Automatic Dependent Surveillance-Broadcast (ADS-B) is an integral part of the Next Generation Air Transport System, providing an efficient and safe transport infrastructure by monitoring and managing congested airspace through advanced surveillance. It is designed to replace trad
...
Automatic Dependent Surveillance-Broadcast (ADS-B) is an integral part of the Next Generation Air Transport System, providing an efficient and safe transport infrastructure by monitoring and managing congested airspace through advanced surveillance. It is designed to replace traditional radar-based communication with a reliable system that requires aircraft to periodically transmit their real-time positions to the air traffic control center and nearby planes. However, despite being a relatively new standard, it lacks security measures. The absence of encryption and authentication leaves it vulnerable to various attacks, including spoofing (message injection or modification), deletion, jamming, and eavesdropping. While eavesdropping may not have immediate consequences, message spoofing can lead to severe traffic disruptions and potential aircraft collisions. Although authentication may mitigate the issue, it is incompatible with existing infrastructure and requires modifications to the current ADS-B protocol. In this paper, we propose Hexa-ML, a novel one-class classifier-based approach to detect location spoofing attacks without requiring ADS-B protocol modifications. We focus on an attacker sending ADS-B signals with a location report that does not match its current location, and we aim to identify such attempts. Our method leverages the idea that a specific location should be associated with a physical signal with specific characteristics. To this aim, we divide the space with a hexagonal tessellation and train a one-class classifier for each hexagon with physical layer features of messages received within the hexagon. These features include power, as well as statistical characteristics of magnitude and power spectrum. The idea is that, if during detection the message does not generate from within a hexagon, its associated one-class classifier should reject it. To validate our approach, we deployed a testbed to collect real ADS-B signals from real airplanes during their cruise. Our experimental results consistently demonstrate that the Isolation Forest (IF) algorithm, implemented in both libraries, performs better than One-class SVM (OCSVM) (macro average F1-score 89%) and achieves an average F1-score of 93% within geospatial hexagonal cells.
@en