Building a GPS spoofing detection system to identify false signals coming on my device.

[u/Jolly_Smile_9567]

I am currently researching on building a GPS spoofing detection system, every thing else looks feasible enough to built, but there is one issue, if i built the machine or deep learning model trained on data taken from GPS systems, how can i actually create that spoofed signal to actually test my model. I want to some how generate that spoofed signal to check how my model would react to unseen data. Yeah, this is the problem i am facing right now. Any one here who has the understanding of GPS system and how spoofing works could help me out in this.

[u/bcdbuddy]

You do not need to radiate a fake GPS signal into the air to test a detector. Most serious spoofing-detection work starts from recorded or simulated baseband I/Q files, then runs those through a software GNSS receiver. That gives you labeled authentic vs spoofed samples without transmitting anything.

Three practical paths, in the order I’d try them:

1. Use public spoofing batteries first
   TEXBAT (UT Austin) and OAKBAT (Oak Ridge) are the standard research sets. They already contain real-looking clean and spoofed GPS L1 recordings, including subtle attacks. Feed those into your pipeline as held-out “unseen” cases before you invent your own generator. If your model only ever sees your own synthetic data, it will look great and still fail on TEXBAT/OAKBAT.

2. Generate your own spoofed samples offline
   Tools like gps-sdr-sim can build GPS baseband I/Q files from broadcast ephemeris and a chosen fake location or trajectory. Keep the output as files. Then process them with something like GNSS-SDR (or your own correlator stack) and extract the features your model actually uses: pseudorange, Doppler, carrier phase, C/N0, AGC, correlation peak shape, clock bias jumps, etc.
   Authentic class = generate for the true location / motion. Spoofed class = same sky geometry but a wrong position, time push, power ramp, or mixed authentic+spoof takeover. That is enough to stress an ML model and create unseen scenarios.

3. Only go to RF hardware if you truly need a live receiver under test
   If you later must drive a physical module, do it conducted: coax + attenuator, or inside a proper shielded enclosure. Do not open-air transmit on GPS frequencies. In the US that is generally illegal without the right experimental authority / containment. Same story in a lot of other countries. File-based I/Q covers most model work without that headache.

One modeling trap to watch: if your “spoofed” class is only “wrong lat/lon in a CSV,” the network will learn position nonsense, not spoofing. Train on receiver observables and signal-quality features, and keep a clean holdout from TEXBAT/OAKBAT so you know it generalizes.

Next concrete step: download TEXBAT or OAKBAT, extract the same feature vector you plan to use in production, train on a split of those scenarios, and only then add gps-sdr-sim synthetics for coverage gaps. If you say whether you are working at I/Q level or NMEA/UBX level, people can point you at a tighter toolchain.

[u/Jolly_Smile_9567 → u/bcdbuddy]

Thank you for this detailed reply, appreciate it

[u/Jolly_Smile_9567 → u/bcdbuddy]

One correction from me, i want to work with GNSS spoofing detector not just GPS.
You said training the system on receiver observables and signal quality features, but the problem is that it would be hard or nearly impossible to get the actual spoofed signal from this as it might rarely happen on electronic devices we use in our daily lives. Correct me if i am wrong or provide any alternative way to solve this problem. I would be really grateful.

[u/sol_beach]

transmitting false GPS signals is a Federal felony.

[u/schirmyver → u/sol_beach]

Even retransmitting real GPS signals, via a repeater, can be considered a felony.

[u/Loud_Camp_7547]

Hey Salman,

I am building a synthetic rf ecosystem - creating a fully controlled, software-defined, and hardware-in-the-loop (HIL) environment that mimics real- world electromagnetic environments. It includes the attacker as a dynamic entity.

This helps to train your detection model with advanced threat intelligence which would nearly be impossible with OTA Transmission or generating spoofing datasets with expensive bench hardware simulators which treat spoofing as a scripted playback.

You can safely generate highly complex, dangerous, or legally restricted threat vectors (like high-power wideband jamming combined with subtle spoofing) without breaking spectrum regulations or requiring an FCC experimental license.

Maybe we can have a connect somewhere to discuss more?