after grouping.

Assume that the phase-center model for antenna O and antenna A, after grouping, can be expressed as

$$\left\{\begin{array}{l}{x}_{OP}=x_O+x_{O\_PCO}+x_{O\_PCV}(\theta ,\phi )\\ y_{OP}=y_O+y_{O\_PCO}+y_{O\_PCV}(\theta ,\phi )\\ z_{OP}=z_O+z_{O\_PCO}+z_{O\_PCV}(\theta ,\phi )\\ x_{AP}=x_A+x_{A\_PCO}+x_{A\_PCV}(\theta ,\phi )\\ y_{AP}=y_A+y_{A\_PCO}+y_{A\_PCV}(\theta ,\phi )\\ z_{AP}=z_A+z_{A\_PCO}+z_{A\_PCV}(\theta ,\phi )\end{array}\right.$$

(13)

The spatial baseline vector of the differential phase-center of the baseline OA, as formed by antenna O and antenna A, can be expressed as

$$\left\{\begin{array}{l}{x}_{OA}=(x_A-x_O)+(x_{A\_PCO}-x_{O\_PCO})+(x_{A\_PCV}(\theta ,\phi )-x_{O\_PCV}(\theta ,\phi ))\\ y_{OA}=(y_A-y_O)+(y_{A\_PCO}-y_{O\_PCO})+(y_{A\_PCV}(\theta ,\phi )-y_{O\_PCV}(\theta ,\phi ))\\ z_{OA}=(z_A-z_O)+(z_{A\_PCO}-z_{O\_PCO})+(z_{A\_PCV}(\theta ,\phi )-z_{O\_PCV}(\theta ,\phi ))\end{array}\right.$$

(14)

where $(x_A,y_A,z_A)$, $(x_O,y_O,z_O)$ are the installed phase-centers of antenna A and antenna O, respectively. $(x_{O\_PCO},y_{O\_PCO},z_{O\_PCO})$ and $(x_{A\_PCO},y_{A\_PCO},z_{A\_PCO})$ represent the average phase-centers of antenna A and antenna O, respectively.

$(x_{O\_PCV}(\theta ,\phi ),y_{O\_PCV}(\theta ,\phi ),z_{O\_PCV}(\theta ,\phi ))$, $(x_{A\_PCV}(\theta ,\phi ),y_{A\_PCV}(\theta ,\phi ),z_{A\_PCV}(\theta ,\phi ))$ represent the instantaneous phase-centers of antenna A and antenna O, respectively.

$(x_{OA},y_{OA},z_{OA})$ is the differential phase-center vector of the baseline OA.

$(x_A-x_O,y_A-y_O,z_A-z_O)$ is the installed phase-center differential baseline of the baseline OA, which can be obtained directly from the antenna structure installation coordinates. $(x_{A\_PCO}-x_{O\_PCO},y_{A\_PCO}-y_{O\_PCO},z_{A\_PCO}-z_{O\_PCO})$ is the average phase differential baseline of the baseline OA, which is determined by the baseline OA’s average phase-center. $(x_{A\_PCV}(\theta ,\phi )-x_{O\_PCV}(\theta ,\phi ),y_{A\_PCV}(\theta ,\phi )-y_{O\_PCV}(\theta ,\phi ),z_{A\_PCV}(\theta ,\phi )-z_{O\_PCV}(\theta ,\phi ))$ is the instantaneous phase differential baseline of OA, which is determined by the instantaneous phase-center of the baseline OA.

As an example, consider the half-wavelength direction-finding baseline composed of dual antennas. In the case of phase measurement and channel phase deviation calibration, the relationship between the spoofing signal’s incident wavelength difference and the array differential phase-center can be expressed as

$$\Delta P(\theta ,\phi )=(x_{OA}\cos \phi \sin \theta +y_{OA}\sin \phi \sin \theta +z_{OA}\cos \theta ){\displaystyle \frac{2\pi }{\lambda }}$$

(15)

where $\lambda$ is the carrier wavelength of the spoofing signal, and $\Delta P(\theta ,\phi )$ is the carrier phase measurement difference of the OA baseline corresponding to different azimuth angles $\phi$ and elevation angles $\theta$. Let the elevation angle $\theta$ be fixed. When the instantaneous differential phase-center is neglected within the range of $\phi \in [0,2\pi ]$, the incident wave path difference measurement matrix of the spoofing signal can be expressed as

$$\left(\begin{array}{l}\Delta P(\theta ,{\phi }_1)\\ \Delta P(\theta ,{\phi }_2)\\ \Delta P(\theta ,{\phi }_3)\\ \cdots \cdots \\ \Delta P(\theta ,{\phi }_N)\end{array}\right)=\left(\begin{array}{l}\cos {\phi }_1\sin \theta ,\sin {\phi }_1\sin \theta ,\cos \theta \\ \cos {\phi }_2\sin \theta ,\sin {\phi }_2\sin \theta ,\cos \theta \\ \cos {\phi }_3\sin \theta ,\sin {\phi }_3\sin \theta ,\cos \theta \\ \cdots \cdots ,\cdots \cdots ,\cdots \cdots \\ \cos {\phi }_N\sin \theta ,\sin {\phi }_N\sin \theta ,\cos \theta \end{array}\right)\left(\begin{array}{l}{x}_{AO\_PCO}\\ y_{AO\_PCO}\\ z_{AO\_PCO}\end{array}\right)+\left(\begin{array}{l}\cos {\phi }_1\sin \theta ,\sin {\phi }_1\sin \theta ,\cos \theta \\ \cos {\phi }_2\sin \theta ,\sin {\phi }_2\sin \theta ,\cos \theta \\ \cos {\phi }_3\sin \theta ,\sin {\phi }_3\sin \theta ,\cos \theta \\ \cdots \cdots ,\cdots \cdots ,\cdots \cdots \\ \cos {\phi }_N\sin \theta ,\sin {\phi }_N\sin \theta ,\cos \theta \end{array}\right)\left(\begin{array}{l}{x}_{AO\_ARP}\\ y_{AO\_ARP}\\ z_{AO\_ARP}\end{array}\right)$$

(16)

where ${(x_{AO\_PCO},y_{AO\_PCO},z_{AO\_PCO})}^T=AO\_PCO$ is the average phase difference baseline of OA, and it is a value to be estimated. ${(x_{AO\_ARP},y_{AO\_ARP},z_{AO\_ARP})}^T=AO\_ARP$ is the differential phase-center of the baseline OA installation, which is a known value. ${[\Delta P(\theta ,{\phi }_1),\Delta P(\theta ,{\phi }_2),\Delta P(\theta ,{\phi }_3),\cdots \cdots ,\Delta P(\theta ,{\phi }_N)]}^T=P$ is the baseline OA carrier phase measurement obtained from measurements at different incident angles, $\left(\begin{array}{l}\cos {\phi }_1\sin \theta ,\sin {\phi }_1\sin \theta ,\cos \theta \\ \cos {\phi }_2\sin \theta ,\sin {\phi }_2\sin \theta ,\cos \theta \\ \cos {\phi }_3\sin \theta ,\sin {\phi }_3\sin \theta ,\cos \theta \\ \cdots \cdots ,\cdots \cdots ,\cdots \cdots \\ \cos {\phi }_N\sin \theta ,\sin {\phi }_N\sin \theta ,\cos \theta \end{array}\right)=\Psi$ is the wave path difference conversion matrix. Equation (15) can be expressed as follows:

$$P=\Psi \times AO\_PCO+\Psi \times AO\_ARP$$

(17)

The least-squares estimation of the vector $AO\_PCO$ can be expressed as

$$AO\_PCO={({\Psi }^T\Psi )}^{-1}{\Psi }^T(P-\Psi \times AO\_ARP)$$

(18)

where $AO\_PCO$ represents the average value of the differential phase-center. Combined with Equation (14), the instantaneous differential phase of the antenna baseline OA can be expressed as

$$AO\_PCV=P-\Psi \times AO\_PCO-\Psi \times AO\_ARP$$

(19)

where $AO\_PCV$ is the instantaneous deviation after the correction of the differential phase-center, which is related to the incident direction $(\theta ,\phi )$. The instantaneous phase deviation can be fitted and corrected by polynomial fitting.

4.3. Spoofing-Direction-Finding: Half-Wavelength Baseline

Assuming that a four-element circular array antenna is used to complete high-precision direction-finding of spoofing, the array configuration and physical structure are shown in Figure 13.

To achieve high-precision direction-finding of spoofing with a half-wavelength baseline, it is necessary to correct the average differential phase-center deviation $AO\_PCO$ and instantaneous differential phase-center $AO\_PCV$ of antennas AO, BO, and CO. The procedures for calibration and the direction-finding methods are as shown in Figure 14.

The specific calculation steps for calibration and the direction-finding methods are as follows:

• The spoofing sources are placed in different positions $(\phi ,\theta )$, and the measurement matrix $\Delta P(\theta ,\phi )$ of baselines OA, OB, and OC is measured by the receiver.
• Calculate the differential baseline coordinate values of the stage baselines OA, OB, and OC, and $AO\_PCO$, $BO\_PCO$, and $CO\_PCO$ are obtained according to Equation (18).
• Calculate the differential instantaneous corrections and the differential instantaneous correction matrices $AO\_PCV$, $BO\_PCV$, and $CO\_PCV$ related to $(\phi ,\theta )$ according to Equations (18) and (19).
• Generate the average phase-center coordinate vector of the baselines OA, OB, and OC, and construct a differential instantaneous correction matrix $[AO\_PCV,BO\_PCV,CO\_PCV]=PCV$ based on $(\phi ,\theta )$.
• Complete the preliminary measurement $({\phi }_1,{\theta }_1)$ of the direction of the spoofing using the $AO\_PCO$, $BO\_PCO$, $CO\_PCO$ data, combined with Equation (11). The measured value includes the instantaneous differential phase error and can only provide a preliminary directional measurement result.
• Set the incoming wave phase error intervals $\phi \in [{\phi }_1-D_1,{\phi }_1+D_1]$ and $\theta \in [{\theta }_1-D_2,{\theta }_1+D_2]$, discretize the interval with $\Delta \xi$, and calculate the correlation coefficient between the baseline phase difference and the wave path difference of OA/OB/OC using the equation in the next step.

  $$\rho ({\phi }_i,{\theta }_i)={\displaystyle \sum _{n=1}^M\left\{\begin{array}{c}\cos (\Delta P_n({\phi }_i,{\theta }_i)-{\Psi }_n({\phi }_i,{\theta }_i)\times PC{O}_n\\ \hspace{1em}\hspace{1em}-PC{V}_n({\phi }_i,{\theta }_i)-{\Psi }_n({\phi }_i,{\theta }_i)\times AR{P}_n)\end{array}\right\}}$$
  Note that n = 1, 2, and 3, respectively, represent baselines OA, OB, and OC.
• Using $\Delta \xi$ as the step, search and calculate all the correlation coefficients $\rho ({\phi }_i,{\theta }_i)$ in the interval $\phi \in [{\phi }_1-D_1,{\phi }_1+D_1]$, $\theta \in [{\theta }_1-D_2,{\theta }_1+D_2]$ and find the directional value corresponding to the largest correlation coefficient, which is the incident direction of the spoofing signal.

Using the interferometric measurement in step 5, the direction of the spoofing signal can be initially obtained. In steps 6 and 7, a high-precision directional measurement of the incoming wave can be achieved. Considering the varying performance characteristics of the array antennas from different manufacturers, it is essential to perform the corresponding array differential phase-center correction before applying the direction-finding of spoofing to ensure the accuracy and effectiveness of the method.

5. Experiments and Results

5.1. Experimental Scenario

Using the algorithm proposed in this paper, a spoofing detection and direction-finding receiver based on a four-element anti-jamming array antenna was developed. The distribution of the array antennas and the device are shown in Figure 15.

The flow patterns of the four-element array for the spoofing antenna, both before and after average differential phase correction, are shown in

Table 3. Spoofing-direction-finding equipment: 4-element array antenna parameters.

Element Number	X Axis (mm)	Y Axis (mm)	Z Axis (mm)	Explain
O	0	0	0	Reference origin
A	0	84	0	Reference origin
B	−72.7	−42	0	Reference origin
C	72.7	−42	0	Reference origin
OA	9.538	1.25	0.0718	Average differential phase correction
OB	−0.8331	−13.44	130.75	Average differential phase correction
OC	−14.94	7.04	−84.12	Average differential phase correction

.

To verify the effectiveness of the proposed method, a real test environment was set up for experimental validation. The test scenario, depicted in Figure 16, includes a spoofing source, a spoofing transmitting antenna, a spoofing source DC power supply, a spoofing control and display computer, a spoofing detection and direction-finding device, a device DC power supply, a spoofing detection and direction-finding display computer, and two mobile power supplies.

The spoofing source is a generative device capable of adjusting the transmission power and code phase delay of the spoofing signal, as well as setting the position and time offset of the receiver to be deceived.

5.2. Experimental Results

To validate the spoofing detection method proposed in this paper, the transmission power of the spoofing signal was modulated within the range of −70 dBm to −30 dBm, employing an incremental step of 1 dBm. Two types of spoofing were considered: time spoofing and position spoofing. The code phase delay for generating the spoofing signal was varied between 0.5 and 3 chips. At the same time, the authentic signal data of the detection receiver in both moving and stationary scenarios were collected. After each test scenario stabilized, a 2 min test dataset was recorded. In total, 13 features used for spoofing detection were extracted from the test data every 0.5 s, resulting in a total of 12,513 test samples, including 6392 authentic signal samples and 6121 spoofing signal samples. The proposed method was then applied to these data, correctly identifying 12,042 samples with an accuracy rate of 96.24%. The confusion matrix for the measured data is illustrated in Figure 17.

To verify the spoofing-direction-finding method proposed in this paper, the spoofing signal power and chip delay are set to −30 dBm and 1 chip, respectively, while the transmission position is precisely calibrated using the RTK receiver. The incident angle of the spoofing signal is varied in 5-degree steps for each transmission position. The results of the measured path difference and theoretical path length for the spoofing-direction-finding array antenna with different baselines are shown in Figure 18. The horizontal axis represents the incident direction of the spoofing signal, and the vertical axis shows the measured carrier phase difference for baselines OA, OB, and OC in each incident direction.

Performing average differential phase correction on the baselines OA/OB/OC can effectively reduce the instantaneous measurement error of the baseline incident azimuth, as shown in Figure 18.

After correcting for channel deviation, the carrier phase difference trend for each baseline of the receiver closely matches the trend of the incident wave path difference, but there is an azimuth offset and some jitter. In the absence of average differential phase correction, the carrier phase observation error for each baseline, which is caused by antenna element characteristics and mutual coupling between elements, can be obtained by subtracting the measured carrier phase of each baseline from the theoretical wave path difference. As shown in Figure 18, the carrier phase observation error for the antenna baseline OB can exceed 45°, as shown in Figure 19.

After applying the average differential phase correction, the corrected baselines OA/OB/OC can achieve observation errors within 20° for different incident directions. When combined with the short-baseline interferometry method, half-wavelength baseline array spoofing can provide spoofing-direction-finding accuracy within 15°, as shown in Figure 20.

To effectively eliminate the impact of average differential phase error on direction-finding accuracy, the PCV (Phase-Center Variation) parameters for each baseline are derived based on the average phase differential correction results of the baselines OA/OB/OC. The maximum correlation coefficient between the incident direction and the PCV is discretized at regular intervals, allowing for accurate measurement of the incident direction.

In actual experiments, the overall direction-finding error remained within 15° through the average phase-center correction of the array antenna. After performing a second accurate search and correction using the PCV differential phase-center with a 0.5° resolution, the overall direction-finding accuracy was improved to within 1°.

6. Conclusions

To achieve sensitive and high-precision direction-finding for satellite navigation spoofing, it is first essential to detect the spoofing during the capture phase. This paper introduces a GNSS spoofing detection method based on the LightGBM machine learning algorithm, utilizing 13 features from the capture phase. The model has been trained and tested using the authoritative TEXBAT spoofing dataset, achieving a spoofing detection accuracy of over 97% on the test set. Additionally, data from real-world scenarios were acquired to further test and verify the method, which showed a spoofing detection accuracy exceeding 98%. The proposed method efficiently detects various types of spoofing, including large delay, small delay, and synchronous regeneration forwarding, during the capture phase.

This approach significantly reduces the influence of phase-center jitter, introduced by mutual coupling between half-wavelength antenna elements, on direction-finding of spoofing. It enables direction-finding for spoofing jamming using conventional half-wavelength anti-jamming arrays. Experimental verification using measured data was conducted for the proposed technology, with the results demonstrating that the direction-finding method can achieve an accuracy within 1°, enabling high-precision direction-finding of deceptive interference signals by traditional anti-jamming receivers.

Building on the successful spoofing detection in the capture phase, this paper also presents a spoofing-direction-finding method applicable to off-the-shelf GNSS anti-jamming zeroing antennas. By leveraging multi-element carrier phase observations from the array antenna, the differential phase-center is calibrated and corrected, thereby substantially reducing the effect of the phase-center jitter from the mutual couplings between half-wavelength antenna arrays. This allows for effective direction-finding of spoofing with conventional half-wavelength anti-jamming arrays. The experimental results demonstrate that the proposed method achieves direction-finding accuracy within 1°, enabling high-precision direction-finding of spoofing using traditional anti-jamming array antennas in a weak multipath environment. In the future, we plan to establish a typical multipath environment and further explore spoofing-direction-finding techniques in more challenging, stronger-multipath conditions.

The spoofing detection and direction-finding method introduced in this paper can be easily extended and applied to existing GNSS zeroing anti-jamming receivers. It holds significant practical value for direction-finding of spoofing and anti-spoofing applications.