Near-Real-Time IDS for the U.S. FAA’s NextGen ADS-B

Abstract

Modern-day aircraft are flying computer networks, vulnerable to ground station flooding, ghost aircraft injection or flooding, aircraft disappearance, virtual trajectory modifications or false alarm attacks, and aircraft spoofing. This work lays out a data mining process, in the context of big data, to determine flight patterns, including patterns for possible attacks, in the U.S. National Air Space (NAS). Flights outside the flight patterns are possible attacks. For this study, OpenSky was used as the data source of Automatic Dependent Surveillance-Broadcast (ADS-B) messages, NiFi was used for data management, Elasticsearch was used as the log analyzer, Kibana was used to visualize the data for feature selection, and Support Vector Machine (SVM) was used for classification. This research provides a solution for attack mitigation by packaging a machine learning algorithm, SVM, into an intrusion detection system and calculating the feasibility of processing US ADS-B messages in near real time. Results of this work show that ADS-B network attacks can be detected using network attack signatures, and volume and velocity calculations show that ADS-B messages are processable at the scale of the U.S. Next Generation (NextGen) Air Traffic Systems using commodity hardware, facilitating real time attack detection. Precision and recall close to 80% were obtained using SVM.

Advancements in ADS-B Security: A Comprehensive Survey of Vulnerabilities, Mitigation Strategies, System Requirements, and Emerging Research Trends

“…The k-nearest Neighbor model outperforms other models with an accuracy of 99.57%. A real-time intrusion detection system for ADS-B is proposed by [87] using a Support Vector Machine model with 80% accuracy. The authors train the model on a dataset generated with the help of OpenSky.…”

SoK of Machine Learning and Deep Learning Based Anomaly Detection Methods for Automatic Dependent Surveillance- Broadcast

“…As a result, the autoencoder has a higher TPR and lower detection latency over all simulated attacks; LSTM has a higher ROC AUC and a lower FPR over all simulated attacks. Unlike other studies, in [45], the authors focused on the system's ability to detect attacks by processing real-time data. A dataset was created by combining 10.000 real ADS-B messages obtained over Opensky with 10.000 generated attack ADS-B messages.…”

“…Therefore, the effectiveness of the method needs to be tested at different phases. The Main Idea Advantages Disadvantages [45] It is focused on the system's ability to process ADS-B messages in real-time and detect possible attacks.…”

“…4) The sheer volume of yearly ADS-B data, estimated at 41 TiB based on FAA statistics [45], presents a practical concern, demanding scalable solutions for efficient processing and analysis in real-world applications of ADS-B anomaly detection systems.…”