# Aircraft Mode S Transponder Fingerprinting for Intrusion Detection
## 3 Intrusion Attack Detection Algorithm  
A block diagram of the proposed method is reported in Figure 4. The method uses the vector \(\mathbf{f}\), containing all the described features obtained with a group of \(N=50\) consecutive messages of the airplane as signature of an aircraft transponder. Every \(N\) messages from the same aircraft, a new signature can be extracted. The signatures of each aircraft are continuously derived from the stream of incoming messages. A sliding window can be used to collect the last \(M\) signatures (\(M\) could be fixed or can be dynamically changed to include all the hysterical data). \(M\) should be large enough to have a representative sample of the aircraft signatures but also small enough to reduce the processing time, the memory load, and to account for the slow time variation of the signatures (due to the aging of the transponders). Its order of magnitude could be some days of data. The last incoming signature (lets call it Signature Under Test--SUT) is also added to the set of signatures and a classical preprocessing (feature scaling, selection, and whitening) is applied. This processing structure is able to create a database of signatures for each aircraft. In more detail, let us define the vector  
\[\mathbf{f_{i}}=[f_{1}(t_{i}),...,f_{n}(t_{i}),...,f_{N}(t_{i})]^{\prime} \tag{6}\]  
as the signature of the aircraft for the time \(t_{i}\), obtained by observing \(N\) messages coming from the aircraft. The time series \(\{\mathbf{f_{i}}\}\) represents the signatures of the same airplane in the time. Using a sliding window, this time series can collect the last \(M-1\) signatures representing the transponder, this sequence of vector can be stacked in the matrix \(\mathbf{F}_{M-1}\):  
\[\mathbf{F}_{M-1}=[\mathbf{f}_{i-M},\dots,\mathbf{f}_{i-1}]. \tag{7}\]  
Afterward, for the new incoming signature \(\mathbf{f}_{i}\), it is possible to test if it is an outlier with respect to \(\mathbf{F}_{M-1}\). The incoming SUT is also stacked in \(\mathbf{F}_{M-1}\), obtaining a new matrix \(\mathbf{F}\) and, after a coarse data-scaling (mean-normalization), the Principal Component Analysis is applied to obtain a new sequence of orthogonal features \(\mathbf{F}^{\prime}\):  
\[[\mathbf{C},\mathbf{F}^{\prime}]=PCA(\mathbf{F}), \tag{8}\]  
where \(\mathbf{C}\) is the matrix containing the principal component coefficients, also known as loadings, for the data matrix \(\mathbf{F}\), each column of \(\mathbf{C}\) contains coefficients for one principal component, and the columns are  
Figure 4: ADS-B signal features extraction block diagram. in descending order of component variance; \(\mathbf{F}^{\prime}\) is the principal component score matrix. The latter is the representation of \(\mathbf{F}\) in the principal component space, the rows of \(\mathbf{F}^{\prime}\) correspond to the observations, and the columns correspond to the components. The number of features can be reduced dropping the ones having low loadings and a reduced dimension \(\mathbf{F}^{\prime\prime}\) is obtained. Last, whitening (dividing each feature for the relative standard deviation) is applied, obtaining a new matrix, \(\mathbf{F}^{\prime\prime\prime}\). In this new feature space, it is expected to have one or more clusters representing the aircraft and, if the last column of \(\mathbf{F}^{\prime\prime\prime}\) (the SUT) of the matrix is not part of these clusters, an alarm should be raised. In other words, after this preprocessing, an outlier detection algorithm should be applied and, if the SUT is classified as outlier, an alarm shall be raised revealing the intrusion. As stated before, the outlier detection algorithm shall be able to identify an outlier without knowing the number of clusters that represent the aircraft and without having any information about the features distribution in the clusters. A two-stage approach is proposed here to identify the outliers.