Automatic dependent surveillance-broadcast (ADS-B) anomalous messages and attack type detection: deep learning-based architecture

Research problem and motivations

Several research articles have explored ADS-B vulnerabilities, attacks, and corresponding security techniques. However, to the best of our knowledge, the existing security solutions fail to comprehensively address all identified vulnerabilities and attacks. The existing security techniques address one or more known attacks on ADS-B but fall short of providing a defense mechanisms against a comprehensive set of attacks. This gap in coverage serves as the primary motivation for undertaking the proposed research. There is a pressing need to review the latest research on ADS-B vulnerabilities and corresponding security solutions. Given the critical importance of ADS-B in modern aviation, it is imperative to classify and compare the published security techniques systematically. This would help guide the development of a robust, accurate, and precise framework to enhance ADS-B security and safeguard its operations effectively.

Research contributions

This article makes the following significant contributions:

• Comprehensive ADS-B attack model: We present a detailed and systematic attack model for ADS-B systems, identifying potential threats and corresponding attack vectors. This analysis highlights the impact of these threats on ADS-B security and aligns them with core security requirements, including confidentiality, availability, integrity, and authentication (CIA+A).

• Innovative IDS: We propose a robust, precise, and accurate IDS leveraging three advanced deep learning models: TabNet, NODE, and DeepGBM. The system classifies ADS-B messages as either benign or malicious and further distinguishes between different attack types. Model performance is rigorously validated using standard evaluation metrics, demonstrating high accuracy and resilience against ADS-B threats.

• Security framework requirements and future research directions: We define critical security requirements for developing a comprehensive ADS-B security framework and identify current challenges in safeguarding the protocol. Additionally, we provide recommendations for future research, including the integration of time-series analysis, blockchain technology, hybrid techniques to improve ADS-B security.

Article structure

The remainder of this article is structured as follows: “Literature Review” provides a review of state-of-the-art machine learning and deep learning-based security solutions. “ADS-B Security” offers an overview of the ADS-B protocol, including its working principles and message structure. This section also presents a detailed attack model, identifying security threats associated with ADS-B, attacks corresponding to these threats, and the related security requirements. “Methodology” describes the proposed research methodology, including dataset generation and preprocessing steps. It also explains the selected deep learning models in detail. “Experimental Results” provides details about the experiments with the implemented models. “Discussion” provides an in-depth discussion of the results, including a comparison of training and testing accuracy and a performance comparison of the implemented models. “ADS-B Security Requirements, Challenges and Future Directions” outlines the identified security requirements, current challenges, and potential future research directions. “Conclusion” concludes the article with a summary of findings and recommendations. Figure 1 illustrates the structure of the proposed research article.

ADS-B overview

ADS-B is a critical communication protocol within the NextGen project, initiated by the FAA in 2005. It is widely used for airspace surveillance to accurately track the location of commercial aircraft. Compared to traditional surveillance protocols, ADS-B is significantly more efficient, safer, and flexible (Ahmed, 2024). Its benefits include enhanced collision avoidance, improved situational awareness, and reliable airspace surveillance, especially in non-radar environments.

ADS-B also improves operational efficiency by increasing accuracy, enabling faster clearance approvals, enhancing aircraft separation, and facilitating smoother visual approaches. Additionally, it optimizes departures and direct routing, resulting in fuel and time savings while increasing airspace capacity. The ADS-B network operates on a 1,090 MHz radio frequency, which requires low-cost maintenance and is more affordable to install compared to conventional radar systems (McCallie, Butts & Mills, 2011a).

ADS-B working

ADS-B brings massive advantages to the aviation industry by replacing radar technology. Radar depends on antennas and radio signals to determine the accurate location of aircraft. On the other hand, ADS-B uses satellite signals to track aircraft location and movements. ADS-B broadcasts aircraft positional data for surveillance purposes used by surrounding aircraft and ground based air traffic management (ATM) to monitor and track aircraft at any time in the airspace. ADS-B system relies on GNSS, radio frequency and ground-based ATC (Ukwandu et al., 2022). Aircraft with ADS-B OUT capability broadcast their positional data periodically using 1090 MHz radio frequency after receiving them from GNSS. The aircraft with ADS-B IN capability and the ground-based ATCs receive the broadcast data. The received data is utilized for airspace monitoring and surveillance. Figure 2 presents the graphical representation of the protocol working (Chevrot, 2022).

ADS-B message

Figure 3 provides a graphical representation of the division of an ADS-B message. The message has a total length of 112 bits and is divided into the following sections: downlink format (DF), code format (CF), ICAO aircraft address (AA), ADS-B message data, and parity check (DO & RTCA, 2009). To enhance positional accuracy, messages containing aircraft position and velocity are broadcast twice per second, while aircraft identification information is broadcast every 5 s. This approach reduces workload by segmenting the message broadcasts into manageable chunks (Costin & Francillon, 2012).

ADS-B attack model

Figure 4 presents a comprehensive overview of the ADS-B attack model, including eavesdropping, message injection, spoofing, and message modification attacks. We have only considered ground-based attackers with the capability of message receiving (eavesdropping) and broadcasting (message injection, spoofing, and message modification) using Software Define Radio (SDR). We utilized different colors to differentiate the attacks and attackers. Ying et al. (2019) proposed an attack model by covering replay and ghost aircraft injection attacks from the perspective of ground-based attackers. They also proposed a deep neural network-based spoofing attack detection framework for ADS-B. Luo et al. (2024) illustrated a poisoning attack model against ADS-B and proposed an anomaly detection framework for poisoning attack detection. Zhang et al. (2023) considered the ADS-B vulnerabilities, and the authors presented the DoS attack model on the data link layer. Similar Leonardi & Sirbu (2021) illustrated GNSS spoofing, message tempering and fake ADS-B message injection attacks in their attack model. In Fig. 4 we provide an enhanced attack model based on the identified threats.

ADS-B is a wireless communication protocol, and messages are broadcast without any security requirements, such as encryption, authentication, etc., which makes ADS-B vulnerable to several threats. The potential threats associated with ADS-B include eavesdropping, message modification, jamming, and spoofing. Based on the ADS-B infrastructure, attacks can be divided into two categories: attacks on ADS-B broadcast information and attacks on navigation information. ADS-B depends on GNSS as a primary source of navigation data. If an attacker modifies or blocks the navigation signal, this can have serious consequences for the aircraft (Dacey, 2002; Wu, Shang & Guo, 2020). Our research focuses on the attacks that target ADS-B broadcast information. Based on the security requirements of the ADS-B protocol, attacks on ADS-B are divided into four categories: confidentiality, integrity, availability, and authentication. Figure 5 presents the classification of attacks based on the identified security threats.

Dataset generation

We generated a novel dataset for the proposed research article containing malicious and non-malicious messages for deep learning model training and testing. The generated dataset contained 20 features listed in Table 2.

• Malicious data collection: The malicious messages are generated using the updated version of OpenScope, a real-time aviation and ATC simulation platform designed for analyzing and testing ATM systems, pilot-controller interactions, and surveillance technologies like ADS-B. The simulator provides a synthetic air traffic environment that enables engineers, researchers and aviation professionals to simulate real-time air traffic scenarios, evaluate security vulnerabilities and mitigation strategies, and generate synthetic ADS-B messages. We generate nine different types of attacks in the OpenScope including message delay attacks, transponder code alteration, non-responsive aircraft, ghost injection, trajectory modification, aircraft standing still, aircraft spoofing, aircraft displaying false information, and jumping aircraft. Using the simulator we generate 163,490 malicious messages of the selected attacks. The malicious messages are generated by modifying different parts of the ADS-B message such as latitude, longitude, altitude, transponder code, heading, and aircraft id, etc.

• Benign messages: The benign messages are obtained from OpenSky network, a crowdsourced, real-world air traffic surveillance system that collects and provides open-access ADS-B messages for aviation applications and research purposes. OpenSky is a non-profit organization aimed at improving air traffic security analysis, monitoring, and airspace research by offering a large-scale dataset of real-time aircraft movements. We downloaded 180,716 benign messages.

Data preprocessing

To achieve optimal accuracy, it is essential to preprocess the dataset before training and testing the models. We applied several data preprocessing techniques to prepocess the dataset. During the process of data collection including malicious and non-malicious messages, we noticed some unnecessary columns, duplicates records and record with null values.

• Removing duplicate values: These are repeated entries in the dataset that can introduce biases by overrepresenting specific patterns. It is important to remove the duplicate records from the dataset to increase the model’s performance. We remove all duplicate records during preprocessing.

• Removing null values: The presence of null or missing values in the datasets can affect the dataset’s statistical properties and lead to inaccurate predictions. Addressing missing data is an important part of data preprocessing to ensure the dataset is clean, complete, and suitable for analysis.

• Removing unnecessary columns: Unnecessary columns can add redundant information and increase dataset complexity which may distort feature importance and negatively affect model accuracy and processing time. The original dataset contains 20 features. Features including id, taxi_start, takeOffTime, airlineId, flightNumber, origin, and destination were determined as unnecessary during feature engineering and were removed.

Figure 7 represents the dataset’s distribution of malicious and non-malicious messages after the preprocessing step.

Evaluation criteria

The performance of the proposed models is evaluated using standard metrics including accuracy, precision, recall and F1-score. Equations (1), (2), (3), and (4) provide the mathematical formulae for accuracy, precision, recall and F1-score, respectively.

• Accuracy (A): The ratio of correctly predicted instances to total instances.

  (1) $$A=\frac{TP+TN}{TP+FP+FN+TN}.$$

• Precision (P): The proportion of true positive predictions to total positive prediction.

  (2) $$P=\frac{TP}{TP+FP}.$$

• Recall (R): The proportion of actual positive instances correctly predicted.

  (3) $$R=\frac{TP}{TP+FN}.$$

• F1-score: The harmonic mean of precision and recall.

  (4) $$F1—score=\frac{2\times P\times R}{P+R}.$$

Deep learning models

For this research, three deep-learning models were selected: TabNet, NODE, and DeepGBM. These models were chosen due to their ability to handle tabular data effectively and their proven performance in complex classification tasks.

TabNet

We use the TabNet Library which provides the TabNetClassifier for training tabular deep learning models. We set up the classifier, tune the hyperparameters such as max_epochs, batch_size, and learning_rate, and finally train and test the model. Figure 8 illustrates the training accuracy vs. validation accuracy of the TabNet model over 50 epochs for the task of ADS-B attack detection. The x-axis represents the number of epochs, or iterations, the model underwent during training. Each epoch corresponds to one complete pass over the training dataset. The y-axis represents the accuracy of the model. The orange line represents the accuracy of the model measured on the validation dataset, which is separate from the training data and is used to evaluate the model’s generalizability. The validation accuracy closely follows the trend of the training accuracy shown with blue line. Training accuracy refers to the accuracy of the model when predicting labels on the training dataset, which it has seen during learning phase. Around epoch 10, the training accuracy reaches approximately 85%, and continues to increase up to around 92% at the 50th epoch. This shows that the model not only improves on the training data but also generalizes well to validation data, enabling it to effectively detect attacks.

The confusion matrix illustrated in Fig. 9 is a detailed evaluation of the TabNet model for ADS-B attack detection. The diagonal values from the top left to the bottom right represent the cases where the model made correct predictions. The TabNet model performs well in classifying certain attack types, such as Ghost injection, No attack, and Non-responsive aircraft and Transponder code alteration with high accuracy. For example, the Ghost injection class has 4,057 instances, all of which are correctly classified, showing 100% accuracy for this class. For No attack class, there are 19,420 correct predictions out of 19,919 total instances with 97.49% accuracy. However, the model struggles with attack types having subtle changes. Aircraft standing still class has an accuracy of 38.55%, with significant misclassifications into other classes. Message delay class has an even lower accuracy of only 8.52%, indicating the model has a hard time detecting this attack type. This confusion matrix helps highlight where the model can be improved, particularly for attack types that share similar characteristics.

Neural oblivious decision ensembles

We initialize a NODE model with parameters defining the number of oblivious trees, tree depth, and learning rate. The model is trained using cross-entropy loss and an Adam optimizer. After training, the NODE model’s performance is assessed. Figure 10 represents the training vs. validation accuracy of the NODE model over 10 epochs.

Both training accuracy (blue line) and validation accuracy (orange line) increase sharply within the first couple of epochs. This shows that the model is learning quickly at the beginning. Both training and validation accuracy remain close, indicating that the model does not overfit and is generalizing well to the validation data. After epoch 4, the training and validation accuracy stabilize around 95%, indicating that the model has learned an optimal decision boundary and continues performing well on both the training and validation sets.

The confusion matrix in Fig. 11 shows how well the NODE model classifies different attack types. Most attack types are detected by the NODE model correctly with high accuracy. Ghost injection class has 100% accuracy. The model performs exceptionally well on Non-responsive aircraft attacks, with 2,048 correct predictions out of 2,060 instances, achieving an accuracy of 99.37%. Non-responsive Aircraft, No attack, and Aircraft displaying false information have 99%, 97.00% and 96% accuracy respectively.

On the other hand, some classes have low accuracy. Only 62 out of 239 instances of Message Delay are correctly classified, yielding an accuracy of 56.49%. Misclassifications are frequent for this attack, with many instances being wrongly classified as Aircraft spoofing or Aircraft standing still. This indicates that the NODE model struggles to differentiate Message Delay from other attack types. Similarly, Aircraft standing still has only 44.44% accuracy. A significant number of messages of this class are misclassified as Jumping aircraft and Aircraft displaying false information. This is likely due to the small number of samples in the dataset, which constrained the model’s ability to learn patterns for these scenarios.

DeepGBM

LightGBM is first used to train a gradient-boosted decision tree model, generating leaf indices for the input data. These leaf indices serve as input features for a neural network component of DeepGBM. A feed-forward neural network is defined and trained. Figure 12 illustrates the training vs. validation accuracy of the DeepGBM model across 16 epochs. In the initial epochs, both the training accuracy (blue line) and the validation accuracy (orange line) increase sharply. This shows that the model is learning quickly and efficiently. Around epoch 4, accuracy dips slightly, but the model quickly recovers. This dip could be caused by changes in the learning rate or the difficulty of certain batches. Both the training and validation accuracies hover around 98-99% towards the later epochs. The model seems to converge well, showing that it is learning effectively without overfitting, as the validation accuracy closely follows the training accuracy.

The confusion matrix in Fig. 13 provides a detailed look at the DeepGBM model’s performance for each attack type. It accurately detects most attack types. All 2,751 messages of Transponder code alteration are classified correctly achieving 100% accuracy. Only 1 instance of Ghost Injection is misclassified out of 4,057, leading to 99.98% accuracy for this class. Only 16 out of 2,275 messages are misclassified in Aircraft displaying false information class, and 25 out of 2,781 messages are misclassified in Non-responsive aircraft class achieving 99.3% and 99.1% accuracy, respectively. 19,704 out of 19,915 instances of the No attack class are correctly classified and only 180 instances are misclassified, resulting in an accuracy of 98.92%. This indicates that the DeepGBM model can effectively and accurately detect these attack type.

The DeepGBM model struggles to accurately detect Message Delay class. Only 160 out of 317 instances of Message Delay are correctly classified, with many instances being confused with other classes. This results in an accuracy of only 50.47%.

Training accuracy comparison

TabNet model demonstrated a slower, more gradual improvement in training accuracy, reaching approximately 91% after 50 epochs. The gradual increase suggests that TabNet learned progressively with a smooth convergence. NODE rapid learning curve reaching 95% accuracy after just a few epochs. This indicates that NODE, can learn more quickly and effectively. DeepGBM, in contrast, achieved rapid convergence, reaching near-perfect accuracy of 98–99% by epoch 10. However, slight fluctuations indicate occasional overfitting or sensitivity to certain batches of data during training. Both DeepGBM and NODE consistently outperformed TabNet in terms of training accuracy, but these gains do not necessarily translate into better generalization, as shown in the testing accuracy comparison.

Testing accuracy comparison

Figure 14 represents the comparison of the selected deep learning models in terms of testing accuracy. TabNet achieved a testing accuracy of 92.7%, which is lower than the other two models. While TabNet’s slower learning rate during training may have contributed to its lower testing accuracy, this behavior indicates strong generalization. NODE, with a testing accuracy of 96.17%, also generalized well to unseen data. NODE outperformed TabNet, but its performance was slightly below DeepGBM. DeepGBM displayed consistently higher testing accuracy of 98.07%, outperforming the other models. This indicates that DeepGBM strikes a good balance between robustness and fast learning on unseen data, leading to superior performance in attack-type detection.

Precision, recall and F1-score comparison

Table 3 compares precision, recall, and F1-score for each attack type across the three models. The metrics clearly show how each model handles specific attack types in ADS-B. Ghost Injection attacks: All three models achieved perfect scores for this attack type, indicating that its nature is easier to detect and that the models can distinguish it reliably. No attack (benign messages): DeepGBM and NODE achieved higher precision, recall, and F1-score than TabNet, with DeepGBM marginally outperforming NODE in all metrics. This suggests that both models are highly reliable for identifying benign ADS-B messages. Aircraft displaying false information attack: DeepGBM and NODE outperformed TabNet on this attack type, achieving higher precision, recall, and F1-score. Jumping Aircraft attacks: DeepGBM achieved the best results for this attack type, with an F1-score of 0.87, while NODE and TabNet trailed slightly behind.

Aircraft standing still attacks: TabNet struggled with this attack type, achieving an F1-score of 0.52, indicating significant confusion with other classes. Both DeepGBM (0.87) and NODE (0.56) performed better. Message Delay attacks: TabNet and NODE struggled the most with this attack, achieving F1-score of 0.16 and 0.38, respectively, while DeepGBM performed better with an F1-score of 0.50. The low recall across all models for this class suggests that Message Delay is a more complex attack type to detect, and further improvements in handling this type are needed.

Comparison with existing work

Table 4 presents a comparative analysis of our research with existing research in the field of ADS-B attack detection using machine learning and deep learning. The comparison is based on several key parameters, including the considered attack types, datasets, deep learning models, and attack detection performance. Table 4 includes multiple studies from different authors. Each study addresses various ADS-B attacks. The comparison is organized by reference citations, ensuring clarity in identifying contributions from different researchers. Our study progresses the state-of-the-art by investigating new attack scenarios (as mentioned in the attacks column), and new deep learning models which have not been explored before.

Our research utilizes both OpenScope and OpenSky, improving the robustness of the research by using diverse data sources. Several existing studies solely rely on simulated datasets, which may limit real-world applicability. Each study applies different machine learning and deep learning models to detect ADS-B attacks. We leverage TabNet, NODE and DeepGBM which are cutting-edge deep learning models. The DeepGBM model achieves the highest accuracy (98.07%), demonstrating superior attack detection capabilities. By demonstrating the efficacy of these models in classifying ADS-B data with high accuracy, our research contributes to the body of knowledge by introducing scalable, interpretable, and efficient methods for enhancing cybersecurity in aviation communication systems. Furthermore, this work highlights the potential of deep tabular models in critical infrastructure protection, offering a pathway for more resilient and intelligent air traffic monitoring systems.

Security requirements

To design an effective and applicable security solution for securing the ADS-B protocol from different attacks should fulfil the following security requirements (Ahmed et al., 2024):

• Cryptography elements: Despite the limited message size in standard ADS-B packets, the solution’s security level should not be compromised.

• No modifications in hardware: The proposed security solution should require a simple software update without requiring hardware modifications in terms of maintenance and cost.

• Packet loss events: Given the prevalent packet loss phenomena in the 1090ES frequency band, effective security solutions should demonstrate resilience against incomplete packet reception caused by obstacles and other factors.

• Backward compatibility: New security solutions should seamlessly integrate with existing systems, allowing aircraft that have yet to update their systems to continue operating.

• Standard compliance: Security solutions must align with the ADS-B protocol’s updated version to ensure message format and communication logic compliance.

• Limited message overhead: Security techniques must introduce a minimal additional message overhead to avoid congestion on the 1090ES frequency band.

Challenges and future research directions

ADS-B stands out as a leading protocol within ATC. Its principal strengths stem from leveraging GPS as a location provider, resulting in better location accuracy (Ahmed et al., 2024). Furthermore, it presents a cost-effective alternative with significant operational expenses and lower deployment than traditional radar technologies. ADS-B augments radar coverage and functions independently in areas missing radar support. Although these notable benefits exist, the broader adoption of ADS-B faces constraints due to associated security weaknesses, primarily linked to the protocol’s open broadcast of clear-text messages and absence of mechanisms to ensure integrity or authenticity, making them susceptible to manipulation using affordable hardware and open-source software. This has raised alarms about the potential exploitation of security loopholes.

Despite the gravity of the abovementioned concerns, only a few researchers have endeavored to propose practical strategies for moderating such vulnerabilities. Addressing this issue is complex, primarily due to the impracticality of modifying the ADS-B message format. Such modifications would render the already extensively implemented base obsolete, posing a significant challenge in enhancing the protocol’s security without disrupting existing systems. This underscores the need for innovative solutions that balance maintaining compatibility with current infrastructure and fortifying the security of ADS-B transmissions against potential tampering.

In the future landscape of aviation, the anticipated growth in the number of aircraft in the airspace poses a challenge, potentially leading to congestion and a surge in ADS-B messages. Addressing the need for swift and accurate reception and processing of these messages while expanding the transmission range on the ADS-B 1090ES frequency to mitigate message loss and congestion is a critical focal point for further investigation (Ahmed et al., 2024).

• Blockchain integration: Using blockchain technology for secure and tamper-proof logging of ADS-B messages and anomaly detection events can enhance transparency and accountability. Blockchain’s decentralized nature removes the need for a central authority, reducing the risk of single points of failure. By hashing ADS-B messages and storing the hash on the blockchain, the integrity of each message can be verified. However, lightweight consensus mechanisms are needed to validate and append messages efficiently without overloading the system. Pioneering work by Habib et al. (2022) introduced blockchain technology for identity recognition by employing P2P technology for distributed data storage and authentication. This technique showcases high security, reliability, and scalability, offering identity authentication across different infrastructures. Articles such as “Aviation Blockchain Infrastructure” (ABI) propose leveraging blockchain for effective, secure, and private communication between aircraft and authorized individuals (Reisman, 2019).

• Machine learning applications: Given the importance of abnormal data detection, particularly in a non-encrypted and open protocol like ADS-B, machine learning provides a compelling solution. In recent years, a surge in anomaly detection techniques based on machine learning has been witnessed, with deep learning gaining prominence in various domains. In the context of ADS-B, machine learning and deep learning models can significantly enhance anomaly detection by leveraging time-series algorithms that take advantage of the rapid and continuous updates in ADS-B messages. By correlating message timestamps and extracting complex patterns, these models improve detection accuracy without requiring additional sensors, maintaining compatibility with existing ADS-B protocols. Previous research, including studies by Kakimoto et al. (2024), Akerman, Habler & Shabtai (2019), Chen et al. (2019), has demonstrated efficacy of deep learning techniques to enhance ADS-B system security.

• Multi-layered security framework: The existing security solutions proposed by researchers provide a limited level of security. Researchers must design and test a security framework based on multi-layered security that can detect and defend ADS-B systems from different attacks. Designing hybrid systems by combining machine learning with rule-based systems can create a robust multi-layered defense approach.

• High attack detection with low false alarm: Researchers face challenges in developing an attack detection method with low false alarms and high attack detection rate. Future research can focus on developing and fine-tuning sophisticated models, such as graph neural networks (GNNs) and attention-based architectures.

Limitation

The proposed research presents a well-structured deep learning-based intrusion detection system for ADS-B attack detection, achieving high accuracy. However, its effectiveness in real-world aviation environments may be limited due to the computational challenges, dataset constraints, and lack of real-time detection capabilities.

Future work

Future research will strive to further improve datasets and investigate lightweight mechanisms for real-time anomaly detection. Another future direction is hybrid security techniques by combining cryptography, artificial intelligence, and multilateration-based verification to enhance ADS-B authentication and data integrity. Additionally, adversarial robustness testing is essential to ensure practical viability in live ATC environments. As the aviation industry moves toward next-generation ATM, intelligent and secure ADS-B systems will play a crucial role in safeguarding global airspace.