Research on Multi-Peak Detection of Small Delay Spoofing Signal

With the widespread application of GNSS systems in various fields, the problem of spoofing detection has drawn much attention from the satellite navigation community. The GNSS spoofing interference generally uses fake or replayed satellite signals to make the targeted receivers receive false GNSS signals and reduce the accuracy of calculated position and time information. In order to ensure and improve the security of GNSS services, in recent years, academia and industry have studied the spoofing detection technology from multiple aspects, and many theoretical results have been obtained. This paper starts the analysis from the acquisition phase of a receiver and analyzes the characteristics of the small-delay spoofing signal. Aiming at solving the problem that it is difficult to detect small-delay (0–2 chips) spoofed signals during the acquisition phase, the CNN (Convolutional Neural Network) based method is used to detect the small-delay spoofed signals effectively. According to the experimental simulation results, when the code phase difference between the spoofing signal and the authentic satellite signal is larger than 0.5 code chip, the CNN-based method achieves high detection accuracy. In addition, the algorithm can quickly detect the data without using any additional equipment. Therefore, low complexity is achieved. This makes the algorithm has a good engineering application prospect.


I. INTRODUCTION
With the development of the Global Navigation Satellite System (GNSS), the satellite navigation technology has been widely used in the military and civil fields, including military, aviation, communications, business, and many other fields [1], [2]. Nowadays, the rapid development and popularization of mobile communication, automobile, and other industries have made the GNSS be more deeply integrated into people's daily lives. People enjoy the great convenience brought by the GNSS. The importance of GNSS to the military field is self-evident, and it is an important support for electronic warfare, information warfare, and long-range warfare. Besides, it is one of the most basic and important technical means for the precision strike of missiles and other types of weapons. The GNSS can not only provide positioning The associate editor coordinating the review of this manuscript and approving it for publication was Tawfik Al-Hadhrami . and navigation but also many services, such as accurate time synchronization [1], [3]. In summary, the GNSS has strong application value in many fields, from financial transaction records to military and aerospace applications [4]- [6].
However, with the rapid development of technology, the vulnerability of GNSS signals to interference and spoofing has been gradually exposed. On the one hand, since the signals of navigation satellites are transmitted over a long distance, these signals are extremely weak when they reach the ground, and they are easily affected by interference signals in their frequency bands [7], [8]. On the other hand, because civil signals are publicly used in the international scope, they are not confidential since they are easy to decipher, thus making receivers extremely vulnerable to interference attacks [9].
The GNSS interference technologies generally include suppressing interference, spoofing interference, and others [10], [11]. The suppressing interference is less difficult VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ to implement. The principle is to suppress the reception of the front-end satellite signals by sending a high-power interference signal in the coverage area of a jammer to make it non-working. However, the power required for implement the suppressing interference is too large to be found, and it is easy to find, so its interference source also has the risk of being attacked [12]. The GNSS spoofing can be divided into generative spoofing interference and transponder spoofing interference in terms of the generation mode of spoofing signals. The transponder spoofing interference is realized by recording the authentic satellite signals and transmitting them to the target receiver through a GNSS signal simulator or transponder with a certain delay, thus making the attacked target calculate the wrong position and time information. The realization of the generative spoofing interference is more complex; namely, attackers extract location, time, satellite ephemeris, and other related information from the authentic satellite signals and align false GPS signal carriers with the authentic GPS signals. Then, a GPS spoofing signal, including specific position and misleading time, is generated by a program and transmitted to the target GPS receiver via antenna, thus making the GPS receiver calculate the wrong position and time information. In contrast to the suppressive interference, the spoof interference does not require strong signal transmission power, and can even perform spoofing (such as generative spoofing interference) without relying on the GNSS systems, which is more threatening to the receiver [13]; also, since it can make the user terminal output wrong position and time information without being found, it is most concealing and destructive.
Recent international GNSS spoofing attack incidents have proven the threat of spoofing interference attacks. In 2011, Iranian engineers used the GPS spoofing interference technology to capture the RQ-170 unmanned surveillance aircraft produced by the US military [14]. In 2012 and 2013, the Humphreys team successfully tricked the unmanned helicopter system and positioning navigation device of the ''White Rose'' yacht [15], [16]. In 2017, GPS spoofing interference attacks in the Black Sea caused the GPS positioning system of dozens of ships were out of work. In 2018, the Russian air defense system in Syria found multiple drones approaching Russian military facilities. The Russian military successfully controlled six UAVs approaching Russian military facilities using the ''vehicle yard'' active interference system. These spoofing incidents have further increased our awareness of the potential harm of spoofing attacks.
The high-developing software radio technology has made spoofing interference easier to implement, more flexible and diversified, and less costly. Thus, anti-spoofing is no longer a concern of only military users because civilians can also be highly affected by decreased safety and reliability of GNSS applications caused by spoofing [17]. Therefore, it is crucial to study the GNSS spoofing interference detection technology to ensure the satellite navigation system can provide end-users with normal and safe navigation, positioning, and timing services.
The research of the anti-spoofing interference has been increasing both in the industry and the academia, and the detection technology of spoofing interference has become a research hotspot in the field of satellite navigation. During recent research on GNSS spoofing interference detection, academia has proposed many detection methods from different levels of the receiver.
In [18], it was proposed to use the correlation feature between two receivers to detect spoofing signals. However, this method requires using two receivers. In addition, in the spoofing environment, it is impossible to know the information from which of the receivers is reliable, so the detection performance cannot be guaranteed. Signal power detection technology is also an effective detection method. In this method, the receiver continuously monitors the power-related parameters, which may be abnormal when spoofing attacks are present. The power-related parameters include C/N 0 (carrier-to-ratio) [19], Signal Quality Monitoring (SQM) [20], absolute power [21], and distribution verification of correlator output [22]. These technologies require the receiver to have high precision in measuring the received signal's parameters and complex hardware. In addition, the absolute power detection is easily affected by antenna type, antenna attitude, and multipath, and it requires additional energy detection devices on the receiver side to achieve it. It should be pointed out when the spoofed signal is transmitted together with the noise, the C/N 0 detection method easily leads to misjudgment.
In [23], [24], a GPS spoofing detection scheme based on the direction of arrival was proposed. This scheme judges the arrival angle of signals by resolving the changes of signals of different antennas, to distinguish whether the current target is subjected to GPS spoofing. However, when the target receiver can receive only one or two GPS signals or the GPS spoofing system is deployed in the direction of the satellite-to-target connection, the GPS spoofing cannot be effectively detected by analyzing the direction of arrival of the received signals. Thus, this detection method requires receivers to use multiple antennas, which significantly increases the hardware cost.
In [25], [26], a method for automatic gain control (AGC) detection was introduced. Namely, by delaying and amplifying the spoofing, the mixed noise signal is also amplified, so the AGC gain is quickly reduced. Therefore, the main idea of the AGC detection method is to detect spoofing signal by monitoring this abnormal change. However, the AGC module is expensive, which leads to a decrease in the algorithm value.
A detection method based on the signal arrival time was proposed in [27]. In this method, by detecting the time difference between the times when the signal arrives at the receiver, it is determined whether there is a spoofing signal. The application of this method is limited mainly to forwarding spoofing, which has little effect on generative spoofing signals and can even eliminate authentic signals and retain spoofing signals. In [28], the Doppler frequency shiftbased detection method was proposed. The principle of this method is that when a receiver moves randomly, the Doppler frequency difference between the authentic satellite signals is non-linear in the time domain, while that between spoofing signals is linear. However, this method is only suitable for detecting the spoofing signals transmitted by a single antenna.
In [29], an anti-spoofing algorithm based on a single receiver pseudo-range difference was proposed. This algorithm can be used to detect simple and intermediate spoofing attacks and meaconing attacks. Further, an adaptive spoofing suppression algorithm based on a multi-antenna array was proposed in [30]. This algorithm can adaptively generate zeros using the cross-correlation gain of multi-antenna arrays and suppress multiple spoofing signals simultaneously. In [31], [32], a low-cost inertial measurement unit (IMU) spoofing detection method was proposed. This method judges whether there is a spoofing attack by comparing the consistency of equivalent acceleration and angular velocity. In [33], an innovative INS-assisted spoof monitoring method was presented. The principle of this method is to detect spoofing signals by detecting abnormal measurements of the angular state of aircraft. However, devices such as IMU and INS are expensive and thus are not widely used in civil applications. A spoofing interference detection method based on the S-curve-bias (SCB), which gradually adjusts the dynamic characteristics of the signal, was proposed in [34]. The experimental results have shown that SCB has the potential of detecting spoofing interference. In [35], a detection method based on double-antenna power measurements was proposed. This method can be used in the unsynchronized case.
The multi-peak detection method [36] is applied during the acquisition phase. The principle is to determine the spoofing signals by detecting whether there are two or more correlation peaks in a two-dimensional matrix of the Doppler frequency and code phase. This method is generally applicable to situations where the code phase of the spoofing and authentic satellite signals has a large offset, but when the code phase shift of spoofing signals is small (for instance, less than one chip), the number of peaks cannot be detected effectively.
This paper starts from the multi-peak detection direction, and studies the spoofing detection in the case that the code phase of the spoofed signal differs from that of the authentic satellite signal by 0-2 chips. Based on the idea of deep learning, a convolutional neural network (CNN) is used to detect spoofing signals during the acquisition phase. The experimental simulation results, at the code phase difference between the spoofed and authentic satellite signals of 0.5 chips or more, show that the spoofing signals can be effectively identified.
The rest of the paper is organized as follows. In Section II, the signal model is presented and analyzed. In Section III, a CNN-based GNSS spoofing interference detection algorithm is introduced. The simulation results and performance of the proposed algorithm in detecting spoofing signals are presented in Section IV. The conclusions are given in Section V.

II. SIGNAL MODEL AND ANALYSIS A. SIGNAL MODEL
A general internal structure of a universal GNSS receiver is shown in Fig. 1. In most GNSS receivers, the received RF signal is converted into an intermediate frequency (IF) signal, which is then processed. In the presence of spoofing interference, the received IF signal of a single antenna receiver can be expressed as: In (1), S R (t) denotes the received IF signal, t denotes time in seconds, S T (t) and S S (t) denote the authentic satellite signal and spoofing signal, respectively; n 0 (t) denotes the additive white Gaussian noise (AWGN) with zero mean and variance σ 2 .
The authentic satellite signal can be expressed as: where M represents the number of authentic satellite signals in the received signal, P T i denotes the received power of the i-th signal; C i (t) denotes the spreading code of the i-th satellite, D T i (t) denotes the data bit of the i-th navigation message; f IF represents the IF signal, f T D,i denotes the Doppler frequency of the i-th authentic satellite signal; τ T i represents the code phase of the i-th signal; and lastly, ϕ T i denotes the initial carrier phase of the authentic satellite signal.
The spoofing signal has the same signal structure as the authentic satellite signal, so the spoofing signal can be expressed as: where N denotes the number of satellites included in the spoofing, P s i denotes the received signal's power of the ith satellite, and D s i (t) denotes the ith signal's data bit stream; τ s i denotes the ith signal's code phase, f s D,i denotes the Doppler frequency shift of the ith authentic satellite signal, and ϕ s i represents the initial carrier phase.
Based on (1) and (3), in a spoofing interference environment, the signal received by a receiver represents a mixture of spoofing and authentic signals. In general, spoofing will VOLUME 8, 2020 include most or all the satellites in the authentic satellite. Therefore, in the receiver acquisition and channel tracking, the processed signal actually represents the superposition of authentic and spoofing signals.

B. MODEL ANALYSIS
The transponder spoofing interference principle is to forward the authentic satellite navigation signal to the target receiver with a certain delay and amplification to cause a positioning error. Generally, a large-delay spoofing signal denotes an interfering signal with a delay of more than two chips. This characteristic is used in the multi-peak detection algorithms to detect spoofing signals. When the forwarding delay of a spoofing signal is large, the detection of the forwarding-type spoofing interference is realized by detecting the number of relevant peaks that exceed the capture threshold during the signal acquisition process.
In the capture phase, the multi-peak detection algorithm determines the number of peaks that exceed the preset correlation peak threshold to detect the spoofing. Generally, if there is only an authentic satellite signal in the received satellite signal, there will be only one correlation peak that exceeds the preset correlation peak threshold, as shown in Figs. 2 and 3. In contrast, when a spoofing signal exists, two or more correlation peaks will exceed the preset threshold, as shown in Fig. 4. Accordingly, in the acquisition stage, by detecting the peaks larger than the correlation peak threshold, the presence of a spoofing interference signal can be detected. However, this holds for situations where the phase values of the spoofing interference signal and authentic satellite signal are quite different, i.e., when an offset is two or more chips, as shown in Fig. 5.
When the phase difference between the spoofing and authentic satellite signal is less than two chips, the performance of the traditional multi-peak detection method in identifying the spoofing signal is reduced, especially when the spoofing signal delay is less than one chip. As presented in Fig. 6, when the phase of the spoofing signal differs from that of the authentic satellite signal by one chip, there is only   one peak, so it is more difficult to distinguish whether there is a spoofing signal.
To improve the performance of the multi-modal detection method in the acquisition stage, the CNN-based method is used to detect small-delay spoofing signals.

III. SMALL-DELAY SPOOFING DETECTION METHOD BASED ON CNN
The CNNs have made great success in the fields of image recognition, video recognition, and speech recognition. However, the application of deep learning in the field of navigation signal processing has been relatively rare. In this paper, a CNN-based method that represents a combination of deep learning and satellite communication technology is used to detect the GNSS spoofing signal.

A. ALGORITHM
The GNSS receiver estimates the Doppler shift and pseudo-code phase of satellite navigation signals by searching for correlation peaks in the two-dimensional matrix. In the capture phase, it is more effective to determine whether there is a spoofing signal based on the number of found correlation peaks. However, when the forwarding delay of a spoofed signal is less than two chips, the correlation peaks of the authentic navigation signal and spoofing signal overlap, and generally, only one correlation peak appears, which makes the spoofing detection difficult. Hence, the spoofing signal detection base on the number of correlation peaks is not reliable in all cases. To overcome this problem, a CNNbased method is developed to extract the characteristics of the small-delay spoofing signal from the image field. The flowchart of the proposed algorithm is shown in Fig. 7.

B. DATA PROCESSING
A GNSS receiver that uses the FFT algorithm to capture the IF signal estimates the Doppler shift and code phase of the satellite navigation signal by searching the correlation peaks in the two-dimensional matrix. In this work, the Doppler frequency shift search range is set to [−5 kHz, 5 kHz], and the spoofing signal delay relative to the authentic satellite signal is from zero to two chips. The steps of obtaining the dataset are as follows: • Step 1: Search a two-dimensional matrix A to find peak A peak that is greater than the capture threshold V.   peak A peak to obtain the detection matrix A m×n , as shown in Fig. 8. Among them, m = 4/ f D + 1, n = 4/ T CA + 1, where f D and T CA represent the Doppler frequency shift search step and code phase search step, respectively.
• Step 3: Set all data in matrix A m×n that are below the threshold V to zero to obtain a new matrix Q m×n , as shown in Fig. 9.
• Step 4: Normalize the non-zero data of the newlyobtained matrix Q m×n to obtain the target matrix B m×n VOLUME 8, 2020   and transform it into a gray-scale image, as shown in Fig. 10.
• Step 5: Use the obtained data for CNN training and classification.

C. CNN DETECTION ALGORITHM SETTING
The advantages of convolutional neural networks have widely been studied in the field of deep learning. Their main advantages become even more obvious when the network input is a multi-dimensional image so that the image can be directly used as a network input, thus avoiding complex feature extraction and data reconstruction processes necessary in the traditional recognition algorithms. Therefore, the CNN method can be used to classify data with small differences, which cannot be achieved by using traditional multi-peak detection algorithms. CNNs are mainly trained using gradient descent and back propagation algorithms. The general CNN network structure includes the input layer, convolutional layer, excitation layer, pooling layer, and fully-connected layer, as shown in Fig. 11.
In [37], [38], the operation principles and formulas of CNNs were introduced in detail, so they are not provided in this article in detail. The function of each CNN layer is explained in the following.

1) INPUT LAYER
The input layer is the same as that in the traditional neural network/machine learning. The neural network model requires input data preprocessing for further operations. Common input-layer preprocessing includes averaging, normalization, and PCA/SVD dimensionality reduction. The data has been processed before, and it is normalized here.

2) CONVOLUTIONAL LAYER
The convolutional layer does not recognize the entire picture data simultaneously, but it is the first local perception of each feature in the picture. For a black and white image with only one layer, the convolution process can be expressed as: where x i represents the ith feature map of the convolution layer, K i represents the ith convolution kernel, and b i represents the ith offset parameter. The convolutional layer can effectively extract the features of normal and spoofing signals in the image.

3) INCENTIVE LAYER
The excitation layer performs a non-linear mapping on the output result of the convolution layer using the excitation function after the convolution summation. Commonly used excitation functions include Sigmoid function, Tanh function, ReLU, Leaky ReLU, ELU, and Maxout. In this paper, the ReLU excitation function is used mainly due to its fast iteration speed, simple gradient solution formula, and absence of gradient disappearance and gradient explosion.
Since the picture size considered in this work is small, and the data features are simple, the effect of using the ReLU excitation function is better. The ReLU function is expressed as follows:

4) POOLING LAYER
Pooling is also called subsampling or downsampling, and it is mainly used for feature dimensionality reduction, reduction of the number of data and parameters, overfitting reduction, and model's fault tolerance improvement. Polling mainly includes Maximum Pooling and Average Pooling. In this paper, Maximum Pooling is used.

5) FULLY-CONNECTED LAYER
After convolution, excitation, and pooling layers, the fullyconnected layer is used, which learns high-quality features of an image. In this work, a dropout operation is added before the fully-connected layer to randomly delete some neurons in the neural network to prevent the overfitting. Then, the data of the fully-connected layer are input to the classifier to obtain the classification result. Also, the sigmoid function is used as an activation function, and it is defined as: It should be noted that the convolution number, excitation, and pooling parameters are different for different Doppler frequency shift search step and code phase search step in the two-dimensional search, which will be explained in the next section.
As well-know, the k-nearest neighbor (kNN) is a basic classification and regression method, and it has been commonly used in the image classification field. The main principle of the kNN is to determine the image to be recognized and to find k closest images among all training images based on a certain distance metric, and then, based on the k nearest neighbors' information, determine the most corresponding category as an output result. In this work, the kNN algorithm is used to detect spoofing signals to compare it with the detection effect of the CNN-based method.

A. SIMULATION SETUP
In the simulations, the sampling frequency of the GNSS IF signal was set to 16.367667 MHz, the IF frequency was set to 4.123968 MHz, and the navigation message data were randomly generated. The signal-to-noise ratio of the simulated satellite navigation signal was between -15 dB and -10 dB. The simulated spoofing signal differed from the authentic signal mainly in the Doppler frequency shift, pseudo-code phase, and power. Because it is difficult to keep the spoofed signal accurately synchronized with the authentic satellite signal, in the experiment, the Doppler shift difference changed randomly within the range of ±1 kHz, and the code phase difference varied from 0 to 2 chips. The spoofing signal power was greater than the authentic signal power 1 dB-2 dB. The simulation data in the experiment included 200,000 datasets, which were divided into two categories: • H 0 : 100,000 datasets, including only the authentic satellite signal; • H 1 : 100,000 datasets, including both the authentic signal and the spoofing signal. The H 1 data were further categorized based on the code phase difference T of the spoofing signal and the authentic signal. The value of T changed from zero to two chips with a step size of 0.1 chips. There were 20 categories in total, and each category consisted of 10,000 datasets. Also, 7000 datasets of various data types corresponding to H 1 were combined with 7000 datasets of H 0 data, so a total of 140,000 datasets were used for CNN training, and the remaining 60,000 datasets were used as test data.
In the simulation experiment, the Doppler frequency shift search step was 500 Hz and 250 Hz, respectively, and the code phase search step was 0.5 chip and 0.25 chip, respectively. In the situation, the relevant parameters can be changed VOLUME 8, 2020 according to the acquisition mode of a receiver, and in this work, only the simulation comparative analysis of our settings was conducted.
To evaluate the detection effect, different pseudo-code search steps were used so that the size of the target matrix B m×n also changed. The simulation parameters are presented in Table 1.

B. SIMULATION RESULTS
The accuracy of the spoofing signal detected by the kNN classifier at different Doppler frequency shift search steps and pseudo-code phase search step conditions, when the spoofing signal deviated from the normal satellite signal by different chip amounts, is presented in Fig. 12. As displayed in Fig. 12, as the delay of the spoofing signal increased, the detection accuracy rate also increased. When the delay of the spoofing signal exceeded the value of one chip, the detection probability could reach 100% under different conditions. Thus, the greater the delay of the spoofing signal was, the easier it was to identify it. In addition, with the decrease in the Doppler frequency shift search step and pseudo-code phase search step, the detection probability increased, which conformed with the principle of the receiver's accuracy of signal acquisition; namely, the smaller the search step is, the stronger the signal acquisition capability will be. When the spoofing signal delay was small (e.g., below 0.4 chips), the detection probability of the signal was relatively low, but the overall detection probability was higher than 90%.  The false alarm probability of the kNN algorithm under different conditions is shown in Fig. 13, where as the delay of the spoofing signal increased, the false alarm probability of the kNN algorithm gradually decreased. When the spoofing signal delay was larger than one chip, the false alarm probability was close to zero. When the spoofing signal delay was larger than 0.5 chips, the false alarm probability was below 0.002. When the spoofing signal delay was smaller than 0.5 chips, the false alarm probability was relatively poor. In Fig. 13, the false alarm probability is basically below 0.006, but the green line has a higher false alarm probability. Also, the larger the chip offset of the spoofing signal is, the lower the false alarm probability is, and the easier it is to detect spoofing interference.
The accuracy of the spoofing signal detected by the CNN classifier under different Doppler frequency shift search steps and code phase search step conditions, when the spoofing signal deviated from the normal satellite signal by a different number of chips, is presented in Fig. 14. As shown in Fig. 11, as the chip offset gradually increased, the detection probability gradually increased. When the spoofed signal was shifted from the normal satellite signal by less than 0.4 chips, the detection probability was relatively low. When the time delay of the spoofing signal was larger than 0.4 chips, the accuracy of CNN's recognition of the spoofed signal was higher than 96%, and as the Doppler frequency shift and the code phase search step decreased, the detection probability gradually increased; the detection probability even reached 100% when the time delay of the spoofing signal was 0.5 chips. This result shows that when the code phase difference between the spoofing signal and the authentic signal is small, the CNN achieves poor performance in the spoofing signal recognition. This is mainly because when the chip offset is too small, the peak values of the spoofing and authentic signals almost overlap, so it is difficult to identify them. On the other hand, when the delay of the spoofing signal is small, the chip offset is directly missed due to the large step size of the code phase search. The combination of these two results in low detection probability.
The false alarm probability of the CNN algorithm under different conditions is presented in Fig. 15. As shown in Fig. 15, when the delay of the spoofing signal increased, the false alarm probability of the CNN algorithm decreased. When the spoofing signal delay was above 0.5 chips, the false alarm probability was close to zero. The false alarm probability was relatively poor when the spoofing signal delay was less than 0.5 chips, which indicated that the smaller the chip delay of the spoofing signal was, the greater the probability of false alarm was, and the larger the chip delay of the spoofing signal was, the smaller the false alarm probability and the higher the detection probability were, thus the spoofing signal was easier to detect. This result is consistent with the results in Fig. 14. In addition, the results presented in Figs. 12 and 14 show that the detection probability of the kNN was slightly higher than that of the CNN, but the detection probabilities of the two algorithms were very close, and their performances were relatively similar. In order to evaluate the performance of the proposed CNN-based detection methods further, the two detection methods were compared from another point of view.
The detection probabilities of the two methods at the same Doppler frequencies of the spoofing and authentic signals are given in Table 2. As presented in Table 2, at different search step values, the CNN and kNN methods had the detection probabilities of more than 96%, which demonstrated high effectiveness of both methods in the spoofing signal identification. The time-consuming statistics of the CNN and kNN methods for a single dataset detection under different conditions are presented in Table 3. In Table 3, it can be seen that at the constant Doppler frequency shift search step, when the code phase search step decreased, the detection time of the CNN and kNN also increased. In addition, at the constant dimension, even when the delay time of the spoofing signal changed, the detection times of the two algorithms were similar. However, under the same conditions, the time taken by the CNN to detect a single set of data was much shorter than that of the kNN. This was mainly because the CNN could directly recognize the new data by the trained model without the need for additional training steps. In contrast, the kNN needed to calculate the distance between unknown samples and all known samples for each data classification. Besides, the larger the data dimension and the larger the data amount were, the lower the data processing efficiency of the kNN, and the higher its computational complexity were. Moreover, as the computing power of the chip increases, the detection time will continue to decrease. Thus, when the kNN TABLE 3. Detection probability of the k NN and CNN at the same doppler frequency. VOLUME 8, 2020 method is used to detect and deceive signals, a compromise must be considered in terms of detection accuracy, detection time, and computational complexity. Compared with the kNN, the application of CNN algorithm is more feasible in engineering practice.

V. DISCUSSION
Since the spoofing signal is transmitted by the deceptive equipment after a series of processing, it is different from the authentic satellite signal in the path and delay, so it is difficult to achieve accurate synchronization with the authentic satellite signal, which makes it impossible for the spoofing signal to have a 0 chip delay. In addition, if there is such a special delay of 0 chip, the identification with CNN algorithm will not get good results, which requires the additional detection method of signal power to achieve.
In order to achieve the effect of deception, the power of the spoofing signal must be higher than that of the authentic satellite signal, so whether there is deception interference can be judged by the value of the peak value A 2 . If A 2 is less than the threshold ρ 1 , the signal has not been searched; if A 2 is greater than the threshold ρ 1 and greater than the threshold ρ 2 meanwhile, the signal in search cell is the authentic signal; if A 2 is greater than the threshold ρ 2 , it is determined that the signal in search cell is a spoofing signal. Among them, ρ 1 is the capture threshold and ρ 2 is the maximum acquisition credible threshold. With the help of CNN detection algorithm, the detection of 0-chip delay spoofing signal can be realized.
In the future, our research will be implemented in a real software receiver system in the following ways: Firstly, in normal environment and environment with deception, a large number of two-dimensional search matrix data including authentic signals and spoofing signals are collected respectively in the receiver. Secondly, the target data set is obtained by processing the obtained data, which is trained to obtain the training model. Finally, the trained model is embedded into the receiver software system to detect deception signals. According to this method, our subsequent work will be implemented in a real software receiver system to verify its detection performance.

VI. CONCLUSION
This paper studies the detection of a small-delay spoofing signal in the acquisition phase based on deep learning. Through the analysis of the signal model and principles of the GNSS system in the acquisition stage and the two-dimensional search matrix processing in the acquisition stage, the spoofing signal recognition in the GNSS system is respectively realized by the kNN and CNN methods. The experimental results show that both methods achieve better detection effect when the code phase shift between the spoofing and authentic signals is equal to or larger than 0.5 chips. The validity of the proposed CNN-based detection method is verified by the experiment and simulation. In the case of a small-delay spoofing signal, the accuracy of the kNN is slightly higher than that of the CNN, but on the whole, the detection results of the two algorithms are relatively similar. However, the kNN has higher complexity, so the CNN method can be considered as more suitable for engineering applications.
The experimental results show that when the spoofing signal delay is small, the detection probabilities of the kNN and CNN are low, while the probabilities of false alarm are high. This is mainly because the correlation peak of a small-delay spoofing signal is relatively close to the correlation peak of the authentic signal, and the correlation peak of the real signal is even superimposed on all of them. When either CNN or kNN method is used for spoofing signal detection, the characteristic of the peak number in the image is not obvious, so an effective spoofing signal identification is impossible.
It should be noted that the proposed CNN-based spoofing signal detection method is in the phase of theoretical analysis and research, and the actual testing and verification in the software receiver system will be part of our future work. From 2017 to 2019, he worked as a Postdoctoral Researcher with Hi-Target Surveying Instrument Company Ltd., and Wuhan University. He is currently an Assistant Professor with the School of Electronics and Communication Engineering, Sun Yat-sen University. He is mainly involved in the theory of GNSS/SBAS precise data processing, real-time PPP, multi-sensor navigation data fusion, and the algorithm and software development. VOLUME 8, 2020