# Aircraft Mode S Transponder Fingerprinting for Intrusion Detection
## 3 Intrusion Attack Detection Algorithm
First of all, the SUT K-Nearest Neighbors [35] are extracted from the matrix \(\mathbf{F}^{\prime\prime\prime}_{\mathbf{M-1}}\), obtaining \(K\) different signatures \(\mathbf{f}^{\prime\prime\prime}_{\mathbf{K}}\), again, stacked in a matrix \(\mathbf{F}^{\prime\prime\prime}_{\mathbf{K}}\). In normal condition, it is possible to assume that the K-Nearest Neighbors will be all in the same cluster. Having these \(K\) signatures, the euclidean distances from the SUT signature can be computed, obtaining a vector of \(K\) distances \(\mathbf{d_{1}}=[d_{1,1},\ldots,d_{1,K}]^{T}\), where  
\[d_{1,i}=\|\mathbf{f}^{\prime\prime\prime}_{\mathbf{M}},-\mathbf{F}^{\prime \prime\prime}_{\mathbf{K},i}\|\hskip 28.452756 pti=1\ldots K. \tag{9}\]  
In the same way, the mutual distances between the \(k\) columns of \(\mathbf{F}^{\prime\prime\prime}_{\mathbf{K},i}\) can also be computed, obtaining a vector \(\mathbf{d_{2}}\) of dimension \(K(K-1)/2\):  
\[d_{2,i+j}=\|\mathbf{F}^{\prime\prime\prime}_{\mathbf{K},i}-\mathbf{F}^{\prime \prime\prime}_{\mathbf{K},j}\|\hskip 14.226378 pti=1\ldots K,j=i+1\ldots K. \tag{10}\]  
Using this approach, if the SUT is close to a cluster, the \(\mathbf{d_{1}}\) and \(\mathbf{d_{2}}\) vectors should have similar distributions; otherwise, it can be considered an outlier. It follows that the second stage of the outlier detection algorithm should be a test on the distribution of the two vectors of distances \(\mathbf{d_{1}}\) and \(\mathbf{d_{2}}\). The two-samples Kolmogorov-Smirnov test is proposed, avoiding the use of any a priori information about the signature distributions and any hypothesis on their type of distribution [34]. To perform the two-sample KS test, the two cumulative distribution functions \(F_{K}(\mathbf{d_{1}})\) and \(F_{K}(\mathbf{d_{2}})\) are computed and the p-value of the KS test is calculated and compared with a threshold [34]. If the obtained p-value is smaller than a given threshold, the under-test signature is considered an outlier; otherwise, it is considered as part of one of the clusters, or in general similar to the other signatures (see Algorithm 1 for a detailed description of the algorithm steps). Similar approaches are used for radar target detection in unknown noise or clutter--for example in [36; 37], exploiting the Ordered Statistic of the noise/clutter; or in [38], where the comparison of CDFs is proposed for outlier detection in nonstationary process. In Figure 5, an example of the application of the proposed method is reported. In Figure 5a, the last 1000 signatures for a given aircraft are shown (only the first three principal components are shown). It is clear that this particular aircraft is represented by more clusters, also having different densities. The black bold \"+\" represents the under-test signature (in case of legitimate aircraft) and the red \"+\" represent the K-NN signatures. In Figure 5b, the CDF for the distances (\(\mathbf{d_{1}}\) and \(\mathbf{d_{2}}\)) are reported. The other two parts of the figure, (c) and (d), show the same quantities but in the case of an intrusion. In this case, the incoming signature is relative to another aircraft. It is clear that in the latter case the two CDF are totally different, returning totally different p-values. Fixing a threshold for this parameter, the former CDFs will pass the K-S test and the latter one will not pass it. ```
Data: \(\mathbf{F_{M-1}}\): matrix containing the last \(M-1\) signatures of the aircraft; \(\mathbf{f}\): vector containing the under-test signature; \(\alpha_{th}\): Alarm threshold. Result: Alarm.