# AeroScope ADS-B Anomaly Benchmark (v1)

**License:** CC-BY 4.0 — cite as: *AeroScope ADS-B Anomaly Benchmark v1, aeroscope.live, 2026-06-06*.
**Rows:** 918 (459 real normal / 459 injected attack) · **Columns:** 38

## What this is
Real airborne ADS-B traffic captured live from crowdsourced receiver feeds (multi-region,
deduplicated by ICAO hex), paired with synthetically injected attacks following the standard
taxonomy in the ADS-B security literature (altitude tampering, velocity tampering, ghost
kinematics, integrity downgrade — cf. Habler & Shabtai, *Computers & Security* 2018).
Every record carries the deployed IsolationForest baseline's anomaly score; that model's
measured performance at training time: ROC-AUC 0.8943, detection rate
0.5424 at a 0.0254 false-positive rate
(threshold calibrated on held-out real traffic).

## Honest limitations
* Synthetic injection is a proxy for real attacks, not the real thing.
* Coverage is biased toward busy terminal areas in the capture regions.
* ADS-B is public broadcast data; no anonymisation is applied (hex/callsign/registration as broadcast).
* Single-snapshot kinematics (no trajectories) — a trajectory release is planned.
* `ias/tas/mach/mag_heading/track_rate/roll` come from enhanced-surveillance messages and are
  only broadcast by a subset of aircraft (~25-40% non-null). Expected sparsity, not data loss.
* `nac_v` is recorded **as-broadcast**: some encoders exceed the DO-260B nominal 0-4 range
  (values up to 7 appear in real feeds).
* Injected altitude values are clamped at -1000 ft (the Mode-S altitude encoding floor), so
  attack rows stay within what a real transponder could actually transmit.

## Columns
| column | type | description |
|---|---|---|
| `record_id` | int | sequential id |
| `label` | int | 0 = real normal traffic, 1 = injected attack |
| `attack_type` | str | null | altitude_tamper | velocity_tamper | ghost_kinematics | integrity_downgrade |
| `capture_ts_utc` | float | unix epoch seconds at capture |
| `hex` | str | ICAO 24-bit address (anonymisation: none — public broadcast data) |
| `callsign` | str | flight callsign (trimmed) |
| `registration` | str | tail registration if broadcast |
| `aircraft_type` | str | ICAO type designator (e.g. B738) |
| `category` | str | ADS-B emitter category (A0-C3) |
| `source` | str | message type (adsb_icao, mlat, ...) |
| `lat` | float | latitude deg |
| `lon` | float | longitude deg |
| `alt_baro_ft` | float | barometric altitude ft |
| `alt_geom_ft` | float | geometric (GNSS) altitude ft |
| `gs_kts` | float | ground speed kts |
| `ias_kts` | float | indicated airspeed kts |
| `tas_kts` | float | true airspeed kts |
| `mach` | float | Mach number |
| `track_deg` | float | ground track deg |
| `mag_heading_deg` | float | magnetic heading deg |
| `track_rate_dps` | float | turn rate deg/s |
| `roll_deg` | float | roll angle deg |
| `baro_rate_fpm` | float | barometric vertical rate ft/min |
| `geom_rate_fpm` | float | geometric vertical rate ft/min |
| `squawk` | str | transponder code |
| `nic` | float | navigation integrity category (0-11) |
| `nac_p` | float | navigation accuracy category, position (0-11) |
| `nac_v` | float | navigation accuracy category, velocity (0-4) |
| `sil` | float | source integrity level (0-3) |
| `rssi_dbfs` | float | received signal strength dBFS |
| `seen_s` | float | seconds since last message |
| `seen_pos_s` | float | seconds since last position |
| `geom_baro_alt_diff_ft` | float | |alt_geom - alt_baro| (tampering desyncs these) |
| `gs_mach_resid_kts` | float | |gs - mach*600| kinematic self-consistency |
| `baro_geom_rate_diff_fpm` | float | |baro_rate - geom_rate| |
| `track_hdg_diff_deg` | float | angular |track - mag_heading| |
| `iforest_score` | float | anomaly score 0-1 from the deployed baseline |
| `iforest_is_anomaly` | int | 1 if score crosses the FPR-calibrated threshold |

## Files
* `aeroscope-adsb-anomaly-benchmark-v1.csv` — flat table (this schema)
* `aeroscope-adsb-anomaly-benchmark-v1.jsonl` — one JSON object per row (same fields)

Generated 2026-06-06 02:16 UTC by the AeroScope pipeline.