Analyzing Sequences of Airspace States to Detect Anomalous Traffic Conditions

Edan Habler, Asaf Shabtai

Research output: Contribution to journalArticlepeer-review


The ADS-B system serves as a replacement for the current radar-based air traffic control systems. Although much effort and resources have been invested in designing and developing the ADS-B system, it is well known for its lack of security mechanisms. Previously suggested approaches for securing the ADS-B system are considered impractical because of the cost and time involved in modifying the system, and given the fact that it is already deployed in most aircraft and ground stations worldwide. In this article, we propose a software-based security solution for detecting anomalous traffic conditions, which does not require any modification of the current system architecture or the addition of external sensors. In order to identify nonlegitimate ADS-B messages, our approach utilizes a stacked-LSTM encoder-decoder model that learns the flight patterns of aircraft in a monitored aerial region. We evaluated our model against common attack patterns injected into six datasets containing real ADS-B data, and we compared our proposed model with commonly used online, unsupervised models. The results of the experiments showed that our method is able to accurately and efficiently detect all of the injected attacks. Moreover, we examined our model's performance on a real flight that deviated from its planned route and confirmed that our method was capable of accurately detecting the anomaly.

Original languageEnglish
Pages (from-to)1843-1857
Number of pages15
JournalIEEE Transactions on Aerospace and Electronic Systems
Issue number3
StatePublished - 1 Jun 2022


  • Anomaly detection
  • Automatic dependent surveillance-broadcast (ADS-B)
  • Explainability
  • Long short-Term memory (LSTM)

ASJC Scopus subject areas

  • Aerospace Engineering
  • Electrical and Electronic Engineering


Dive into the research topics of 'Analyzing Sequences of Airspace States to Detect Anomalous Traffic Conditions'. Together they form a unique fingerprint.

Cite this