{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T16:07:24Z","timestamp":1782403644682,"version":"3.54.5"},"reference-count":46,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2024,6,2]],"date-time":"2024-06-02T00:00:00Z","timestamp":1717286400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Deep learning has shown significant advantages in Automatic Dependent Surveillance-Broadcast (ADS-B) anomaly detection, but it is known for its susceptibility to adversarial examples which make anomaly detection models non-robust. In this study, we propose Time Neighborhood Accumulation Iteration Fast Gradient Sign Method (TNAI-FGSM) adversarial attacks which fully take into account the temporal correlation of an ADS-B time series, stabilize the update directions of adversarial samples, and escape from poor local optimum during the process of iterating. The experimental results show that TNAI-FGSM adversarial attacks can successfully attack ADS-B anomaly detection models and improve the transferability of ADS-B adversarial examples. Moreover, the TNAI-FGSM is superior to two well-known adversarial attacks called the Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM). To the best of our understanding, we demonstrate, for the first time, the vulnerability of deep-learning-based ADS-B time series unsupervised anomaly detection models to adversarial examples, which is a crucial step in safety-critical and cost-critical Air Traffic Management (ATM).<\/jats:p>","DOI":"10.3390\/s24113584","type":"journal-article","created":{"date-parts":[[2024,6,3]],"date-time":"2024-06-03T05:58:00Z","timestamp":1717394280000},"page":"3584","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Adversarial Attacks against Deep-Learning-Based Automatic Dependent Surveillance-Broadcast Unsupervised Anomaly Detection Models in the Context of Air Traffic Management"],"prefix":"10.3390","volume":"24","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9163-3126","authenticated-orcid":false,"given":"Peng","family":"Luo","sequence":"first","affiliation":[{"name":"School of Information and Navigation, Air Force Engineering University, Xi\u2019an 710051, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Buhong","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Information and Navigation, Air Force Engineering University, Xi\u2019an 710051, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1485-7465","authenticated-orcid":false,"given":"Jiwei","family":"Tian","sequence":"additional","affiliation":[{"name":"School of Information and Navigation, Air Force Engineering University, Xi\u2019an 710051, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-9816-9383","authenticated-orcid":false,"given":"Chao","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Information and Navigation, Air Force Engineering University, Xi\u2019an 710051, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yong","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Information and Navigation, Air Force Engineering University, Xi\u2019an 710051, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,6,2]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Wang, Y., Xiao, G., and Dai, Z. (2017). Integrated Display and Simulation for Automatic Dependent Surveillance\u2013Broadcast and Traffic Collision Avoidance System Data Fusion. Sensors, 17.","DOI":"10.3390\/s17112611"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Leonardi, M., and Sirbu, G. (2021). ADS-B Crowd-Sensor Network and Two-Step Kalman Filter for GNSS and ADS-B Cyber-Attack Detection. Sensors, 21.","DOI":"10.3390\/s21154992"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"102652","DOI":"10.1016\/j.cose.2022.102652","article-title":"CAE: Contextual auto-encoder for multivariate time-series anomaly detection in air transportation","volume":"116","author":"Antoine","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_4","first-page":"1338","article-title":"On Perception and Reality in Wireless Air Traffic Communication Security","volume":"18","author":"Strohmeier","year":"2017","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1066","DOI":"10.1109\/COMST.2014.2365951","article-title":"On the Security of the Automatic Dependent Surveillance-Broadcast Protocol","volume":"17","author":"Strohmeier","year":"2014","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"101599","DOI":"10.1016\/j.cose.2019.101599","article-title":"Online sequential attack detection for ADS-B data based on hierachical temporal memory","volume":"87","author":"Li","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1742","DOI":"10.1109\/TAES.2019.2933957","article-title":"An ADS-B Message Authentication Method Based on Certificateless Short Signature","volume":"56","author":"Wu","year":"2020","journal-title":"IEEE Aerosp. Electron."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/MAES.2021.3054681","article-title":"On jamming attacks in crowdsourced air traffic surveillance","volume":"36","author":"Leonardi","year":"2021","journal-title":"IEEE Aerosp. Electron."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"3150","DOI":"10.1109\/TVT.2015.2438171","article-title":"Adaptive Air-to-Ground Secure Communication System Based on ADS-B and Wide-Area Multilateration","volume":"65","author":"Nijsure","year":"2016","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"12651","DOI":"10.1109\/JIOT.2023.3252809","article-title":"GAN-LSTM-Based ADS-B Attack Detection in the Context of Air Traffic Control","volume":"10","author":"Yue","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1186\/s13638-020-01756-8","article-title":"ADS-B spoofing attack detection method based on LSTM","volume":"2020","author":"Wang","year":"2020","journal-title":"EURASIP J. Wirel. Commun."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"155","DOI":"10.1016\/j.cose.2018.07.004","article-title":"Using LSTM encoder-decoder algorithm for detecting anomalous ADS-B Messages","volume":"78","author":"Habler","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"102213","DOI":"10.1016\/j.cose.2021.102213","article-title":"ADS-B anomaly data detection model based on VAE-SVDD","volume":"104","author":"Luo","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_14","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_15","unstructured":"Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial Machine Learning at Scale. arXiv, 2016."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1843","DOI":"10.1109\/TAES.2021.3124199","article-title":"Analyzing Sequences of Airspace States to Detect Anomalous Traffic Condition","volume":"58","author":"Habler","year":"2022","journal-title":"IEEE Trans. Aerosp. Electron. Syst."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"101789","DOI":"10.1016\/j.cose.2020.101789","article-title":"Dynamic temporal ADS-B data attack detection based on sHDP-HMM","volume":"93","author":"Li","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Qiu, S., Liu, Q., Zhou, S., and Wu, C. (2019). Review of artificial intelligence adversarial attack and defense technologies. Appl. Sci., 9.","DOI":"10.3390\/app9050909"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1007\/s11633-019-1211-x","article-title":"Adversarial attacks and defenses in images, graphs and text: A review","volume":"17","author":"Xu","year":"2019","journal-title":"Int. J. Autom."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: Attacks and defenses for deep learning","volume":"30","author":"Yuan","year":"2019","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_21","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Goswami, G., Ratha, N., Agarwal, A., Singh, R., and Vatsa, M. (2018, January 2\u20137). Unravelling robustness of deep learning-based face recognition against adversarial attacks. Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LA, USA.","DOI":"10.1609\/aaai.v32i1.12341"},{"key":"ref_23","unstructured":"Fawaz, H.I., Forestier, G., Weber, J., Idoumghar, L., and Muller, P.A. (2019, January 14\u201319). Adversarial attacks on deep neural networks for time series classification. Proceedings of the 2019 International Joint Conference on Neural Networks, Budapest, Hungary."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1734","DOI":"10.1109\/LWC.2020.3002914","article-title":"Adversarial Examples on Deep-Learning-Based ADS-B Spoofing Detection","volume":"9","author":"Shang","year":"2020","journal-title":"IEEE Wirel. Commun. Lett."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"78","DOI":"10.1016\/j.ijcip.2018.11.003","article-title":"Sequential collaborative detection strategy on ADS-B data attack","volume":"24","author":"Li","year":"2019","journal-title":"Int. J. Crit. Infrastruct."},{"key":"ref_26","unstructured":"Costin, A., and Francillon, A. (2012, January 21\u201326). Ghost in the Air Traffic: On insecurity of ADS-B protocol and practical attacks on ADS-B devices. Proceedings of the Black Hat, Las Vegas, NV, USA."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"3322","DOI":"10.1109\/JIOT.2018.2882633","article-title":"A Practical and Compatible Cryptographic Solution to ADS-B Security","volume":"6","author":"Yang","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"511","DOI":"10.1109\/TIV.2018.2873911","article-title":"ADS-Bsec: A Holistic Framework to Secure ADS-B","volume":"3","author":"Kacem","year":"2018","journal-title":"IEEE Trans. Intell. Veh."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Strohmeier, M., Lenders, V., and Martinovic, I. (2015, January 9\u201310). Intrusion Detection for Airborne Communication Using PHY-Layer Information. Proceedings of the 12th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Milan, Italy.","DOI":"10.1007\/978-3-319-20550-2_4"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Monteiro, M. (2015, January 13\u201317). Detecting malicious ADS-B broadcasts using wide area multilateration. Proceedings of the 2015 IEEE\/AIAA 34th Digital Avionics Systems Conference, Prague, Czech Republic.","DOI":"10.1109\/DASC.2015.7311579"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"107751","DOI":"10.1016\/j.asoc.2021.107751","article-title":"Temporal convolutional autoencoder for unsupervised anomaly detection in time series","volume":"112","author":"Thill","year":"2021","journal-title":"Appl. Soft Comput."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Cho, K., and Merrienboer, B. (2014, January 25\u201329). Learning Phrase Representations using RNN Encoder\u2013Decoder for Statistical Machine Translation. Proceedings of the Conference on Empirical Methods in Natural Language Processing, Doha, Qatar.","DOI":"10.3115\/v1\/D14-1179"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Goel, A., Singh, A., Agarwal, A., Vatsa, M., and Singh, R. (2018, January 22\u201325). Smartbox: Benchmarking adversarial detection and mitigation algorithms for face recognition. Proceedings of the 2018 IEEE 9th International Conference on Biometrics Theory, Applications and Systems, Redondo Beach, CA, USA.","DOI":"10.1109\/BTAS.2018.8698567"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"22399","DOI":"10.1109\/JIOT.2021.3111024","article-title":"Adversarial Attacks and Defenses for Deep-Learning-Based Unmanned Aerial Vehicles","volume":"9","author":"Tian","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Jadidi, Z., Pal, S., Nayak, N., Selvakkumar, A., Chang, C.C., Beheshti, M., and Jolfaei, A. (2022, January 25\u201328). Security of Machine Learning-Based Anomaly Detection in Cyber Physical Systems. Proceedings of the 2022 International Conference on Computer Communications and Networks, Honolulu, HI, USA.","DOI":"10.1109\/ICCCN54977.2022.9868845"},{"key":"ref_36","unstructured":"Li, T., Luo, W., Shen, L., Zhang, P., Ju, X., Yu, T., and Yang, W. (November, January 30). Adversarial sample detection framework based on autoencoder. Proceedings of the 2020 International Conference on Big Data & Artificial Intelligence & Software Engineering, Bangkok, Thailand."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1023\/B:MACH.0000008084.60811.49","article-title":"Support Vector Data Description","volume":"54","author":"Tax","year":"2004","journal-title":"Mach. Learn."},{"key":"ref_38","first-page":"163","article-title":"Optimization and global minimization methods suitable for neural networks","volume":"2","author":"Duch","year":"1998","journal-title":"ACM Comput. Surv."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Strohmeier, M., Martinovic, I., Fuchs, M., Sch\u00e4fer, M., and Lenders, V. (2015, January 13\u201317). OpenSky: A swiss army knife for air traffic security research. Proceedings of the 2015 IEEE\/AIAA 34th Digital Avionics Systems Conference, Prague, Czech Republic.","DOI":"10.1109\/DASC.2015.7311577"},{"key":"ref_40","unstructured":"Hosseini, H., Chen, Y., Kannan, S., Zhang, B., and Poovendran, R. Blocking transferability of adversarial examples in black-box learning systems. arXiv, 2017."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Goodfellow, I.J., Jha, S., Celik, Z.B., and Swami, A. (2017, January 2\u20136). Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates.","DOI":"10.1145\/3052973.3053009"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. (2016, January 22\u201326). Distillation as a defense to adversarial perturbations against deep neural networks. Proceedings of the 2016 IEEE Symposium on Security and Privacy, San Jose, CA, USA.","DOI":"10.1109\/SP.2016.41"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"1201","DOI":"10.14778\/3514061.3514067","article-title":"TranAD: Deep transformer networks for anomaly detection in multivariate time series data","volume":"15","author":"Tuli","year":"2022","journal-title":"Proc. VLDB Endow."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Deng, A., and Hooi, B. (2021, January 2\u20139). Graph Neural Network-Based Anomaly Detection in Multivariate Time Series. Proceedings of the AAAI Conference on Artificial Intelligence, Virtually.","DOI":"10.1609\/aaai.v35i5.16523"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Chen, J., and Michael, I. (2020, January 18\u201321). HopSkipJumpAttack: A Query-Efficient Decision-Based Attack. Proceedings of the 2020 IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Zhang, J., and Li, B. (2022, January 8\u201324). Towards Efficient Data Free Blackbox Adversarial Attack. Proceedings of the 2022 IEEE\/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01469"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/11\/3584\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T14:52:32Z","timestamp":1760107952000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/11\/3584"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,6,2]]},"references-count":46,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2024,6]]}},"alternative-id":["s24113584"],"URL":"https:\/\/doi.org\/10.3390\/s24113584","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,6,2]]}}}