Spoofing attacks pose a clear cybersecurity risk for all systems relying on Global Navigation Satellite Systems (GNSS) for time synchronization or positioning. Secure Code Estimation and Replay (SCER) spoofing attacks are the most challenging type of spoofing attacks, as these may be problematic even for future GNSS protection systems, like Navigation Message Authentication (NMA) or Spreading Code Authentication (SCA). This is one of the reasons that make the development of complementary protection techniques, like the one proposed in this work, necessary In the first part of the paper, the spoofing SCER attacks are analyzed in detail for GPS and, particularly, for Galileo. The role of the Galileo Pseudorandom Noise (PRN) intra-satellite non-orthogonality distortion term in hindering the attacks is discussed and a detailed comparison between GPS and Galileo expected quality curves for the SCER attack is provided A complementary detection method for end-user receivers (assuming NMA is used) against SCER attacks is proposed, based on the application of machine learning and a proposed set of features extracted from the receiver search space, assuming the attacker was not able to null the satellite signal.

Spoofing attacks pose a significant security risk for organizations and systems relying on global navigation satellite systems (GNSS) for their operations. While the existing spoofing detection methods have shown some effectiveness, these can be vulnerable to certain attacks, such as secure code estimation and replay (SCER) attacks, among others.This paper analyzes the potential of satellite fingerprinting methods for GNSS spoofing detection and benchmarks their performance using real (in realistic scenarios by using GPS and Galileo signals generated and recorded in the advanced GNSS simulation facility of DLR) GNSS signals and scenarios. Our results show that our proposed fingerprinting methods can improve the detection accuracy of the existing methods and can be coupled with other techniques to enhance the overall performance of the detection systems, all based on relatively simple metrics. In this paper, we compare the performance of several fingerprinting methods, including those from the existing literature (based on signal Gaussian properties of the signal complex envelope, energy and in-phase symbol dispersion) and one proposed in this paper, based on the satellite instrumental delay. The innovation of this work is a new jamming and spoofing complementary detection technique, based on fingerprinting and machine learning, including a new fingerprinting metric (based on the satellite instrumental delay).

In the current geopolitical situation, the disruption and falsification of GNSS (Global Navigation Satellite Systems) signals poses a severe threat for the defence operations of the European Union (EU) and NATO, and puts civil operations, like airlines and maritime operators, in danger. Several areas in the world are experiencing this problem in almost a continuous manner over the last few months (e.g., East border of the EU and Middle East, among others). This paper discusses the work performed by the Universidad Politécnica de Madrid (UPM) and DLR GfR mbH in the field of detection and protection of attacks to GNSS signals for critical infrastructure, developing technologies that were applied in ESA (European Space Agency) projects like RESIST, for worldwide detection of GNSS Spoofers and Jammers. This paper will discuss the results of the application of the AI-based developed systems CMCU (Central Machine Learning Unit) and RESIST to different fields and projects. A brief discussion on new techniques developed on top of these two is outlined.

Global Navigation Satellite System(s) (GNSS) are critical enablers for applications such as aviation, telecommunications, power grid synchronization, and land navigation. However, their increasing ubiquity also exposes them to sophisticated threats, particularly signal spoofing attacks. Galileo, the European GNSS, has introduced the Open Service Navigation Message Authentication (OS-NMA) mechanism, which enables cryptographic validation of navigation messages. This thesis focuses on developing advanced spoofing protection methods that leverage this authentication capability. The main objectives of this research are: to assess the role and effectiveness of Galileo OSNMA against advanced attacks such as Secure Code Estimation and Replay (SCER) (when integrated with signal-domain analysis), machine learning, and fingerprinting techniques in realistic spoofing scenarios; to investigate the use of artificial intelligence for automated spoofing detection; and to assess the viability of satellite-based detection techniques for real-time spoofing identification. Key findings include evidence that OS-NMA, when combined with signal analysis and machine learning algorithms, significantly enhances spoofing detection performance. Two experimental units (CMCU (Central Machine Learning Computation Unit) and CFCU (Central Fingerprinting Computation Unit)) were developed to process GNSS signals and detect spoofing from both ground-based and space-based perspectives. Additionally, the concept of a spaceborne monitoring system named RESIST (RF analytical Evaluation of Signal In Space Threats) was introduced, under contract with the European Space Agency (ESA), enabling global detection of spoofing attacks via onboard sensors. In conclusion, this thesis demonstrates that navigation message authentication, together with modern signal analysis and AI techniques, can provide a robust and scalable framework for spoofing detection in Galileo. The proposed solutions are suitable for both conventional GNSS receivers and spaceborne platforms, contributing meaningfully to the security and resilience of navigation services. RESUMEN Los sistemas globales de navegación por satélite (GNSS) son fundamentales en aplicaciones críticas como la aviación, las telecomunicaciones, la sincronización de redes eléctricas y la navegación terrestre. Sin embargo, su creciente adopción también los expone a amenazas cada vez más sofisticadas, especialmente a ataques de suplantación de señal (spoofing). Galileo, el sistema europeo de navegación por satélite, ha introducido un mecanismo de autenticación de mensajes de navegación (OS-NMA) que proporciona capacidades criptográficas para validar la autenticidad de los datos de navegación. Esta tesis se centra en el desarrollo de métodos avanzados de protección frente al spoofing que aprovechan dicha autenticación. Los objetivos principales de esta investigación son: evaluar el papel y la eficacia del servicio Galileo OS-NMA frente a ataques avanzados como Secure Code Estimation and Replay (SCER), asumiendo que se integra con técnicas de análisis en el dominio de la señal, aprendizaje automático y fingerprinting en escenarios realistas de spoofing; investigar el uso de la inteligencia artificial para la detección automática de ataques de spoofing; y evaluar la viabilidad de técnicas de detección basadas en satélites para la identificación de ataques de spoofing en tiempo real. Entre los principales hallazgos se incluye la demostración de que el OS-NMA, si se combina con análisis de señales y algoritmos de aprendizaje automático, mejora significativamente la capacidad de detección de ataques de spoofing. Se desarrollaron dos unidades experimentales(CMCU (Central Machine Learning Computation Unit) y CFCU (Central Fingerprinting Computation Unit)) capaces de procesar señales GNSS y detectar suplantaciones tanto en tierra como desde el espacio (en el caso del CMCU). También se exploró el concepto de un sistema de monitorización espacial llamado RESIST (RF analytical Evaluation of Signal In Space Threats), bajo contrato con la Agencia Espacial Europea (ESA, European Space Agency), que permitiría detectar ataques de spoofing a nivel global mediante sensores embarcados. En conclusión, esta tesis demuestra que la autenticación del mensaje de navegación, junto con técnicas modernas de análisis de señal y aprendizaje automático, puede ofrecer un marco sólido y escalable para la detección de ataques de spoofing en Galileo. Las soluciones propuestas podrían aplicarse tanto en redes de detección en tierra (CMCU), combinando detección en la superficie terrestre y en el espacio (LEO, Low Earth Orbit) y también potencialmente en receptores GNSS tradicionales (CFCU).