50 100 150 200 250 300 2300 2350 2400 2450 2500 2550 2600 2650 2700 2750 Time [s] Frequency offset [Hz] Measured Doppler shift [Hz ]  Linear approximation Prediction bounds 0 50 100 150 200 250 300 −1000 0 1000 2000 3000 Time [s] Frequency offset [Hz] SV−1 0 50 100 150 200 250 300 −10000 −5000 0 Time [s] Frequency offset [Hz] SV−4 0 50 100 150 200 250 300 0 2000 4000 6000 Time [s] Frequency offset [Hz] SV−7 0 50 100 150 200 250 300 0 1000 2000 3000 Time [s] Frequency offset [Hz] SV−13 0 50 100 150 200 250 300 −4000 −2000 0 Time [s] Frequency offset [Hz] SV−20 0 50 100 150 200 250 300 −1000 0 1000 2000 3000 Time [s] Frequency offset [Hz]  SV−24 0 50 100 150 200 250 300 −4000 −2000 0 Time [s] Frequency offset [Hz]  SV−25 Figure 7: Measured and approximated Doppler frequency shift. Figure 8: Doppler shift attack; unsophisticated adversary. The dotted line represents the predicted and the solid line the measured frequency offset. The Almanac contains approximate position of the satel- lites, ( Xs$_{i}$, Y s$_{i}$, Zs$_{i}$ ), time and the week number ( WN, t ), and the corrections, such that the receiver is aware of the expected satellites, their position, and the Doppler offset. is due to signal variation (including receiver mobility, RF multipath, scattering). Its estimation can serve to deter- mine an acceptable interval around the predicted values. The adversary is mostly at the ground and static or mov- ing with speed that is much smaller than the satellite ve- locity, which is in a range around 3km/s. Thus, the adver- sary will not be able to produce the same Doppler shift as the satellites, unless it changes its transmission frequency to match the one receivers would obtain from GNSS sig- nals due to the Doppler shift. An unsophisticated attacker would then be easily detected. This is illustrated in Fig. 8: After a “gap” corresponding to jamming, there is a striking difference, between 100 and 150 seconds, when comparing the Doppler shift due to the attack to the predicted one. Because of the high carrier frequencies and large satel- lite velocities, large Doppler shifts are produced ( ± 5kHz), and vary rapidly (1 Hz/s). The oscillator of the receiver has frequency shift of ± 3KHz, thus the resultant frequency shift goes therefore up to ± 9KHz. Without the knowledge of the shift, the receiver has to perform a search in this range of frequencies in order to acquire the signal. The rate of Doppler shift receiving frequency caused by the rel- ative movement between GPS satellite and vehicles approx- imately 40 Hz per minute to the maximum. These varia- tions are linear for every satellite. If the receiver is mobile, the Doppler shift variation can be estimated knowing the velocity of the receiver( [3]). In our simulations, Doppler shift is analyzed for each available satellite (number of available satellites varies). To be consistent with results shown for other mechanisms, we present results for DST for the 300sec period. The case of A sophisticated adversary that controls its transmission frequency (the attack starts at 160 s )is shown in the Fig. 9. The adversary has multiple adaptive ra- dios and it operates according to the following principle: it predicts the Doppler frequency shift at the location of the receiver, and it then changes its transmission frequency accordingly. If the attacker is not precisely aware of the actual location and motion dynamics of the victim node (receiver), there is still a significant difference between the predicted and the adversary-caused Doppler shift. This is shown, with a magnitude of approximately 300 Hz, in Fig. 9; a difference that allows detection of the attack. We observe in Fig. 7 the Doppler shift variation based on data collected by an ASHTECH receiver: the maximum change in rate is within + / − 20Hz around a linear curve fitted to the data. This clues that with sufficient samples, the future Doppler Shift rate, and thus the shift per se, values can be predicted. In practice, we observe that 50 sec of samples, with one sample per second, appear to be sufficient. More precisely, the rate of change of the frequency shift, D$_{i}$ ( t ), is computed for each satellite, S$_{i}$ , as: 5 Conclusion r$_{i}$ = dD$_{i}$ ( t ) dt (6) Existing GNSS receivers are vulnerable to a number of attacks that manipulate the location and time the re- ceivers compute. We qualitatively and quantitatively ana- lyze those in this paper, and identify memory-based mech- anisms that can help in securing GNNS signals. In particu- lar, we realize that location-based inertial mechanisms and a clock offset test can be relatively easily defeated, with the adversary causing (through jamming) a sufficiently long period of unavailability. In the latter case, only special- ized highly stable clock hardware could enable detection of fraudulent GNSS signals. Our Doppler Shift Test provides which can be approximated by numerical methods. Based on prior samples for each D$_{i}$ , available for some time win- dow the frequency shift can be predicted based those sam- ples and the estimate rate of change of the Doppler shift. Based on prior measured statistics of the signal at the re- ceiver, the variance σ 2 of a random component, assumed to be N (0 , σ $^{2}$), can be estimated. This random component 7