# Aircraft Mode S Transponder Fingerprinting for Intrusion Detection
## 4 Performance Evaluation with Real Data
In fact, the major steps of the algorithm have different computational complexities that depend on the different algorithm parameters: the K-NN search has a complexity of \(\mathcal{O}(M)\), the computation of distance vectors has a complexity that depends on the computation of all the possible combinations of distances in a sample of \(K\) points--that is, more or less, \(\mathcal{O}(K(k-1))\)--and finally, the KS test complexity can be approximated with the complexity of the sorting algorithm used to estimate the distribution functions of the distances, \(\mathcal{O}(KlogK)\). This means that, for \(M>>K\), the computational load of the algorithm linearly grows with \(M\), this is also confirmed by some trials done varying the history window size of the algorithm and measuring its execution time, see Figure 7. In the author's opinion, having \(M\) on the order of thousand could be more than enough. Finally, concerning the value of \(N\), the main constraint is the algorithm update time; the larger \(N\) is, the larger the algorithm update time is. In addition, in principle, choosing larger value for \(N\) improves the meaningfulness and the stability of the signatures, and only a small impact on the overall algorithm performance was found for higher values. In the author's opinion, using \(N=50\), that means about 25 s of renewal time, could be the right trade-off. Moreover, for this particular time-limited data-set, increasing \(M\), the number of tests and the number of tested airplanes decreases due to the fixed size of the used recording (for example, for a window size of 500 signatures 362 aircraft were tested with a total number of tests equal to 400,677; on the other hand, for a size of 1000 signatures, the tests were 267,664 on 208 aircraft) reducing the  
Figure 7: Algorithm running time varying the size of the history window. This example is computed running the proposed algorithm implemented in Matlab on an Intel(R) Core(TM) i3-3220 CPU @3.30 GHz. significance level of the results. For this reason \(M=1000\), \(K=60\), and \(N=50\) are finally selected for a good trade-off between performance evaluation and significance of the results. The comparison of the performance obtained with the method proposed in [31] is reported in Figure 8, where an evaluation for the second scenario is also represented (with the same values of \(M\) and \(K\)). Finally, Table 2 reports examples of results fixing two possible values of the probability of detection (\(P_{D}=0.7\) and \(P_{D}=0.8\)) and for different settings of \(K\) and \(M\). In the table, the symbol \"\(<\)\" in the \(P_{fa}\) column is used when zero alarms are raised for all the tests; the reported values, in those cases, are the maximum resolution of the probability estimation process (\(1/\)(number of tests)). In general, the way of choosing the best couple of \(P_{D}\) and \(P_{fa}\) on the ROC curve strictly depends on the application and, usually, when a security alarm shall be raised, it is preferred to fix the maximum value for the probability of false alarm accepting the corresponding probability of detection. This means, usually, staying below the elbow of the curves. For example, considering this particular dataset, a good solution could be working on the elbow of the curve for \(M=1000\) and \(K=60\) and fixing the maximum probability of false alarm to \(10^{-3}\), obtaining a probability of detection of about 0.75.