The AeroScope ADS-B anomaly benchmark

A benchmark, not a raw dump

The AeroScope ADS-B Anomaly Benchmark (v1) pairs 459 real airborne ADS-B records, captured live from public crowdsourced feeds and de-duplicated by ICAO 24-bit address, with 459 synthetically injected attacks built on top of that same real traffic. Injected attacks follow the taxonomy used in the ADS-B security literature (methodology after Habler and Shabtai, Computers & Security, 2018): altitude tampering, velocity tampering, ghost kinematics, and integrity-field downgrade. Every one of the 918 rows also carries the anomaly score from a deployed scikit-learn IsolationForest model, so a baseline is not something you have to build yourself before you can compare against it.

Nothing in this dataset comes from a satellite feed, a proprietary receiver network, or multilateration. AeroScope's own data sources are adsb.fi, adsb.lol and an OpenSky fallback, the same class of public, crowdsourced feed anyone can access, which is part of why this dataset is reproducible by other researchers rather than tied to infrastructure only one organization has.

Four injected attack types

Injected altitude values are clamped at -1000 ft, the Mode-S altitude encoding floor, so attack rows stay within what a real transponder could physically transmit rather than producing an obviously impossible value a trivial range check would catch.

38 columns

Every row carries the raw ADS-B fields, the signal-integrity fields, four derived self-consistency features, and the deployed baseline's score. The full schema, read directly from the published CSV header:

Baseline performance and how to reproduce it

A scikit-learn IsolationForest, the same model AeroScope runs in production as one of its detectors, scores every one of the 918 rows. Recomputed directly from the labels and scores shipped in the published file, across all 459 real records and 459 injected attacks, it achieves ROC-AUC 0.87, with a 54% detection rate at a 3.1% false-positive rate using the shipped iforest_is_anomaly threshold.

To reproduce it yourself: load the CSV, treat label as ground truth and iforest_score as the model's continuous anomaly score, then compute ROC-AUC with any standard implementation (for example scikit-learn's roc_auc_score(label, iforest_score)). To reproduce the detection-rate figure, compare label against the already-shipped iforest_is_anomaly column rather than picking a new threshold: true-positive rate among the 459 attack rows and false-positive rate among the 459 real rows should land at 54% and 3.1% respectively. No retraining is required, the scores are already in the file, which is the point: the baseline is meant to be checked, not taken on faith.

Honest limitations: synthetic injection is a proxy for real attacks, not the real thing. Coverage is biased toward busy terminal areas in the capture regions. Enhanced-surveillance fields (IAS, TAS, Mach, magnetic heading, track rate, roll) are only broadcast by a subset of aircraft, roughly 25 to 40 percent non-null, which is expected sparsity rather than a data quality problem. Full details are in the dataset card linked below.

Get the dataset

Download CSV  Download JSONL  Hugging Face mirror ↗

The Hugging Face mirror includes a load_dataset() loader for direct use in Python. See the research and dataset page and the dataset card for the full column reference and provenance notes. Licensed CC-BY 4.0: use it for any purpose, including commercial, with attribution.

How to cite this dataset

@misc{uzair2026aeroscopebenchmark,
  title={AeroScope ADS-B Anomaly Benchmark v1},
  author={Uzair, Muhammad},
  year={2026},
  publisher={AeroScope},
  howpublished={Hugging Face Datasets},
  url={https://huggingface.co/datasets/Muhammaduazir69/aeroscope-adsb-anomaly-benchmark},
  license={CC-BY-4.0}
}

A Zenodo DOI for this release is being minted; this page and the dataset card will be updated once it is issued.

Common questions