How to detect ADS-B spoofing
ADS-B was built for openness, not security, its messages are unauthenticated, so a fabricated aircraft is technically possible. The good news: spoofed broadcasts almost always betray themselves by contradicting physics or their own metadata. Here are the signals that expose them, and how AeroScope applies every one.
ADS-B is unauthenticated by design
ADS-B messages carry no signature and no encryption, so any transmitter could, in principle, inject a fabricated position. Documented research has shown ghost aircraft, altitude tampering and velocity tampering are all feasible. That’s why a serious platform treats every broadcast as a claim to be verified, not a fact. See the basics on ADS-B technology.
How a spoof gives itself away
1 · Integrity-field mismatch
Real avionics report consistent NIC/NACp/NACv/SIL quality fields. A fabricated message often sets them wrong, or claims a precision its jittery track can’t support.
DO-260B2 · Physical implausibility
A Kalman filter predicts where the aircraft should be next. A spoof that "teleports", accelerates impossibly or violates its performance envelope fails the normalized-innovation (NIS) test, which flags a position as a statistical outlier once its NIS exceeds 9.21, the 99% threshold for two degrees of freedom.
KALMAN NIS3 · Self-inconsistency
Geometric-vs-barometric altitude, ground-speed-vs-Mach and track-vs-heading should agree on a real airframe. Contradictions between them betray a fabricated record.
RESIDUALS4 · Single-source / timing
A real aircraft is heard by several independent receivers. A target seen by only one network, or whose multi-receiver timing doesn’t add up, deserves suspicion.
CROSS-CHECKEvery broadcast, checked
AeroScope runs a DO-260B-style 7-check plus a Kalman normalized-innovation test and the three self-consistency residuals on every aircraft, every cycle, and fuses public ADS-B feeds so multi-receiver agreement is a free integrity signal. Suspect aircraft are surfaced with the contributing factors shown, see signal integrity and threat scoring. None of this uses a black-box neural network; it’s built on auditable, established methods.
What a spoof actually looks like in the data
Published research and observed incidents cluster into a handful of recognisable classes. Each leaves a different fingerprint, which is why several detectors are needed rather than one.
| Class | What the attacker does | How it betrays itself |
|---|---|---|
| Ghost aircraft (detail) | Injects an airframe that does not exist | No corroborating receiver geometry, integrity fields that do not match the claimed accuracy, and kinematics that are too clean or physically implausible. |
| Altitude tampering | Reports a false altitude for a real or fabricated track | The geometric and barometric altitudes stop agreeing, and the implied vertical rate conflicts with the reported one. |
| Velocity tampering | Reports speed or heading inconsistent with the track | Position deltas between messages do not integrate to the claimed velocity, and track diverges from heading beyond what wind can explain. |
| Replay | Rebroadcasts genuine historical messages | Timestamps and sequence behavior are inconsistent, and the same identity can appear in impossible places. |
| Jamming or flooding | Degrades reception rather than faking content | Not a content problem at all. It shows up as sudden coverage loss, which is a coverage symptom rather than an integrity one. |
The arithmetic that makes flags usable
Any single detector tuned sensitively enough to catch real spoofing will also fire on ordinary data problems: a marginal reception, a momentary GPS degradation, an aircraft genuinely manoeuvring hard. Run one detector across hundreds of aircraft every cycle and you generate a stream of alerts nobody will read.
AeroScope therefore requires at least two independent detectors to agree before raising a flag. Because the detectors look at genuinely different things, a physics residual, an integrity field, a trajectory model and a statistical outlier score, their errors are largely uncorrelated. Two agreeing is far less likely to be coincidence than one firing alone.
The cost is honest and worth stating: consensus reduces sensitivity. A spoof that only trips one detector will not be flagged. That is a deliberate trade in favour of a signal an analyst can actually trust.
Underneath, each aircraft accumulates a composite spoof score out of 100: a failed kinematic check adds 20, a failed position check 25, a failed altitude check 15, a duplicate ICAO address 40, a failed transponder check 15, cross-source disagreement 10, and a failed Kalman NIS test 20, with smaller additions for a large speed-consistency error and an unstable NIC value. The total is graded A (score 10 or under) through F (over 60), and a track is only surfaced as suspect once its score passes 25.
Checking a suspicious track by hand
Every check below uses fields the platform already displays, so you can reach your own conclusion rather than trusting the flag.
- Compare the altitudes. Geometric and barometric altitude should track each other with a plausible offset. A large or erratic divergence is the single most useful manual check.
- Integrate the positions. Successive positions and the time between them imply a speed. It should match the reported ground speed.
- Read the integrity fields. NIC, NACp, NACv and SIL describe how good the avionics claim their own data is. Values that are implausibly perfect, or inconsistent with the position noise you can observe, are suspicious.
- Check plausibility against the type. A light piston type reporting 500 knots at flight level 400 is not a detection problem, it is arithmetic. See aircraft types.
- Reproduce it. The open benchmark dataset contains labelled injected anomalies of exactly these classes, so you can test any detector, including ours, against it.