ADS-B is one of the significant innovations in air traffic management (ATM) that impacts efficiency, safety, and capacity in the global airspace.¹ It is a satellite-based surveillance technology that aids aircraft in broadcasting their position, altitude, speed, and other data to air traffic controllers and adjacent aircraft in real time. Improved safety is associated with ADS-B due to its situational awareness for controllers and pilots and its capacity to provide real-time and accurate data.² Precise location assessment reduces the risks of mid-air collisions, and it also improves the detection of conflicts to resolve these timely.³ Furthermore, precise tracking through ADS-B also supports minimizing the separation between aircraft and allows efficient usage of airspace.⁴ This is specifically useful within high-traffic regions and in remote areas with limited radar systems. The system eliminates the need for expensive radar infrastructures that are usually ground-based and supports optimal routes of flights by minimizing fuel consumption and carbon emissions.⁵ Unlike radars, ADS-B provides coverage in oceanic and remote areas, ensuring seamless control of air traffic.³

Due to increased digital applications, security and vulnerability challenges pose a significant risk in aviation. ADS-B has transformed ATM with the help of increased situational awareness and efficiency; however, it is also linked with various vulnerabilities. The unencrypted data transmission makes ADS-B susceptible to jamming attacks and spoofing that can happen due to disruptions and false signals impacting the reliability of the system.^2,6 Furthermore, a lack of authentication leads to malicious actors that can imitate ground stations and legitimate aircraft.⁷ On the other hand, security channels also include the mitigation of the risks from cyberattacks that are exploited by the vulnerabilities and also guarantee flexibility against signal interference.³ The dependence on publicly accessible broadcast data intensifies the unauthorized monitoring exposure that can lead to privacy breaches and national security risks.⁸

Advanced machine learning methods are useful to detect anomalies related to ADS-B ins ATM as analyzed by.⁹ Anomalies are detected by ML and deep learning models as these models are able to analyze huge amounts of ADS-B data to find spoofed signals and irregular patterns, and they alert controllers regarding further potential attacks like jamming or spoofing.¹⁰ This is due to the ability of these systems to learn historical data to improve threat detection over time. ML models can make a difference in the authentication of ADS-B signals from any malicious interference.¹¹ It increases reliability in contested and complicated environments. Furthermore, predictive maintenance to manage resilience ensures proactive measures that are implemented to establish operational integrality.¹² The study by¹³ elaborated that ML algorithms are able to validate ADS-B as it does not directly encrypt data. It applies cross-referencing with auxiliary and historical data that ensure consistency and authenticity.

The research objectives are:

The ADS-B architecture is based on the three main components of ADS-B Out, ADS-B In, and Ground Infrastructure.¹⁴ ADS-B Out includes the aircraft’s broadcast position, altitude, speed, and identification of data at regular intervals through onboard transponders.² ADS-B In includes ground stations and aircraft and received ADS-B broadcast that increases the situational awareness for air traffic controllers and pilots.¹⁵ Ground infrastructure is based on the receiver processes where ADS-B data is used to manage traditional radar systems.¹³

The working principle shows that the aircraft uses GPS to find the exact location. The information is combined with the data of other flights, and then it is encoded and transmitted through transponders over 1090 MHz radio frequency for international use and 978 MHz in the US.¹⁶ Ground stations and related aircraft in the range receive and decode the signals for real-time tracking. The security concerns can be related to the authentication and encryption in the ADS-B broadcasts that leave the system vulnerable to eavesdropping, spoofing, and jamming attacks. Interference of signals and unauthorized monitoring can increase challenges to advanced security measures and integrity. ADS-B increases safety and efficiency, increases the risks, and makes it vital for global ATM and its components (Figure 2).

According to the study by,^1,4 the absence of encryption allows unauthorized parties to intercept ADS-B signals, compromising operational confidentiality. Malicious actors can introduce false data like incorrect positions and fictitious aircraft within the system.^18,19 The outcomes overwhelm the traffic control system through phantom aircraft and generate an illusion of collision paths and, thereby, severely disrupting operations. Furthermore, ADS-B signals transmitted at 1090 MHz are also vulnerable to jamming, which can render critical communication channels inoperable.²⁰

The attack can include low-cost equipment that makes it accessible to potential attackers. Such threats are intercepted with valid messages about retransmission that can cause confusion in the monitoring system of airspace.²¹ In this case, the main threat is that the ADS-B messages that can be transmitted without verification of senders can enable the legitimate takeoff of aircraft.¹ The ultimate outcome is the manipulation of flight data that leads to cyberattacks. ADS-B also depends on the global navigation satellite system to position data that is vulnerable to signal disruption and spoofing.²² Encryption of ADS-B messages and the addition of the sender identification can reduce spoofing and eavesdropping by implementing the potential system latency and implementation costs that have notable challenges.²³ Furthermore, multilateration (MLAT) and time difference of arrival methods can assist in detecting and preventing positional spoofing attacks and data injections.²⁴ Anti-jamming methods with signal processing can synchronize the receiver network and minimize the susceptibility to jamming.

The security landscape of ADS-B is observed to show progress, but it is a challenge because of inherently unencrypted and unauthenticated communication protocols.⁶ Current measures focus on mitigation, detection, and increased resilience as compared to the fully renovated system and its basic vulnerabilities.²⁵ Air navigation service providers enhance the use of MLAT for validation of the ADS-B data.^24,26 The technique is based on the comparison of signal times from various receivers for the detection of anomalies like spoofed positions. However, encryption is not adopted widely because of compatibility with legacy systems and because of latency risks.⁷ Such services offer a future-proof solution for eavesdropping and spoofing threats, help reduce jamming and frequency hopping, and utilize signal processing methods as anti-jamming strategies.⁴ These methods are helpful in improving the robustness of signals against interference.

Advanced ML and algorithm systems assess the ADS-B data streams for the detection of discrepancies and unusual patterns.²⁷ Such systems can also flag potential malicious activities and increase situational awareness. EUROCONTROL and the International Civil Aviation Organization (ICAO) are driving collaborative efforts for establishing the global security standards for ADS-B.² Implementation is inconsistent globally in various regions, which shows that a proactive design of ADS-B integration and authentication is required for long-term security. The differences in the aviation regulations of various regions and standards of ATM bring more challenges to the European Union Aviation Safety Agency, Federal Aviation Administration, and ICAO, which have different operational and security requirements globally.²⁸ For this, ML adoption in the ADS-B system needs compliance with such standards, which makes the cross-border system integration complicated. Regional certifications and compliance requirements include as those laid out by ISO/IEC 27001 and DO-178C.²⁹ Collaborative efforts are required to meet the challenges and to be in compliance with global air transportation standards in various regions.

The study by³⁰ indicates that supervised learning is one of the most powerful tools for detecting anomalies and classifying threats to security systems. Supervised learning is an approach that helps detect anomalies and classify threats to security systems. Furthermore, it applies labeled training data for creating models that can find unusual patterns and behaviors indicating security threats like system malfunctions and cyberattacks. Support vector machines (SVMs) are neural networks that analyze known data patterns for the detection of deviations.³¹ Such models improve the accuracy of the identification of spoofing threats in communication systems like ADS-B over time after learning from historical incidents.¹ The supervised learning models in classification are categorized with the security events in predefined types, like differentiating between insider threats and external attacks. It directly improves the response prioritization and allocation of these resources. However, effective supervised learning needs high-quality labeled datasets that make its success important for robust data collection and preprocessing exertions.

Another type of machine learning method is unsupervised learning, which plays a critical role in identifying and clustering novel threats within dynamic security environments.³² Unsupervised learning without labeled data uncovers the hidden structures and dataset patterns. For example, clustering algorithms like DBSCAN and K-means group similar amounts of data points on the basis of features.³³ In network security, clustering assists in finding unusual traffic patterns that can also signify attacks.³⁴ For novel threat identification, anomaly detection finds the data points that are significantly different from the majority. Gaussian mixture models and autoencoders are applied to flag the outliers like spoofed ADS-B signals or unexpected behavior of the system.³⁵

Deep learning leverages neural networks to find intricate patterns in data with the help of the hierarchal extraction of features.³⁶ Convolutional neural networks (CNNs) recognize the anomalies and objects in image form; however, recurrent neural networks (RNNs) assist in processing sequential data like time-series signals and text. Deep learning in aviation security detects jamming and spoofing by assessing complex signal patterns.³⁷ The capability of the unstructured data process, like speech and images, makes it ideal for diverse applications like natural language understanding, and unstructured data processing or speech makes it ideal for a diverse population. In aviation security, deep learning perceives jamming or spoofing by assessing the complex signal patterns.³⁸ The ability of the method for unstructured data like speech and images makes it ideal for various types of applications like natural language system facial recognition and advanced anomaly detection.

ML algorithms are important for vast datasets to find patterns and anomalies in real time.³⁹ In the ADS-B systems, ML is able to detect spoofed signals, unusual aircraft behavior and jamming by associating the transmitted data against predictive models and historical patterns.⁴⁰ In aviation, a huge amount of data is generated from the radar signals for passenger information. Furthermore, ML assists the rapid data analysis that allows security teams to respond to threats immediately.⁴¹ The agility increases safety and reduces operational disruptions. The analysis of historical data performance through ML can predict potential system failures and vulnerabilities to enable preemptive maintenance.⁴² This minimizes downtime and leads to increased robustness of the critical aviation systems, including the communication and surveillance infrastructure. ML-powered automation minimizes the human errors and increases operational efficiency.³³ Automated systems are able to monitor multiple inputs, recommend actions, free security personnel, and prioritize alerts for highly sensitive tasks. ML continuously improves the new data that makes the aspects well-suited for the emerging security challenges.

ML increases ADS-B security by automating the anomaly detection and abnormal behavior of flights, which is important to maintain air traffic system integrity.¹ SVMs and neural networks find threats like spoofing and injected signals in historical dataset training.⁴³ In the meantime, unsupervised models, including autoencoders and clustering algorithms, detect novel threats by assessing the deviation from typical data patterns from in-flight data. ML flags the ADS-B signal discrepancies like improbable speed and changes in the altitude that show the manipulated or spoofed data.³⁸ Real-time anomaly detection through deep learning assists proactive responses to security breaches by ensuring operational efficiency.

ML increases attack classifications, like jamming, spoofing, and injection in the ADS-B systems. Spoofing attacks are found by assessing anomalies in the aircraft velocity, position, and consistency of signals using deep learning and decision tree networks.⁴⁴ Jamming is assessed through disruption patterns of signals that are supervised models to assess the abnormal noise in the communication channels.⁴⁰ Injection attacks assess the falsified data and categorize it to use the algorithms that identify the deviations.⁴⁵ Such classifications assist in the precise detection of threats and facilitate tailored control strategies by ensuring traffic integrity during adaptation to evolve the attack vectors.

Predictive models in machine learning are essential in the real-time mitigation of threats by analyzing live and historical data to encounter and anticipate evolving threats.⁴⁶ These models utilize methods like anomaly detection, trend forecasting, and pattern recognition to find risks before materialization. The predictive algorithm monitors ADS-B data streams to indicate the irregular flight paths, mismatches, and signal disruptions that are expected in aircraft behavior.⁴⁷ The learning from previous patterns of historical attacks by ML assists in assessing the potential injection attempts, spoofing, and jamming, and it can trigger automatic responses in the form of alters.⁴⁴ Real-time updates also enable the system to recalibrate the predictions, and it ensures the adaptability towards novel threats.

Various non-ML-based approaches, including authentication techniques, cryptographic checks, redundancy checks, and physical-layer security, create a primary defense against threats, including jamming, spoofing, and injection attacks.^47,48 Furthermore, cryptographic methods are dependent on encryption for securing the ADS-B signals, and this confirms the legitimate parties that can interpret data.⁴⁹ On the other hand, an open broadcast system of ADS-B and encryption has limited feasibility because of interoperability and computational challenges with legacy systems. Another solution is message authentication codes that verify the origin and integrity of the broadcast messages, and they also struggle to establish real-time performance for crowded and large air spaces.⁵⁰

Redundancy-based methods cross-verify the flight data through multiple sensor inputs like ground-based sensors and radar to detect spoofed signals. The approach is effective but increases the cost and system complexity.⁵¹ The signal strength monitoring can assist in finding jamming strength and detect unusual signal fluctuations, but it needs specialized hardware that is at risk for false positives. However, physical-layer security methods like fingerprinting detect the unique characteristics of transmission for authenticating the aircraft. These can be bypassed with sophisticated attacks that imitate the transmission signatures.

On the other hand, ML-based methods suggest data-driven and proactive detection and threat classification. Supervised learning models like random forest (RF) and SVMs are more effective in detecting anomalies to assess deviation from historical data of flights.⁵² Deep learning models, including RNNs and CNNs, assess the multi-denomination relations and complex patterns from real-time flight data. The large volume of ADS-B data can be processed through deep learning, which increases the accuracy of threat detection.⁵³

Future research is intended to be conducted using explainable and robust AI models. It will also integrate federated learning to enhance privacy in ADS-B communication. Furthermore, it will use machine learning solutions and hybrid cryptography. It will also standardize machine learning practices in ADS-B security. Future research will explore the combined ML and non-ML model-like hybrid approaches for anomaly detection. The approach can be useful by adding a multi-layered defense system that can work against a broader range of attacks. ML scalability is also possible through hybrid models. Deep learning is assessed to be managing an exceptional accuracy, but these are operated like “black boxes,” which makes it challenging to interpret logic. Future research through XAI can increase the transparency of the models. This will help air traffic controllers in understanding the specific anomalies and reasons why these were flagged as a threat.