Detection method of decoying of a traffic alert and collision avoidance system, and associated traffic alert and collision avoidance system
Disclosed is a method of detecting spoofing of a traffic alert and collision avoidance system, known as a TCAS, the TCAS having a Mode A, a Mode C and a Mode S for communicating with surrounding aircraft. The method includes: querying a suspected spoofing aircraft via Mode S of the TCAS and receiving a response to this query; deducing from the response at least some data, known as Mode S data, relating to the suspected spoofing aircraft; and validating Mode S data by querying the suspected spoofing aircraft via Mode A or Mode C of the TCAS.
1. A method for spoofing detection of a traffic alert and collision avoidance system, called TCAS;
the TCAS having a Mode A, a Mode C and a Mode S for communicating with surrounding aircrafts;
the method comprising the following steps:
querying a suspected spoofing aircraft via Mode S of the TCAS and receiving a response to this query;
deducing from said response data, called Mode S data, relating to the suspected spoofing aircraft;
validating the Mode S data by querying the suspected spoofing aircraft via Mode A or Mode C of the TCAS.
2. The method for spoofing detection according to claim 1 , wherein the validation step is repeated N times, the suspected spoofing aircraft being recognised as false when the Mode S data traffic is not validated by any iteration.
3. The method for spoofing detection according to claim 1 , wherein:
N is greater than or equal to 3;
at least one iteration of the validation step is implemented when the suspected spoofing aircraft becomes a threat in both altitude and distance;
at least one iteration of the validation step is implemented prior to the triggering of a traffic alert in relation to the suspected spoofing aircraft;
at least one iteration of the validation step is implemented prior to the triggering of a resolution advisory in relation to the suspected spoofing aircraft.
4. The method for spoofing detection according to claim 1 , further comprising a step of retrieving a transponder code of the suspected spoofing aircraft via Mode S.
5. The method for spoofing detection according to claim 4 , wherein the step of retrieving the transponder code is implemented:
in passive mode when the suspected spoofing aircraft is not a threat in altitude or distance;
in querying mode when the suspected spoofing aircraft is a threat in altitude or distance.
6. The method for spoofing detection according to claim 4 , wherein said Mode S data validation step comprises:
querying via Mode A;
identifying a response to this querying of the suspected spoofing aircraft by comparing the received transponder code with that retrieved in the retrieval step;
designating Mode S data as validated when the response from the suspected spoofing aircraft has been received within a time window determined by that Mode S data;
the Mode S data comprising a relative distance to the suspected spoofing aircraft.
7. The method for spoofing detection according to claim 1 , wherein said Mode S data validation step comprises:
querying via Mode C;
designating Mode S data as validated when there is a response to this query with carried/deducible data corresponding to Mode S data;
the Mode S data comprising a relative distance, bearing and altitude of the suspected spoofing aircraft.
8. The method for spoofing detection according to claim 1 , further comprising a behavioural analysis step consisting of analysing the behaviour of the suspected spoofing aircraft in terms of the physical capabilities of an aircraft and/or a regulation.
9. The method for spoofing detection according to claim 8 , wherein the behavioural analysis comprises analysing at least one of the following:
speed of the suspected spoofing aircraft;
variation in the speed of the suspected spoofing aircraft;
detection of a fixed transmitter.
10. The method for spoofing detection according to claim 1 , further comprising a step of displaying in the TCAS a symbol representative of the suspected spoofing aircraft in the event of non-validation of Mode S data, said symbol being different from a symbol representative of any other aircraft whose Mode S data has been validated.
11. A traffic alert and collision avoidance system, called TCAS, comprising a query module, a reception module, a behavioural analysis module, a validation module and a display module configured to implement the method for spoofing detection according to claim 1 .