Spoofing is becoming a serious threat to various Global Navigation Satellite System (GNSS) applications, especially for those that require high reliability and security such as power grid synchronization and applications related to first responders and aviation safety. Most current works on anti-spoofing focus on spoofing detection from the individual receiver side, which identifies spoofing when it is under an attack. This paper proposes a novel spoofing network monitoring (SNM) mechanism aiming to reveal the presence of spoofing within an area. Consisting of several receivers and one central processing component, it keeps detecting spoofing even when the network is not attacked. The mechanism is based on the different time difference of arrival (TDOA) properties between spoofing and authentic signals. Normally, TDOAs of spoofing signals from a common spoofer are identical while those of authentic signals from diverse directions are dispersed. The TDOA is measured as the differential pseudorange to carrier frequency ratio (DPF). In a spoofing case, the DPFs include those of both authentic and spoofing signals, among which the DPFs of authentic are dispersed while those of spoofing are almost overlapped. An algorithm is proposed to search for the DPFs that are within a pre-defined small range, and an alarm will be raised if several DPFs are found within such range. The proposed SNM methodology is validated by simulations and a partial field trial. Results show 99.99% detection and 0.01% false alarm probabilities are achieved. The SNM has the potential to be adopted in various applications such as (1) alerting dedicated users when spoofing is occurring, which could significantly shorten the receiver side spoofing cost; (2) in combination with GNSS performance monitoring systems, such as the Continuous Operating Reference System (CORS) and GNSS Availability, Accuracy, Reliability anD Integrity Assessment for Timing and Navigation (GAARDIAN) System, to provide more reliable monitoring services.

The vestigial signal defense (VSD) method is widely used for detecting intermediate spoofing attacks via monitoring the vestigial signals within the receiver. It is popular and promising for two reasons. One is that it is one of the most effective methods against intermediate spoofing attacks unless the spoofer could suppress the authentic signals. The other is that it is easy to implement as it is totally softwaredefined and receiver-autonomous. Though VSD is promising, it can be vulnerable to spoofing signals with strong strength. Because the strong spoofing signals can significantly lift the receiver noise floor and reduce the vestigial signal to interference and noise ratio (SINR) to below the SINR detection threshold, preventing the vestigial signal from being detected. To low-costly address this issue, this paper firstly investigates the effect of spoofing strength on the availability of VSD on the basis of vestigial SINR model. Then, the improvement scheme is proposed based on the investigation, which is low-cost but effective. As shown by the rigorous analysis, the noise floor would be considerably increased and the vestigial SINR would fall below the SINR detection threshold, even when the spoofing signals are not much stronger. However, if the receiver is able to extend integration time and roughly estimate the noise floor, the VSD can be more robust to much stronger spoofing signals.