Using LSTM encoder-decoder algorithm for detecting anomalous ADS-B messages
A method for detecting anomalous ADS-B messages in airplanes and air-traffic control system, comprising: extracting features from application level data, which is information broadcasted in said ADS-B messages, contextual data and flight plans; analyzing said extracted features and computing relative measures of a flight based on said extracted features; training a machine learning model to represent a benign ADS-B messages; applying said machine learning model on said extracted features thereby deriving a reputation score for said ADS-B message; issuing a decision based on said score, thereby recognizing an attack and issuing an alarm regarded said recognized attack.
1. A method for detecting anomalous ADS-B messages in airplanes and air-traffic control system using at least one or more hardware processors, the method comprising:
a. extracting features from application level data, which is information broadcasted in said ADS-B messages, contextual data and flight plans;
b. analyzing said extracted features by the one or more hardware processors of each individual airplane and computing relative measures of a flight based on said extracted features;
c. training a machine learning model to represent a benign ADS-B messages;
d. applying said machine learning model on said extracted features thereby deriving a reputation score, for verifying the reliability of ADS-B messages received from neighboring aircrafts, the deriving of the reputation score including at least one of the following methods:
analyzing a correlation between the data in the ADS-B message;
learning a profile of a flight route using a machine learning model by using previous ADS-B messages flights reports of the same route;
modeling all airplanes in a specific geolocation and time frame based on said airplanes ADS-B reports and detect anomalous reports; and
using current flight plans and correlating said plans with the ADS-B messages of said airplane;
e. for each specific route of each airplane, detecting anomalies resulting from malicious cyber-attacks; and
f. issuing a decision based on said score, thereby recognizing an attack and issuing an alarm regarded said recognized attack.
2. A method according to claim 1 , wherein the information broadcasted in the ADS-B messages relates to aircraft ID, altitude, location, speed, heading and wherein the contextual data relates to weather, type of plane, airline and destination.
3. A method according to claim 1 , wherein the methods for deriving a reputation score are combined to issue a decision.
4. A method according to claim 1 , wherein the machine learning model applied is a Markov model or sequence mining algorithms.
5. A method according to claim 1 , wherein the machine learning model applied is a deep learning model.
6. A method according to claim 5 , wherein the deep learning model is a ANN architecture.