Toward realistic and lightweight intrusion detection for ADS-B: A comprehensive threat model and multi-attack machine learning evaluation

Automatic Dependent Surveillance–Broadcast (ADS-B) is a critical surveillance technology for modern air traffic management. However, the protocol’s open and unencrypted nature exposes it to significant cybersecurity threats. This paper presents a comprehensive and realistic intrusion detection system (IDS) for ADS-B based on machine learning (ML) models. Existing research has primarily focused on limited attack scenarios or binary classification (benign vs. malicious). In contrast, this study introduces a multi-attack evaluation framework covering nine distinct ADS-B attack types under realistic traffic conditions. A novel dataset is constructed by combining real-world ADS-B data from the OpenSky Network with simulated attack scenarios generated using an enhanced OpenScope platform. The dataset includes diverse attack types such as ghost injection, trajectory manipulation, spoofing, and message delay. Furthermore, a structured threat model based on STRIDE and CIA+A principles is proposed to systematically map vulnerabilities to attack behaviors. Three ML models: KNN, SVM, and XGBoost—are implemented and evaluated using multiple performance metrics, including accuracy, precision, recall, F1-score, MCC, ROC-AUC, and PR-AUC. Experimental results show that both KNN and XGBoost achieve high classification accuracy (98.16%) and (98%), significantly outperforming SVM (83%). KNN demonstrates strong macro-level performance (F1-score: 0.95) and low computational overhead, making it suitable for near real-time deployment. The real-time feasibility analysis indicates that the proposed system can support high-density air traffic scenarios through parallel processing. The findings highlight the effectiveness of lightweight ML-based IDS approaches for securing ADS-B communications, while also identifying challenges in detecting temporally subtle attacks such as message delay. To the best of our knowledge, this work is among the first to jointly evaluate multi-attack detection, dataset realism, and real-time deployment feasibility within a unified ADS-B intrusion detection framework.