Abstract:ADS-B (Automatic Dependent Surveillance-Broadcast) is a key technology in the new generation air traffic surveillance system. However, it is vulnerable to various cyber attacks because it broadcasts data in plaintext format and lacks authentication mechanism. Previous research has rarely considered the application scenarios of ATM (Air Traffic Management) in commercial air transport, and there are the problems of low anomaly detection rate and the non-lightweight model. This paper focuses on ADS-B anomaly detection under the background of ATM. We propose the TTSAD (TCN-Transformer-SVDD Model for Anomaly Detection) model, which aims to address the problems of existing ADS-B anomaly detection methods including inadequate considerations of long-term dependencies and distribution characteristic, the non-lightweight model and the poor adaptive threshold. First, ADS-B time series is input into TCN (Temporal Convolutional Network) prediction module which predicts data in an accurate and quick way using causal convolution and dilated convolution. Then, the predicted ADS-B time series is input into Transformer reconstruction module which reconstructs data accurately and quickly based on Self-Attention and Multi-Head Attention mechanism. Finally, the difference values between the reconstructed values and the real values are input into SVDD (Support Vector Data Description) threshold determination module for an optimal threshold. Experimental results show that the TTSAD model can detect ADS-B anomaly data generated from attacks such as altitude slow offset and DOS (Denial of Service). The TTSAD model is superior to other machine learning methods in terms of recall rate, detection rate, accuracy rate, missing detection rate and false alarm rate. Furthermore, compared with other deep learning methods including LSTM, GRU and LSTM-AE, the TTSAD model has a shorter training time and a lightweight characteristic. This approach guarantees the information security of ADS-B, thereby improving the operational security of ATM.

HTMTAD: A Model to Detect Anomalies of CDN Traffic Based on Improved HTM Network

Packet Payload Based Anomalous Network Intrusion Detection

A Method Of Http Malicious Traffic Detection On Mobile Networks

Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features

Traffic Anomaly Detection in Backbone Networks Using Classification of Multidimensional Time Series of Entropy

MTC-NET: A Multi-Channel Independent Anomaly Detection Method for Network Traffic

Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Method of Detecting Network Anomaly on Multi-Time-scale

Detecting Network-Wide Traffic Anomalies Based on Spatial HMM

Traffic Anomaly Detection Based on Spatio-Temporal Hypergraph Convolution Neural Networks

The Detection of Abnormal Behavior by Artificial Intelligence Algorithms Under Network Security

Multi‐scale Anomaly Detection for High‐speed Network Traffic

HSTF-Model: An HTTP-based Trojan detection model via the Hierarchical Spatio-temporal Features of Traffics

An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone.

TTSAD:TCN-Transformer-SVDD Model for Anomaly Detection in Air Traffic ADS-B Data

A method based on hierarchical spatiotemporal features for trojan traffic detection

TTSAD: TCN-Transformer-SVDD Model for Anomaly Detection in Air Traffic ADS-B Data

A Network-wide Traffic Anomaly Detection Method Based on HSMM

Network traffic anomaly detection based on catastrophe theory

Modeling Network Traffic for Traffic Matrix Estimation and Anomaly Detection Based on Bayesian Network in Cloud Computing Networks.