Mode S extended squitter anomaly and spoofing detection from LEO
Space-based receivers collecting Mode S extended squitter messages from multiple orbital vantage points can cross-validate message authenticity using TDOA geometry, kinematic physics and ICAO address consistency, catching spoofed or manipulated ADS-B traffic that ground networks routinely miss.
Sensors
- Aireon space-based ADS-B (Iridium NEXT): 66 operational LEO satellites at roughly 780 km altitude, each hosting an L-band ADS-B payload. Provides global coverage including oceanic and polar airspace with message latency typically under 8 seconds. Multiple satellites can receive the same 1090 MHz squitter simultaneously, enabling TDOA cross-checks across baselines of hundreds to thousands of kilometres.
- Spire aviation payload: Spire operates a constellation of 3U/6U CubeSats carrying 1090 MHz ADS-B receivers. Revisit geometry differs from Iridium NEXT, offering an independent reception chain whose message timestamps can be compared against Aireon observations for consistency checks on ICAO address, position and velocity fields.
- EUROCONTROL MUAC Mode S surveillance radar: Ground-based secondary surveillance radar at Maastricht UAC interrogates Mode S transponders independently of ADS-B self-reporting. EUROCONTROL publishes Mode S data quality studies that document observed anomaly rates, giving a calibration baseline against which space-based anomaly detectors can be validated.
- ITU-R and ICAO 1090 MHz signal standard: The physical layer of ADS-B is defined in ICAO Doc 9684 and RTCA DO-260B. Each extended squitter is 112 bits at 1090 MHz with known pulse timing. Deviations in bit timing, signal strength or Downlink Format fields are themselves anomaly indicators independent of the position payload.
What a squitter message actually contains, and why that matters
A Mode S extended squitter is a 112-bit broadcast transmitted at 1090 MHz roughly twice per second by any ADS-B Out-equipped aircraft. It carries a 24-bit ICAO address, a message type code, and a payload that can include GPS-derived position, barometric and GNSS altitude, ground speed, track angle, vertical rate and aircraft identification. The ICAO address is meant to be globally unique and tied to the aircraft's registration.
The critical word is 'meant'. The address is self-reported. Nothing in the 1090 MHz protocol cryptographically signs the message or binds it to a verified identity. A transmitter broadcasting a plausible ICAO address with plausible position data will be accepted by most ground receivers and, without additional cross-checks, will appear on air traffic displays as a real aircraft. That gap is the attack surface.
What multiple orbital receivers reveal that one cannot
When a single ground receiver hears a squitter, it records position and timestamp. When two or more LEO satellites hear the same squitter within milliseconds of each other, the time-difference-of-arrival between those receivers constrains where the signal actually originated. If the TDOA-derived source location disagrees with the position field inside the message by more than the expected GPS error budget (typically a few hundred metres for a well-functioning transponder), the message is flagged.
Aireon's payload on Iridium NEXT is particularly well suited to this because the Iridium constellation's orbital geometry means that at cruise altitudes, multiple satellites frequently have line-of-sight to the same aircraft simultaneously. The baseline separations involved, hundreds to several thousand kilometres, give TDOA hyperbolas that intersect with useful precision. Published work from the aviation surveillance community puts TDOA-based position accuracy for space-based ADS-B in the range of one to a few nautical miles under favourable geometry, which is sufficient to detect the gross position falsification that characterises most spoofing events.
Spire's independent receiver chain adds a second, architecturally separate observation. Disagreement between Aireon and Spire timestamps for the same ICAO address and message sequence number is itself an anomaly indicator, independent of any position calculation.
Kinematic impossibilities and ICAO address collisions
TDOA is not the only detection path. A significant fraction of anomalous ADS-B traffic is detectable from the message content alone, without any cross-receiver geometry. Kinematic screening compares successive position and velocity reports against the flight envelope of the declared aircraft category. A message sequence showing a commercial transport accelerating at 5g, climbing at 60,000 feet per minute, or teleporting 200 nautical miles between consecutive squitters fails basic physics. These checks are straightforward to automate and have been documented in academic literature using EUROCONTROL and OpenSky Network datasets.
ICAO address duplication is a related but distinct problem. The 24-bit address space contains roughly 16.7 million codes, but active aircraft number in the tens of thousands globally. Duplicate ICAO addresses appearing simultaneously in geographically separated airspace are either a spoofing attempt or a misconfigured transponder, both of which warrant investigation. Space-based receivers with global simultaneous coverage are better placed to catch simultaneous duplicates than regional ground networks, which may each see only one instance.
Altitude inconsistency between the barometric altitude field and the GNSS altitude field within the same squitter is a subtler indicator. Legitimate aircraft show a consistent offset between the two that varies predictably with atmospheric pressure. Spoofed messages generated without access to current METAR data often show implausible offsets or no offset at all.
Honest limits of the method
Space-based ADS-B detection is not infallible and the anomaly-detection layer adds its own uncertainty. TDOA accuracy degrades when only one satellite has line-of-sight, which still occurs over some oceanic and polar regions depending on constellation geometry at the moment of interest. At lower altitudes, particularly below 10,000 feet, LEO satellite visibility angles become shallow and message reception rates drop.
Kinematic screening produces false positives. Aerobatic aircraft, military fast jets and certain test flights generate manoeuvre profiles that a civilian-envelope model will flag incorrectly. Any operational anomaly-detection system needs a continuously updated aircraft-type database and a human review tier for ambiguous cases.
The method also cannot detect spoofing that is physically consistent. A sophisticated adversary who knows an aircraft's true position, constructs a plausible kinematic sequence and transmits from a location close to the claimed position can defeat TDOA checks if the position error is within the measurement noise. The detection capability is real but not absolute, and it should be layered with ground radar cross-checks where available.
Operational contexts where this matters
The most documented operational concern is conflict-zone airspace. Multiple incidents since 2019 have been attributed to GNSS spoofing affecting aircraft navigation, with knock-on effects on ADS-B position accuracy because many transponders derive their broadcast position from the same GNSS receiver being spoofed. Space-based anomaly detection can distinguish between a transponder faithfully reporting a spoofed GPS position (a navigation integrity problem) and a ground transmitter injecting entirely fabricated squitters (an ADS-B integrity problem). The distinction matters for the response.
Oceanic airspace management is a second context. Over the North Atlantic and Pacific, where radar coverage is absent, ADS-B is the primary surveillance tool. Anomalous messages in these regions have a direct effect on separation assurance. Aireon's network was specifically designed to address the oceanic surveillance gap, and the TDOA cross-check capability is a natural extension of that infrastructure.
Regulatory and insurance applications form a third tier. Aviation regulators and hull insurers increasingly need verified track records for aircraft operating in contested or sanctioned airspace. An audit trail that flags message anomalies, with timestamps, satellite IDs and TDOA residuals, is a more defensible record than raw ADS-B position logs.
Satellize can configure anomaly-screening pipelines against Aireon and Spire data streams for clients who need a dedicated monitoring product rather than access to a shared commercial feed. The analytical approach mirrors the statistical screening methods we apply in other domains, including the crop-estimation work we run for the Kingdom of Tonga, where the underlying discipline is the same: separating signal from artefact in a noisy broadcast environment.
What a delivered product looks like
A practical anomaly-detection output is not a raw flag on every suspicious message. The volume of global ADS-B traffic, estimated at billions of messages per day across the Aireon network, makes undifferentiated alerting unworkable. The deliverable is a scored anomaly feed: each flagged event carries a confidence score derived from the combination of checks that triggered it, the number of independent satellite observations, the TDOA residual magnitude, and the kinematic deviation from expected flight envelope.
High-confidence events, those where TDOA disagrees with the position field by more than five nautical miles and kinematic screening also fails, are surfaced as priority alerts. Lower-confidence events enter a review queue. The output format is typically a structured feed compatible with existing air traffic management systems, with optional GIS layers for spatial analysis of anomaly clustering by region or time window.
Typical figures
| Operating frequency | 1090 MHz (Mode S extended squitter, Downlink Format 17/18/19) |
| Primary space-based network | Aireon on Iridium NEXT, 66 operational LEO satellites at ~780 km altitude |
| Message latency (Aireon) | Typically under 8 seconds from transmission to ground delivery |
| TDOA position accuracy (space-based) | Approximately 1 to a few nautical miles under favourable multi-satellite geometry; degrades at low elevation angles |
| Coverage | Global, including oceanic and polar airspace above approximately 5,000 ft (reception rate altitude-dependent) |
| ICAO address space | 24-bit field, ~16.7 million codes; duplicate detection requires simultaneous global observation |
| Kinematic screening envelope | Configurable by aircraft category; commercial transport defaults flag accelerations above ~0.5g sustained and vertical rates above ~8,000 ft/min |
| Archive depth | Aireon operational since 2019; Spire aviation data from approximately 2018; historical replay available for retrospective audit |
| Anomaly score output | Per-message confidence score combining TDOA residual, kinematic deviation and address-collision flags |
| Delivery format | Structured JSON or CSV alert feed; optional GIS polygon layers for regional anomaly density mapping |
Analytics Satellize can run
| TDOA position-vs-broadcast discrepancy alert | Time-difference-of-arrival hyperbolic positioning using multi-satellite reception timestamps, compared against the GPS position field in the squitter payload | Per-event alert with TDOA-derived position, broadcast position, residual distance and satellite geometry quality indicator |
| Kinematic impossibility flag | Sequential message screening against published aircraft performance envelopes by ICAO category; acceleration, vertical rate and speed-of-advance checks | Flagged message sequences with deviation magnitude and aircraft-type context, delivered as a daily anomaly digest or real-time feed |
| Duplicate ICAO address collision report | Global simultaneous address-space monitoring across all received squitters; spatial separation threshold configurable by operator | Collision event log with timestamps, geographic positions of both instances and receiver satellite IDs |
| Barometric/GNSS altitude consistency score | Statistical comparison of the two altitude fields within each squitter against expected offset distributions derived from historical fleet data and current METAR pressure fields | Per-flight altitude-consistency time series; outlier events flagged with expected vs. observed offset |
| Regional anomaly density map | Spatial aggregation of flagged events by 1-degree grid cell over configurable time windows; hotspot identification using kernel density estimation | GIS raster or vector layer of anomaly density, updated daily or weekly, suitable for airspace risk assessment |
| Historical track audit for regulatory or insurance purposes | Retrospective replay of archived squitter data with anomaly screening applied post-hoc; chain-of-custody metadata preserved | Signed PDF audit report with per-flight anomaly timeline and confidence scores, plus machine-readable annex |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.