Abstract:ADS-B (Automatic Dependent Surveillance-Broadcast) is a key technology in the new generation air traffic surveillance system. However, it is vulnerable to various cyber attacks because it broadcasts data in plaintext format and lacks authentication mechanism. Previous research has rarely considered the application scenarios of ATM (Air Traffic Management) in commercial air transport, and there are the problems of low anomaly detection rate and the non-lightweight model. This paper focuses on ADS-B anomaly detection under the background of ATM. We propose the TTSAD (TCN-Transformer-SVDD Model for Anomaly Detection) model, which aims to address the problems of existing ADS-B anomaly detection methods including inadequate considerations of long-term dependencies and distribution characteristic, the non-lightweight model and the poor adaptive threshold. First, ADS-B time series is input into TCN (Temporal Convolutional Network) prediction module which predicts data in an accurate and quick way using causal convolution and dilated convolution. Then, the predicted ADS-B time series is input into Transformer reconstruction module which reconstructs data accurately and quickly based on Self-Attention and Multi-Head Attention mechanism. Finally, the difference values between the reconstructed values and the real values are input into SVDD (Support Vector Data Description) threshold determination module for an optimal threshold. Experimental results show that the TTSAD model can detect ADS-B anomaly data generated from attacks such as altitude slow offset and DOS (Denial of Service). The TTSAD model is superior to other machine learning methods in terms of recall rate, detection rate, accuracy rate, missing detection rate and false alarm rate. Furthermore, compared with other deep learning methods including LSTM, GRU and LSTM-AE, the TTSAD model has a shorter training time and a lightweight characteristic. This approach guarantees the information security of ADS-B, thereby improving the operational security of ATM.

Ms-Lstm: A Multi-Scale Lstm Model for Bgp Anomaly Detection

A Multi-View Framework for BGP Anomaly Detection Via Graph Attention Network

Attention Based CNN-LSTM Network for Anomaly Pattern Classification of Multivariate Time Series

ISP Self-Operated BGP Anomaly Detection Based on Weakly Supervised Learning.

An efficient network behavior anomaly detection using a hybrid DBN-LSTM network

Improved LSTM-based Time-Series Anomaly Detection in Rail Transit Operation Environments

MAD-MulW: A Multi-Window Anomaly Detection Framework for BGP Security Events

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Multi-scale Risk Assessment Model of Network Security Based on LSTM

M STL: Multi-Range Multi-Level Spatial-Temporal Learning Model for Network Traffic Prediction

Detecting Urban Traffic Anomalies Using Traffic-Monitoring Data

Long short‐term memory based anomaly detection: A case study of China railway passenger ticketing system

A New Multi-Scale Sliding Window LSTM Framework (MSSW-LSTM): A Case Study for GNSS Time-Series Prediction

T-LSTM: A Long Short-Term Memory Neural Network Enhanced by Temporal Information for Traffic Flow Prediction

MTC-NET: A Multi-Channel Independent Anomaly Detection Method for Network Traffic

A Network Traffic Classification Method Based on Graph Convolution and LSTM

ConvLSTMTransNet: A Hybrid Deep Learning Approach for Internet Traffic Telemetry

Campus Network Traffic Prediction and Anomaly Detection Based on Deep Learning

TTSAD:TCN-Transformer-SVDD Model for Anomaly Detection in Air Traffic ADS-B Data

GLSNN Network: A Multi-Scale Spatiotemporal Prediction Model for Urban Traffic Flow

Deep Sequence Modeling for Anomalous ISP Traffic Prediction