An Interpretable Ensemble Learning Method for GPS Spoofing Detection with Feature Selection

1. Introduction

GPS has become an indispensable component of modern navigation infrastructure, serving critical applications across civil aviation, unmanned aerial systems (UAS), autonomous maritime vessels, and consumer mobile devices [1,2,3]. The reliability and integrity of GPS-derived positioning information are paramount, as spoofing attacks that manipulate authentic satellite signals can induce catastrophic consequences, including aircraft misnavigation, unauthorized drone diversion, and maritime collision incidents. Consequently, the development of robust GPS spoofing detection mechanisms has emerged as a research priority of substantial significance within the remote sensing and navigation communities. This research domain has attracted considerable scholarly attention in recent years, with numerous methodological advances documented in the literature [4]. The practical applicability of effective anti-spoofing solutions is widely recognized, given their potential deployment across safety-critical transportation systems. Furthermore, GPS signal authentication and anomaly detection constitute an increasingly established research paradigm, supported by both theoretical frameworks and empirical validations.

As illustrated in Figure 1, GPS positioning fundamentally relies on the simultaneous reception of signals from multiple satellites (typically four or more), whereby the receiver calculates its three-dimensional position through trilateration based on signal propagation time measurements [5,6,7,8]. In a spoofing attack scenario, an adversarial transmitter deliberately broadcasts counterfeit GPS signals that mimic authentic satellite transmissions, thereby deceiving the target receiver into computing erroneous position, velocity, and time solutions. The spoofer, as depicted in the Figure 1, emits malicious signals (represented by red dashed lines) that compete with or overwhelm legitimate satellite signals (represented by blue solid lines) received by the aircraft. Such attacks can be categorized into simplistic, intermediate, and sophisticated variants, distinguished by their signal generation complexity and synchronization accuracy with authentic satellite constellations.

1.1. Related Work

To address the vulnerability of GPS signals to spoofing interference, extensive research efforts have been undertaken, encompassing signal processing-based techniques, machine learning classifiers, and hybrid detection frameworks. Previous investigations have demonstrated the efficacy of various approaches, including power monitoring, signal quality metrics, cryptographic authentication, and data-driven anomaly detection methodologies.

1.1.1. Signal Processing-Based Techniques

In the domain of signal processing-based techniques, Fan et al. [9] propose a spoofing matching algorithm to identify GPS deception. Numerical simulations are conducted within test scenarios, demonstrating the effective identification of Global Spoofing Attack (GSA) locations and the recovery of GPS pseudo-synchronous phasor data, which subsequently refines GPS state estimation results. Kwon et al. [10] leverage accelerometers within an Attitude and Heading Reference System (AHRS) to directly detect GPS spoofing interference. The detection performance of this approach is analyzed using corresponding Probability Density Functions (PDFs), wherein the magnitude of acceleration error serves as the decision variable for calculating the probability of spoofing. Basan et al. [11] design a spoofing detection methodology utilizing Kullback–Leibler divergence, integrated with essential analytical parameters and data normalization. This strategy mitigates the reliance on extensive prior data, a common constraint in traditional detection schemes.

1.1.2. Machine Learning-Based Classifiers

Within the sphere of machine learning, advancements in semantic segmentation [12], multi-class classification [13], and ensemble learning [14] have significantly propelled the development of GPS spoofing detection. For instance, Wei et al. [15] selected specific flight data types—encompassing altitude and horizontal position control processes—as feature inputs. Multiple algorithms are employed to train and generate CONSTDET, a classifier tailored for GPS spoofing attacks. Bose and Sam [16] adopt supervised machine learning techniques, utilizing GPS observable features such as pseudorange, carrier phase, Doppler shift, and carrier-to-noise density ratio ($C/N_0$) to discriminate between authentic and forged signals. Comprehensive investigations are performed regarding network architecture, training sample size, the number of hidden layers, neuron distribution across layers, and the total count of hidden neurons. Acknowledging that conventional machine learning methods often exceed the computational constraints of small UAVs, Ren et al. [17] propose a lightweight detection model based on Long Short-Term Memory (LSTM) networks deployed at the ground control station. Through knowledge distillation, this model is compressed into a parameter-efficient variant capable of operating within UAV onboard control systems, with experimental results validating its feasibility.

1.1.3. Hybrid Detection Frameworks

In the context of hybrid detection frameworks, Meng et al. [18] address GPS attacks targeting UAV swarms by combining swarm collaborative positioning with a security machine optimal marking mechanism, yielding a detection method characterized by high real-time performance. Song et al. [19] introduce a hybrid spoofing detection approach that fuses Temporal Convolutional Networks (TCN) with Kalman Filters. This integration alleviates Inertial Navigation System (INS) error drift and generates virtual GPS trajectories, thereby establishing correlations across continuous time windows. Consequently, the mechanistic capabilities of INS-aided GPS spoofing detection are enhanced, and challenges related to strain positioning in GPS signal reconstruction are resolved. Meanwhile, observer-based hybrid diagnosis methods [20] can also be employed in GPS attacks detection. Furthermore, Kuriş et al. [21] contribute to the comparative analysis of hybrid methodologies by providing a detailed performance evaluation of LSTM, Gated Recurrent Unit (GRU), and hybrid LSTM–GRU deep learning models applied to GPS spoofing attack detection.

1.2. The Gap in the Literature and the Contribution of This Study

However, existing detection methods frequently exhibit limitations in generalization capability across diverse attack scenarios and operational environments, while the interpretability of deep learning-based detectors remains insufficiently explored. These gaps motivate the extension of current methodologies through ensemble learning architectures that integrate complementary model strengths with explainable artificial intelligence principles.

Overall, in this paper, we develop a robust ensemble learning framework for GPS spoofing detection, integrating deep learning attention mechanisms with interpretable feature selection. The following three aspects describe the primary contributions of this study.

(1)

A novel stacked ensemble learning framework tailored for GPS spoofing detection is proposed. Considering the complexity of signal features in spoofing scenarios, we integrate the attention-based TabNet network with traditional tree-based models within a stacking architecture. The newly proposed Stack-TabNet model dramatically improves the detection robustness and saves computing resources compared to standalone deep learning models. Therefore, our proposed ensemble method has significant performance improvement compared with traditional machine learning methods.

(2)

We introduce a comprehensive interpretability analysis for GPS spoofing detection models. For the first time in this context, we employ SHapley Additive exPlanations (SHAP) to decode the decision-making process of the TabNet-based ensemble. A total of 13 signal features are analyzed, which can be used to study the physical characteristics distinguishing spoofed signals from authentic ones. It is worth mentioning that the interpretability analysis is conducted in real-world navigation scenarios, which is a challenging process due to the high dimensionality of signal data. In addition, visualizing feature contributions is a critical task due to the safety-critical nature of aviation navigation systems.

(3)

Through SHAP-guided feature selection, a refined detection variant is developed to reduce model complexity and improve computational efficiency. By retaining only the most informative features, the training process becomes less dependent on high-dimensional inputs, which is particularly advantageous for real-time GPS monitoring applications. Experimental results demonstrate that our optimized method named Stack-TabNet-2 can improve the classification accuracy of the full-feature model with only the top 8 features and can exceed the classification effect of traditional supervised learning baselines while minimizing computational overhead.

The remainder of this paper is organized as follows: Section 2 presents dataset and proposed methodology in detail. Section 3 reports experimental results and comparative analyses. Section 4 discusses the implications and limitations of this work. Finally, Section 5 concludes the paper and outlines future research directions.

2. Materials and Methods

The systematic workflow for the proposed GPS spoofing detection methodology is illustrated in Figure 2. The research pipeline is partitioned into four primary functional modules, which facilitate a transition from raw signal acquisition to an optimized, interpretable detection architecture.

As depicted in Figure 2(a), the initial phase involves the acquisition of 13-dimensional GPS signal features and subsequent pre-processing. To address the inherent class imbalance between authentic and spoofed instances, an under-sampling strategy is executed to construct a balanced training environment across four categories: Authentic, Simplistic, Intermediate, and Sophisticated attacks.

The core modeling phase, designated as Stack-TabNet 1, is presented in Figure 2(b). This stage employs a multi-fold cross-validation training regime for three heterogeneous base learners. The generated class probabilities are then synthesized by a Logistic Regression meta-classifier. This initial ensemble serves as the baseline for high-performance detection across all available signal attributes.

Subsequently, a post-hoc interpretability analysis is performed as shown in Figure 2(c). SHAP values are computed to quantify the global and local contributions of each signal feature. This process decodes the "black-box" nature of the ensemble and identifies the most discriminative physical indicators of spoofing.

Finally, an optimized detection variant, Stack-TabNet 2, is derived in Figure 2(d). Guided by the SHAP-driven importance ranking, a feature selection policy is implemented to retain the top eight most influential features. This refined model is retrained to evaluate the feasibility of achieving superior detection accuracy with reduced computational overhead, thereby ensuring suitability for real-time navigation safeguards.

2.1. Dataset Description and Preliminary Analysis

The empirical data utilized in this study comprises recordings of GPS intrusion incidents [22]. Authentic signal measurements are acquired via an eight-channel GPS receiver mounted on a ground vehicle. Velocity profiles varying from 0 to 60 mph are maintained to simulate UAS flight dynamics, while stationary observations are conducted at three distinct elevated locations to replicate hovering scenarios. Thirteen distinct signal parameters are derived from eight parallel processing channels during the acquisition phase. Beyond genuine transmissions, three categories of spoofing intrusions—classified as simplistic, intermediate, and sophisticated—are artificially generated to ensure comprehensive coverage of threat vectors.

The specific parameters extracted during signal processing are detailed in Table 1. These attributes encompass both navigation data and signal quality metrics, providing a multidimensional view of the receiver state.

The initial dataset exhibits a significant class imbalance, reflecting real-world operational conditions where authentic signals vastly outnumber attack instances. The distribution across the four target categories is recorded as follows: Class 0 (Authentic) contains 397,825 samples; Class 1 (Simplistic Attack) comprises 36,458 samples; Class 2 (Intermediate Attack) includes 44,232 samples; and Class 3 (Sophisticated Attack) consists of 32,015 samples. To mitigate the potential bias introduced by this disparity during model training, undersampling techniques are subsequently applied, as detailed in the EXPERIMENT section. The total number of observations amounts to 510,530 instances, each characterized by the thirteen dimensions outlined above.

To investigate the inter-dependencies among the 13 extracted GPS signal features, a correlation matrix heatmap is constructed, as illustrated in Figure 3. The Pearson correlation coefficients are computed to quantify the linear relationships between each pair of features, with values ranging from $-1$ to $+1$.

Several notable correlation patterns are observed from the heatmap. First, the correlation-based features EC (Early Correlation), LC (Late Correlation), and PC (Prompt Correlation) exhibit strong positive correlations with each other (correlation coefficients $\approx 0.9-0.96$), which is expected given their shared origin in the signal correlation process. Second, DO (Doppler Offset) demonstrates strong negative correlations with CP (Carrier Phase) and TCD (Time of Code Delay) (correlation coefficients $\approx -0.82$), reflecting the inverse relationship between frequency shift and phase/code measurements. Third, TCD and DO show near-perfect positive correlation, as both represent temporal information. Additionally, CN0 (Carrier-to-Noise Density Ratio) displays moderate positive correlations with EC, LC, and PC (correlation coefficients $\approx 0.75$–$0.78$), indicating that signal strength influences correlation magnitudes.

The correlation analysis reveals that while some features are highly interdependent, most feature pairs exhibit weak correlations (coefficients $<0.3$), suggesting that the 13-dimensional feature space captures complementary information for spoofing detection. This finding justifies the inclusion of all features in the initial model training. Furthermore, it indicates that the selection of training features significantly influences the final outcome, warranting a detailed investigation into feature importance and optimization in the subsequent sections.

2.2. Stack-TabNet Ensemble Model

A novel heterogeneous ensemble framework, designated as Stack-TabNet, is constructed to enhance the robustness and interpretability of GPS spoofing detection. The architecture operates through a two-level hierarchy, wherein diverse base learners are aggregated by a meta-classifier. This design leverages the complementary strengths of deep learning attention mechanisms and traditional tree-based ensemble methods. The overall workflow of the proposed methodology is illustrated in Figure 4.

2.2.1. Base Learners Configuration

Three distinct algorithms are employed as base learners to ensure model diversity and complementary learning capabilities. The strategic selection of these classifiers is motivated by the hypothesis that their integration through stacking will yield superior detection performance compared to any individual base learner, a claim that is substantiated in the experimental results section.

First, XGBoost is utilized for its efficiency in handling structured tabular data through gradient boosting. The model constructs an ensemble of decision trees sequentially, where each tree corrects the residuals of its predecessors. The objective function is formulated as:

$$\mathcal{L}=\sum _{i=1}^{n}l(y_i,{\widehat{y}}_i)+\sum _{k=1}^K\Omega \left(f_k\right)$$

(1)

where l denotes the loss function, ${\widehat{y}}_i$ represents the predicted probability, and $\Omega$ regularizes the complexity of K trees. This regularization prevents overfitting while maintaining high predictive accuracy on GPS signal features.

Second, Random Forest is integrated to reduce variance via bagging and random feature subspace selection. Multiple decision trees are constructed independently using bootstrap samples, and the final prediction is obtained through majority voting. The random subspace method ensures that each tree considers only a subset of features at each split, thereby decorrelating the individual trees and enhancing ensemble robustness. These tree-based models capture non-linear relationships within the GPS signal metrics effectively.

Third, TabNet is incorporated as a deep learning component specifically designed for tabular data. Unlike standard neural networks that process all features simultaneously, TabNet employs a sequential attention transformer mechanism to select relevant features at each decision step, enabling instance-wise feature selection and improved interpretability. The architecture consists of multiple decision steps, where each step processes a subset of salient features.

The input feature vector $\mathbf{x}\in {\mathbb{R}}^{13}$ is first normalized through batch normalization:

$$\mathbf{BN}\left(\mathbf{x}\right)=\gamma {\displaystyle \frac{\mathbf{x}-\mu }{\sqrt{{\sigma }^2+ϵ}}}+\beta$$

(2)

where $\mu$ and ${\sigma }^2$ denote the batch mean and variance, while $\gamma$ and $\beta$ are learnable parameters. At each decision step t, an attention mask ${\mathbf{M}}_t\in {\mathbb{R}}^{13}$ is computed through a sparsemax transformation to identify the subset of features contributing to the decision:

$${\mathbf{M}}_t=\mathrm{sparsemax}({\mathbf{W}}_a{\mathbf{h}}_{t-1}+{\mathbf{b}}_a)$$

(3)

where ${\mathbf{h}}_{t-1}$ represents the hidden state from the previous step, ${\mathbf{W}}_a$ denotes the attention weight matrix, and ${\mathbf{b}}_a$ is the bias term. The sparsemax function produces a sparse probability distribution, effectively zeroing out irrelevant features.

The selected features are then transformed through a feature transformer block consisting of gated linear units:

$${\mathbf{f}}_t=\mathrm{GLU}\left({\mathbf{W}}_f[\mathbf{x}\odot {\mathbf{M}}_t]\right)=\sigma \left({\mathbf{W}}_1[\mathbf{x}\odot {\mathbf{M}}_t]\right)\odot \left({\mathbf{W}}_2[\mathbf{x}\odot {\mathbf{M}}_t]\right)$$

(4)

where ⊙ denotes element-wise multiplication, $\sigma$ is the sigmoid activation, and ${\mathbf{W}}_f$ represents the transformation weights. The hidden state is updated recursively:

$${\mathbf{h}}_t=\mathrm{ReLU}({\mathbf{W}}_h{\mathbf{h}}_{t-1}+{\mathbf{f}}_t)$$

(5)

The outputs from all decision steps are aggregated to produce the final representation:

$${\mathbf{d}}_{\mathrm{out}}=\sum _{t=1}^{N_{\mathrm{steps}}}\mathrm{ReLU}\left({\mathbf{d}}_t\right)$$

(6)

where ${\mathbf{d}}_t$ denotes the decision output at step t. This multi-step processing allows the model to focus on discriminative signal characteristics, such as PD or CN0, while suppressing noise and redundant information.

The hyperparameters of TabNet are configured as follows: the decision embedding dimension $n_d$ and attention embedding dimension $n_a$ are both set to 128, the number of decision steps $N_{\mathrm{steps}}$ is set to 3, and the sparsity coefficient $\gamma$ is set to 1.3 to control the trade-off between feature selection sparsity and information retention. The model is optimized using the Adam optimizer with a learning rate of $3\times {10}^{-3}$ and a step learning rate scheduler.

The output probabilities from TabNet complement the tree-based models by capturing complex high-order interactions that may be overlooked by gradient boosting or bagging approaches. By integrating these three heterogeneous base learners within the stacking framework, the proposed Stack-TabNet model leverages their complementary strengths: the gradient-based optimization of XGBoost, the variance reduction of Random Forest, and the attention-driven feature selection of TabNet. This diversity is expected to enhance generalization capability across diverse spoofing attack scenarios, and the experimental results demonstrate that the ensemble indeed surpasses the performance of each individual base classifier.

2.2.2. Stacking Mechanism and Meta-Learning

The predictions from the base learners are combined using a stacking generalization strategy. Instead of hard class labels, the predicted class probabilities are utilized as input features for the second level. This approach preserves uncertainty information and provides a richer representation for the meta-learner. Specifically, the probability vector ${\mathbf{p}}_i=[p_{i,0},p_{i,1},p_{i,2},p_{i,3}]$ generated by each base classifier i is concatenated.

Additionally, the original input features are retained and passed to the meta-learner to prevent information loss. Consequently, the meta-learner receives a concatenated vector comprising both the base predictions and the original input features. The meta-learner is implemented using Logistic Regression with a multinomial loss function. This linear model is chosen to minimize the risk of overfitting given the reduced dimensionality of the meta-features. The final prediction $\widehat{y}$ is derived by maximizing the probability output from the meta-learner:

$$\widehat{y}=arg\underset{c}{max}\left(\mathrm{softmax}({\mathbf{W}}_{meta}[{\mathbf{p}}_{XGB},{\mathbf{p}}_{RF},{\mathbf{p}}_{TabNet},\mathbf{x}]+{\mathbf{b}}_{meta})\right)$$

(7)

where ${\mathbf{W}}_{meta}$ and ${\mathbf{b}}_{meta}$ represent the weights and bias of the logistic regression model, $\mathbf{x}$ denotes the original input feature vector, and ${\mathbf{p}}_{XGB}$, ${\mathbf{p}}_{RF}$, and ${\mathbf{p}}_{TabNet}$ denote the class probability vectors generated by the XGBoost, Random Forest, and TabNet base learners, respectively.

2.2.3. Training Strategy

The ensemble model is trained on the balanced dataset obtained through random under-sampling. This preprocessing step mitigates the bias towards the majority class observed in the raw data. During training, the base learners are fitted independently. Subsequently, out-of-fold predictions are generated to train the meta-learner, ensuring that the stacking process remains robust against data leakage. The optimization objective focuses on maximizing classification accuracy while maintaining computational efficiency suitable for potential real-time deployment. By integrating TabNet’s interpretable attention masks with the stability of tree ensembles, the Stack-TabNet framework achieves a balance between performance and transparency.

2.3. Feature Interpretability and Selection Policy

While the proposed Stack-TabNet framework delivers robust detection performance, the opacity of deep learning components necessitates a rigorous interpretability analysis to ensure trustworthiness in safety-critical navigation applications. To address this, SHAP is employed to quantify the contribution of each input feature to the model’s output. SHAP is grounded in cooperative game theory, where the Shapley value provides a unique solution for fairly distributing the "payout" (prediction) among the "players" (features). For a given prediction, the SHAP value ${\varphi }_i$ for feature i is formulated as:

$${\varphi }_i=\sum _{S\subseteq N\setminus \left\{i\right\}}{\displaystyle \frac{\left|S\right|!\left(\right|N|-|S|-1)!}{\left|N\right|!}}[f(S\cup \left\{i\right\})-f\left(S\right)]$$

(8)

where N denotes the set of all features, S represents a subset of features excluding i, and f is the model prediction function. This formulation ensures properties of local accuracy, missingness, and consistency, making it superior to traditional perturbation-based methods.

Given the hybrid nature of the ensemble, SHAP analysis is primarily conducted on the TabNet base learner using the DeepExplainer algorithm, which is optimized for deep neural networks. A background dataset is sampled from the training set to estimate the expected model output. For each sample in the evaluation set, SHAP values are computed across all 13 input features and four target classes. To derive a global measure of feature importance, the mean absolute SHAP value is calculated for each feature across the entire dataset:

$$I_i={\displaystyle \frac{1}{M}}\sum _{j=1}^M\left|{\varphi }_i^{\left(j\right)}\right|$$

(9)

where $I_i$ represents the importance score of feature i, M is the number of samples, and ${\varphi }_i^{\left(j\right)}$ is the SHAP value for feature i on sample j. Features are subsequently ranked in descending order based on $I_i$.

Based on the ranking results, a feature selection policy is implemented to construct an optimized variant of the proposed model. Specifically, a subset of features exhibiting the highest discriminative power is retained, while the remaining features with lower contribution scores are excluded. This subset is expected to comprise critical signal metrics that consistently demonstrate strong attribution values across different spoofing classes. The rationale behind this strategy is twofold. First, removing features with negligible SHAP values mitigates the influence of noise and redundant information, which can otherwise degrade generalization capability. Second, reducing the input dimensionality lowers the computational overhead during both training and inference, enhancing suitability for real-time deployment.

This optimized configuration is designated as Stack-TabNet-2, whereas the model utilizing all available features is referred to as Stack-TabNet-1. It is hypothesized that the curated feature subset enables the ensemble to focus on the most salient signal characteristics, thereby improving classification accuracy. The comparative performance of these two variants is empirically validated in the experimental section to evaluate the effectiveness of SHAP-driven feature selection in improving model’s performance without compromising detection integrity.

3. Experiments and Results

3.1. Experimental Setup

All experiments are conducted on a high-performance workstation equipped with an Intel Core i9-1400K processor operating at 3200 MHz, 128 GB of Kingston DDR5 memory and an NVIDIA RTX 5090 graphics processing unit. The implementation is based on Python with scikit-learn and PyTorch libraries.

To address the inherent class imbalance in the raw GPS spoofing dataset, Random Undersampling is applied to achieve balanced class distributions across all four categories. The classes are encoded as integers: Class 0 represents Authentic signals, Class 1 denotes Simplistic attacks, Class 2 indicates Intermediate attacks, and Class 3 corresponds to Sophisticated attacks. The dataset is partitioned into training and testing subsets with a 75:25 ratio. The detailed data distribution is presented in Table 2.

3.2. Comparative Experiments

To comprehensively evaluate the effectiveness of the proposed Stack-TabNet ensemble framework, comparative experiments are conducted against eight baseline models, including Decision Tree [23], Gaussian Naive Bayes [24], K-Nearest Neighbor [25], Logistic Regression [26] Random Forest [27], Support Vector Machines [28], XGBoost [29], and standalone TabNet [30]. All models are trained on the same balanced training set and evaluated on the identical testing set to ensure fair comparison.

3.2.1. Confusion Matrix Analysis

The confusion matrices for all nine models are presented in Figure 5. Each matrix illustrates the classification performance across the four spoofing categories, where the diagonal elements represent correctly classified samples and off-diagonal elements indicate misclassifications.

From the visualized results, it is observed that traditional machine learning models such as Gaussian Naive Bayes and Logistic Regression exhibit substantial confusion between authentic and spoofed signals, particularly for Class 1 and Class 2 attacks. In contrast, ensemble methods including Random Forest, XGBoost, and the proposed Stack-TabNet1 demonstrate superior discrimination capability with minimal off-diagonal errors. The Stack-TabNet1 model achieves the highest diagonal concentration, indicating robust classification across all attack types.

3.2.2. ROC-AUC Curve Analysis

The Receiver Operating Characteristic (ROC) curves and Area Under the Curve (AUC) values for all models are illustrated in Figure 6. The ROC curves are plotted for each of the four classes using a one-vs-rest approach, providing a comprehensive view of model performance across different decision thresholds.

The Stack-TabNet1 model demonstrates consistently high AUC values across all classes, with particularly strong performance in distinguishing sophisticated attacks (Class 3). The ensemble architecture effectively combines the strengths of tree-based models and attention-driven deep learning, resulting in improved separability between authentic and spoofed signal patterns.

3.2.3. Per-Class Performance Metrics

The precision, recall, and F1-score for each model across all four classes are summarized in Table 3, Table 4, and Table 5, respectively. These metrics provide granular insights into model behavior for each spoofing category.

From the per-class metrics, several observations are made. First, Gaussian Naive Bayes and Logistic Regression perform poorly across all classes, with F1-scores below 0.50, indicating their inadequacy for complex GPS spoofing detection tasks. Second, tree-based ensemble methods including Random Forest and XGBoost demonstrate competitive performance, particularly for Class 3 sophisticated attacks. Third, TabNet achieves strong results through its attention mechanism, but the proposed Stack-TabNet1 further improves performance by integrating complementary model strengths. Notably, Stack-TabNet1 achieves the highest precision score 0.9905 for Class 3 and the highest recall score 0.9987 for Class 3, demonstrating exceptional capability in identifying sophisticated spoofing attempts.

3.2.4. Overall Accuracy Comparison

The overall classification accuracy for all nine models is summarized in Table 6. This metric provides a holistic view of model performance across all spoofing categories.

Results demonstrate that the proposed Stack-TabNet1 achieves the highest overall accuracy of 93.37%, outperforming the second-best model TabNet by 1.00 percentage points. Compared to traditional machine learning baselines, the improvement is more substantial, with gains of 3.48% over Random Forest and 4.74% over XGBoost. The inferior performance of Gaussian Naive Bayes and Logistic Regression below 50% accuracy highlights the complexity of GPS spoofing detection and the necessity of advanced ensemble or deep learning approaches. The consistent superiority of Stack-TabNet1 across all evaluation metrics validates the effectiveness of integrating TabNet attention-driven feature selection with the stability of tree-based ensemble methods within a stacking framework.

3.3. SHAP Interpretability Analysis

To enhance the transparency and trustworthiness of the proposed Stack-TabNet1 model, SHAP is employed to interpret the feature contributions across all four GPS spoofing categories. SHAP provides a unified measure of feature importance based on cooperative game theory, ensuring properties of local accuracy, consistency, and missingness. The analysis is conducted on 2,000 test samples using a DeepExplainer optimized for deep neural network architectures. Three types of visualizations are generated: SHAP violin plots illustrating the distribution of feature impacts, SHAP bar plots ranking features by their mean absolute SHAP values, and SHAP dependence plots revealing the relationship between feature values and their corresponding SHAP values.

3.3.1. SHAP Violin Plot Analysis

The SHAP violin plots for all four classes are presented in Figure 7. Each violin plot displays the distribution of SHAP values for the 13 input features, where the width of the violin represents the density of samples at each SHAP value level. Positive SHAP values indicate features that push the model prediction toward the corresponding class, while negative values indicate features that push the prediction away from that class.

From Figure 7, several observations are made. First, PD and TCD consistently exhibit the widest distributions across all classes, indicating their dominant role in distinguishing between authentic and spoofed signals. Second, the SHAP value distributions for correlation-based features including EC, LC and PC are relatively narrow, suggesting their limited contribution to the final decision. Third, Class 3 demonstrates the most pronounced SHAP value separation, which aligns with the model’s high recall score 0.9987 for this category. The violin plots confirm that the Stack-TabNet1 model relies on physically meaningful signal characteristics rather than spurious correlations.

3.3.2. Feature Importance Ranking

The global feature importance rankings for all four classes are illustrated in Figure 8. The mean absolute SHAP value is computed for each feature across all test samples, providing a quantitative measure of each feature’s overall contribution to the model output.

As shown in Figure 8, PD and TCD emerge as the two most important features across all four classes, with mean absolute SHAP values ranging from 4.25 to 15.25 depending on the class. For Class 0, the top five features are PD at 4.25, TCD at 3.76, CP at 2.06, DO at 0.97, and PRN at 0.77. For Class 3, the ranking shifts slightly with PD at 15.25, TCD at 11.06, DO at 4.83, PRN at 3.00, and CP at 2.62. This consistency validates the physical interpretability of the model, as pseudorange and code delay are fundamental indicators of signal authenticity in GPS receivers. Notably, while TCD and DO exhibit strong linear correlation, their simultaneous retention is justified by their distinct physical definitions in signal tracking loops and the non-linear capacity of the ensemble model to utilize them complementarily rather than redundantly. Besides, the importance of PD increases substantially for Class 3, reflecting the model ability to detect subtle anomalies in distance measurements that characterize advanced spoofing techniques.

3.3.3. SHAP Dependence Plot Analysis

The SHAP dependence plots for the top three features of each class are displayed in Figure 9. Each scatter plot shows the relationship between a feature value on the horizontal axis and its corresponding SHAP value on the vertical axis, revealing how changes in feature values influence the model prediction.

Clear monotonic relationships are observed between PD, TCD and their SHAP values across all classes from Figure 9. For Class 3, PD exhibits a strong positive correlation with SHAP values, where higher pseudorange measurements correspond to increased likelihood of sophisticated spoofing detection. This aligns with the physical principle that spoofed signals often introduce anomalous distance estimates. Similarly, TCD demonstrates consistent negative correlations, where abnormal code delay patterns indicate potential spoofing interference. The dependence plots confirm that the Stack-TabNet1 model captures physically interpretable relationships between GPS signal characteristics and spoofing attack patterns, rather than relying on opaque feature combinations.

SHAP analysis reveals that while all 13 features contribute to the model decision-making process, their importance varies significantly across different spoofing categories. PD and TCD consistently dominate the feature importance rankings, while correlation-based features such as EC, LC, and PC and quadrature components such as PIP and PQP exhibit relatively minor contributions. This suggests that a subset of highly discriminative features may be sufficient to achieve comparable or even superior detection performance, as removing low-importance features can reduce noise and computational overhead without compromising accuracy. The implications of this finding are explored in the subsequent section through the development of an optimized model variant utilizing SHAP-driven feature selection.

3.4. SHAP-Driven Feature Selection and Stack-TabNet2 Performance

Based on the SHAP interpretability analysis conducted in the previous section, an optimized model variant designated as Stack-TabNet2 is developed. The top 8 features including PD, TCD, DO, CP, PRN, TOW, RX, and CN0, exhibiting the highest mean absolute SHAP values across all four spoofing categories are selected for training, while the remaining 5 features with lower contribution scores are excluded. Although SHAP values are primarily derived from the TabNet component to leverage its intrinsic attention mechanism, the resulting feature subset is empirically validated on the full stacking ensemble to ensure compatibility and performance across all base learners. The Stack-TabNet2 architecture maintains identical configuration to Stack-TabNet1.

3.4.1. Performance Evaluation of Stack-TabNet2

The classification performance of Stack-TabNet2 is comprehensively evaluated using the same testing set as Stack-TabNet1 to ensure fair comparison. The per-class precision, recall, and F1-score metrics are summarized in Table 7.

The confusion matrix for Stack-TabNet2 is presented in Figure 10. The diagonal elements indicate correctly classified samples, while off-diagonal elements represent misclassifications. Compared to Stack-TabNet1, Stack-TabNet2 demonstrates improved classification accuracy with reduced confusion between Simplistic and Intermediate attacks.

The ROC-AUC curves for Stack-TabNet2 across all four classes are illustrated in Figure 11. The model achieves near-perfect AUC values of 1.00 for Class 0 (Authentic), Class 1 (Simplistic), and Class 3 (Sophisticated), with 0.99 for Class 2 (Intermediate). These results indicate exceptional discrimination capability despite the reduced feature dimensionality.

3.4.2. Comparative Analysis: Stack-TabNet1 vs. Stack-TabNet2

A comprehensive comparison between Stack-TabNet1 (13 features) and Stack-TabNet2 (8 features) is presented in Table 8. Remarkably, Stack-TabNet2 achieves higher overall accuracy (95.91%) compared to Stack-TabNet1 (93.37%), despite utilizing 38.5% fewer input features.

Several observations are made from this comparison. First, the removal of 5 low-importance features (EC, LC, PC, PIP, PQP) eliminates redundant information and reduces noise interference, leading to improved generalization capability. Second, the computational overhead during both training and inference is significantly reduced, enhancing suitability for real-time deployment on resource-constrained platforms. Third, the consistency of PD and TCD as the top two features across all classes validates their fundamental role in GPS spoofing detection, as these metrics directly reflect signal propagation anomalies introduced by adversarial transmitters.

The superior performance of Stack-TabNet2 demonstrates that SHAP-driven feature selection effectively identifies the most discriminative signal characteristics while discarding features with negligible contribution. This finding has important implications for practical GPS anti-spoofing system design, where computational efficiency and detection accuracy must be balanced under real-world operational constraints.

4. Discussion

The experimental results validate the effectiveness of the proposed Stack-TabNet framework for GPS spoofing detection across diverse attack scenarios. The comparative analysis demonstrates that the ensemble approach consistently outperforms individual baseline models, including standalone TabNet, XGBoost, and Random Forest. Specifically, the optimized Stack-TabNet2 variant achieves an accuracy of 95.91%, surpassing the 93.37% accuracy of the full-feature Stack-TabNet1 model. This improvement underscores the efficacy of the SHAP-driven feature selection strategy, which mitigates the influence of redundant features and reduces noise within the input data. The integration of TabNet’s attention mechanism with tree-based models leverages complementary strengths, resulting in enhanced robustness against simplistic, intermediate, and sophisticated spoofing attacks. The high recall rates observed for Class 3 (Sophisticated Attacks) indicate that the model successfully captures subtle signal anomalies that traditional methods often overlook.

The interpretability analysis provided by SHAP offers critical insights into the decision-making process of the deep learning model, addressing the "black-box" concern prevalent in safety-critical aviation applications. The feature importance rankings reveal that PD and TCD consistently contribute the most to classification decisions across all classes. This aligns with the physical principles of GPS spoofing, where adversarial signals typically introduce inconsistencies in signal propagation time and distance measurements. By visualizing these contributions, the study establishes trust in the model’s predictions, allowing system operators to understand why a specific signal is flagged as spoofed. Furthermore, the dependence plots illustrate non-linear relationships between feature values and model output, confirming that the model learns complex patterns rather than relying on simple thresholding. This transparency is essential for regulatory approval and practical deployment in autonomous navigation systems.

Despite the promising results, certain limitations warrant consideration. The computational complexity of the stacking ensemble, although reduced in Stack-TabNet2, remains higher than that of single lightweight models, which may pose challenges for real-time deployment on resource-constrained UAVs. Additionally, the model is trained and evaluated on a specific dataset; its generalizability to other GNSS constellations (e.g., Galileo, GLONASS) or different environmental conditions requires further validation. The current study focuses on supervised learning, which relies on labeled data that may be scarce in real-world spoofing incidents. Future work addresses these limitations by exploring model compression techniques, such as knowledge distillation, to facilitate edge deployment. Further research also extends the framework to multi-constellation GNSS environments and investigates semi-supervised learning approaches to reduce reliance on labeled spoofing data. Finally, the integration of this detection module into a resilient navigation framework that can switch to alternative positioning sources upon detection constitutes a vital direction for subsequent research.

5. Conclusions

In this study, an interpretable ensemble learning framework designated as Stack-TabNet is proposed for GPS spoofing detection with systematic feature selection to address the limitations of existing methods in generalization and transparency. The architecture integrates the attention-based TabNet network with XGBoost and Random Forest within a stacking mechanism, while SHAP analysis provides comprehensive interpretability by quantifying feature contributions across all spoofing categories. Experimental results demonstrate that the optimized variant, Stack-TabNet2, achieves an accuracy of 95.91%, surpassing both standalone baseline models and the full-feature Stack-TabNet1 variant. The SHAP-driven feature selection identifies Pseudorange and Time of Code Delay as the most discriminative features, enabling effective dimensionality reduction from 13 to 8 inputs without compromising detection integrity. This confirms that interpretable feature selection not only reduces computational overhead but also enhances model transparency by revealing physically meaningful signal characteristics underlying spoofing detection. Consequently, the proposed method provides a transparent and efficient solution for safeguarding navigation systems against diverse spoofing attacks, offering significant potential for real-time deployment in safety-critical applications where both accuracy and interpretability are paramount.