On Passive Data Link Layer Fingerprinting of Aircraft Transponders

In order to meet future demands in increasingly congested airspaces, the world's aviation authorities are currently upgrading their air-traffic management systems. The Automatic Dependent Surveillance-Broadcast (ADS-B) protocol is at the core of the Next Generation Air Transportation (NextGen) system, and an increasingly large number of aircraft use ADS-B to broadcast data to their surroundings. In this paper, we use differences in the implementation of aircraft transponders to fingerprint their wireless drivers. In particular, without any modification to either aircraft or the off-the-shelf ADS-B receivers that we use, we develop a passive fingerprinting technique that accurately and efficiently identifies the wireless implementation by exploiting variations in their transmission behavior. We perform an evaluation of our fingerprinting technique that shows it both quickly and accurately fingerprints aircraft transponders using real-world aircraft data. Furthermore, through cross-referencing our fingerprints with open source aircraft databases, we are able to infer potential aircraft types and fleet combinations, as well as general market proliferation of different transponder implementations. Finally, we discuss implications for the security and privacy of our approach as well as potential mitigating factors.