# Aircraft Mode S Transponder Fingerprinting for Intrusion Detection
## 1 Introduction
It follows that the transmitted signal (considering only the data-block, to simplify the notation) \(s_{t}(t)\) can be represented as  
\[s_{t}(t)=C(t)\cdot\sin\left[2\pi\left(f_{C}+\delta f\right)t+\phi(t)\right], \tag{1}\]  
where  
\[C(t)=A(t)\cdot\left[\sum_{m=1}^{112}g\left(t-2 mT+c_{m}T+T/2\right)\right]. \tag{2}\]  
In the previous equations, \(f_{C}\) is the carrier frequency equal to 1090 MHz, \(\delta f\) is the allowed jitter of the carrier frequency, \(\phi(t)\) is the phase of the carrier. \(C(t)\) represents the transmitted 112 pulses sequence, \(A(t)\) is the message amplitude, \(\{c_{m}\}\) is the bits sequence to be transmitted (composed of \(m=112\)_bits_), \(T\) is the pulse width, and \(g(t)\) is a function that represents the real shape of the transmitted pulse as generated from the transmitter and compliant with the recommendations. Assuming to have a 1090-MHz coherent receiver with a sampling period of \(T_{s}\), in the presence of Additive White Gaussian Noise (AWGN), the received signal can be expressed as follows:  
\[s_{r}(kT_{s})=C^{\prime}(kT_{s})\sin\left[2\pi(\delta f+f_{d})kT_{s}+\phi(kT_{ s})\right]+n(kT_{s}), \tag{3}\]  
and  
\[C^{\prime}(t)=A^{\prime}(t)\cdot\left[\sum_{m=1}^{112}g^{\prime}\left(t-2 mT+c _{m}T+T/2\right)\right], \tag{4}\]  
where \(n(kT_{s})\) represents the noise, \(T_{s}\) is the sampling time, and \(f_{d}\) is the Doppler frequency due to the aircraft/station relative velocity. \(A^{\prime}\) represents the received amplitude behaviour and \(g^{\prime}\) represents the shapes of the received pulses that can be corrupted by the propagation (the propagation delay has been assumed equal to zero to simplify the notation). Having the samples of the received signal, it is possible to estimate some of the message features:  
* The residual carrier frequency \(f_{d}+\delta f\) (it can be estimated using any kind of frequency estimator, for example, finding the maximum value of the Discrete Fourier Transform of the received signal). Notice that the maximum Doppler frequency \(f_{d}\) (considering an aircraft flying at 250 m/s) is lower than 1 kHz and the maximum frequency resolution that can be obtained using the Mode S signals is inversely proportional to its duration, that is, \(f_{res}=1/(120\)\(\upmu\)s\()=9 kHz\). In this condition, we can expect that the Doppler shift can be neglected with respect to the transmitter frequency offset (\(\delta f\pm 1\) MHz). * The carrier phase along the message. It can be estimated by estimating 112 different phase values \(\hat{\phi}_{m}\), one for each pulse of the ADS-B message using a Maximum Likelihood Estimator, as shown in [29]. The second-grade best-fitting polynomial, \(y=ax^{2}+bx+c\), of this sequence can be derived for each message. * Time of Arrival of each message [27]. In [29], the authors have already done a measurement campaign to evaluate carrier phase along messages as a transmitter feature, discovering that at least seven different types of transmitter are commonly used. Finally, a group of \(N\) consecutive messages coming from the same aircraft can be used to produce the transponder signature composed from the following:  
* Carrier phase features: \(E(a)\), \(E(b)\), \(E(c)\), \(std(a)\), \(std(b)\), and \(std(c)\), where \(a,b,c\) are defined as before and \(E(\cdot)\) and \(std(\cdot)\) represent the mean and the standard deviation;
* Carrier frequency features: \(E(f)\), \(f_{min}\), \(f_{max}\), \(std(f)\), \(mode(f)\);
* Time features: observing the Time Difference of Arrival (TDOA) histogram of the messages in the sample, the following parameters can be defined: \(n_{bins}\), number of bins composing the distribution; \(d_{bins}\) mean distance between consecutive bins; \(n_{0}\), number of selected bins with zero/not zero occurrences [27]. In [31], a vector containing all these 14 parameters was considered as the transponder signature and an outlier detection algorithm based on the z-score was proposed.