Aerospace and Electronic Systems Magazine November 2017 - 58

ADS-B Vulnerabilities and a Security Solution with a Timestamp

Figure 6.

Simulation screenshot.

location. However, spoofing works only for one victim airplane, as
it is physically impossible to fake the values for any other airplanes.
The attacker may also try to send out multiple bogus messages with
different timestamp values in a hope that some of them match, but
such a massive transmission can be detected and rejected easily due
to the discrepancy among the frames. No matter how many ghost
airplanes are injected, all of them can be identified simultaneously.

EVALUATION
To test the feasibility of the concept, we have developed a simulation program and tested a variety of cases.
Figure 6 shows a screenshot that shows the airplane locations
and configuration parameters. In this simulation, all airplanes
transmit their location in every 0.5 seconds, and we ignore the
frame collisions. All airplanes are moving in random directions at
constant speed. We introduced a small amount of random error in
their broadcast locations. An attacker creates ghost airplanes either
from a fixed location or while moving. Figure 7 shows the trend of
Tsender values over multiple ADS-B frames. In the case of a legitimate airplane's ADS-B, it fluctuates within a small range (several
meters in distance) due to the random errors. But in the case of
ghost airplanes, it either converges or diverges. If the difference
of the values between two frames is beyond a certain threshold
value, it can be considered a spoof. In this case, the Tsender values in
58

subsequent frames changed at the rate of about 60 meters (= 200
ns) per 0.5-second tick. This is a very large value and we can claim
it a spoof.
An attacker will probably create thousands of ghost airplanes
in order to make the ADS-B system useless. We simulated 100
ghost airplanes by the attacker. Additionally, to test the false positive ratio, we included 100 legitimate airplanes. In each scenario,
we ran the simulation 10 times and Figure 8 shows the results.
Since our method monitors the changes in Tsender values, it requires
multiple frames. We monitor three or more frames to see if the
change amount goes over a threshold value. Within 5 ticks (= 2.5
seconds), 99% of the fake airplanes are detected and eventually
all are detected within 25 seconds in case of a static attacker in
Figure 8a. In the case of a mobile attacker in Figure 8b, all fake
airplanes were detected within 20 seconds. In all cases, none of the
legitimate airplanes were affected, i.e., false positive ratio was 0%.

DISCUSSIONS
NEED FOR CLOCK HARDWARE SUPPORT
ADS-B doesn't need to maintain a synchronous clock among the
ADS-B devices. But to measure the time of arrival for the received
packets, it should maintain a local oscillator of above 100 MHz at
10 to 20 ppb accuracy (10 to 20 ns error per second). Fortunately

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017