# Aircraft Mode S Transponder Fingerprinting for Intrusion Detection
## 1 Introduction
These latter proposals need a deep modification of the Mode S protocol that can have a big impact on the channel throughput for the transmission of authentication information. Moreover, in the case of spoofing, it can be used either to flood the channel or to inject fake data into the channel; for example, representing fake airplanes. In case of flooding, the attack could be  
Figure 1: Secondary Surveillance Radar (SSR) Modes, Automatic Dependent Surveillance System (ADS-B), Traffic Information System (TIS-B), and Traffic Collision Avoidance System (TCAS) block diagram. Intruder is also shown. easily detected by the use of conformance checks (for example, a message rate conformance monitor) and then one of the previously mentioned source separation algorithm could be used to separate the legitimate messages from the ones coming from the spoofer. In case of a smart spoofer that injects a small quantity of well-formatted coherent data (such as fake aircraft following a fake trajectory), the detection of the attack can be very difficult. This work will focus on this latter case, where the lack of authentication of the SSR Mode S messages could allow the following possible types of cyberattacks:  
* Intrusion-1: The on-board navigation unit can be replaced with a fake one reporting false information;
* Intrusion-2: An intruder can transmit false information on the channel with an unauthorized transmitter, producing false information on the controller/pilot display. In these two cases, the receiving stations can receive false information without any ability to detect the intrusion. We will focus on the possibility of taking a fingerprint of the aircraft transmitter and exploiting it to detect fake messages sent from an attacker that uses a different transmitter. This is possible because the signals generated from each transponder cannot be easily replicated, since they are produced with a specific hardware that is subjected to some tolerances (also related to randomness in the manufacturing process such as, for example, the presence of analog components in the transmission chain, clock stability, etc. ), aging or different time versions of the transmitter Hardware (HW) and Software (SW) [23; 24; 25; 26]. Signatures based on different Radio Frequency (RF) signal features can be found in the received signals and used to find out the origin of the messages. It follows that by creating a database of aircraft/transponders containing their transponder signatures, it is possible to check if the incoming signals belong to the expected aircraft or not. In some previous works (for example in [27; 28]), the possibility to classify the aircraft Mode S transponders with respect to the time series of the transmitted messages or by the use of phase transient and carrier frequency are investigated. Moreover, in [29; 30], the carrier phase pattern along the message is used for transponder classification by the use of Neural Networks or K-NN classifiers. In the latter, different approaches to extract the signature are also compared: single-message fingerprint or group-message fingerprint. Finally, the Cumulative Distribution Function (CDF) of the carrier frequencies measured on consecutive messages could also be considered peculiar for transponders, as shown in [31]. The main result of all these works was that they showed it is possible to distinguish between different transponder groups using RF fingerprinting, while using low-cost hardware. Moreover, in [31], a set of these features (phase along the message, carrier frequency distribution, and time series) was proposed for the intrusion detection, exploiting a simple distance-based outlier detection algorithm. Summarizing these mentioned works, the Mode S data link format is shown in Figure 2 and the Pulse Position Modulation (PPM) implies that, neglecting the preamble, the data-block is always composed of \(m=112\) pulses with different time positions to encode the information to be transmitted (i.e., Manchester coding) [2; 3]. Figure 2: ADS-B/Mode S reply format.