TDOA-based Position Verification of ADS-B Information

Using a Sensor Network

Clemens Allmann∗ , Stefan Stanzel∗∗ , Christian Steffes∗
∗ Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE, Wachtberg, Germany
{clemens.allmann, christian.steffes}@fkie.fraunhofer.de
∗∗ DFS Deutsche Flugsicherung GmbH, Langen, Germany

[email protected]

Abstract—Automatic Dependent Surveillance-Broadcast transmitted transponder signals (like ADS-B) without having
(ADS-B) is an established surveillance technology providing to rely on the included position information [1]. The TDOA-
receivers with aircraft state information including aircraft based localization problem itself is well investigated [2]–[6].
position (Mode S). However, this position data might be
imprecise or even spoofed. Drawing the attention of an air Even though the costs of a single sensor node may be quite
traffic controller to aircraft sending false position data could low, the added costs of a dense sensor network can be quite
2022 Sensor Data Fusion: Trends, Solutions, Applications (SDF) | 978-1-6654-8672-9/22/$31.00 ©2022 IEEE | DOI: 10.1109/SDF55338.2022.9931704

enhance situational awareness, at the same time reduce work high resulting from maintenance, network connectivity and site
load, and increase general aviation safety. In this paper, we rent. It may also be beneficial to use a reduced coverage for
investigate the position verification together with localization of each sensor to avoid a high number of message collisions.
ADS-B transmitters using time difference of arrival (TDOA)
methods based on a synchronized sensor network to validate The idea of this contribution is not to estimate the position
ADS-B position information. of the emitter in the first place (which would require at least
the signal reception by four sensor nodes in a 3D scenario)
I. INTRODUCTION but to validate the transmitted ADS-B position. Only in the
Airspace surveillance and air traffic management rely on case of implausible information, the attention of an air traffic
the accurate knowledge of each aircraft’s position. The state controller needs to be directed towards the respective air-
of the art techniques to acquire necessary information basically craft. The investigated ADS-B messages are transmitted using
build upon three systems: Primary Surveillance Radar (PSR) the 1090 MHz extended squitter link. The discussion of the
which determines the position of the aircraft using active drawbacks of this technology mainly include non-encrypted
radar systems on ground, Secondary Surveillance Radar (SSR) information transmission [7] (everyone can identify the aircraft
where the aircraft’s position is derived by the angle between using the included ICAO address and track its position), the
the ground station and an aircraft’s response to interrogations possibility to send faulty information (accidentally or inten-
of the ground station, and Automatic Dependent Surveillance- tionally), and the extensively used frequency band without
Broadcast (ADS-B) where aircraft automatically and periodi- any channel access method or collision detection. However,
cally transmit information of their current state (position, etc.) the last mentioned drawback can also be exploited, since a lot
to ground stations and other planes. The position information of messages from different aircraft are received nearly at the
is derived by the plane using navigation systems, such as GPS, same time.
and barometric pressure sensors. The reliability and accuracy In [10], a statistical position verification technique and a
of the ADS-B position reports in its currently deployed stage grid-based position estimation approach was proposed to deal
however is limited. The data may even be actively spoofed. with attacks on modern air traffic communication networks. A
Especially, in highly congested airspace, where distances theoretical performance model for ADS-B position verification
between aircraft become relatively small, the received data using TDOA methods was presented in [11], where a model
has to be reliable and consistent. ADS-B position verification was derived by considering the effects of receiver aircraft
techniques, e.g. by checking for consistency between received geometry, TDOA accuracy, latency, self-localization accuracy,
signal measurements and decoded position, can be of assis- and detection threshold.
tance. In our previous work we have presented a method to
For gap-free wide area surveillance, radar systems can determine accurate TOAs of 1090 MHz transponder signals
be assisted and the overall coverage and accuracy can be [8], investigated various aspects of aircraft tracking using wide
enhanced by using passive emitter localization and multilater- area multilateration (WAM) [9], and presented field experi-
ation techniques. Time of Arrival (TOA) or Time Difference ments using a WAM sensor network [1]. Enriched by position
of Arrival (TDOA) measurements are one basis of position verification, this contribution considers a sensor network based
estimation. Therefore, an accurate time synchronization and a on realistic sensor node placement, synchronization accuracies
communication infrastructure to transmit its measurements to and sensor detection ranges. The general localization accuracy
one or multiple fusion centers/nodes is needed. is compared to the Cramér-Rao Lower Bound (CRLB), which
A multilateration sensor network with a large number of defines a lower bound on the achievable localization accuracy.
sensors is well suited to localize aircraft based on their Simulated ADS-B positions, realistic as well as flawed, are

Authorized licensed use limited to: University of Arizona. Downloaded on April 04,2025 at 17:23:32 UTC from IEEE Xplore. Restrictions apply.
successfully validated with an automatic threshold adjustment Estimating the emitter position requires a set of sufficient
even by only using two sensors out of the full network. As an TOA measurements τn , n ∈ {1, . . . , N } taken by N sensors
application this work can be used to assess ADS-B sensor in- (might vary over time instances). These TOA measurements
frastructure in terms of possible localization performance and translate to a full TDOA measurement set of all possible
further safety features in form of ADS-B position verification. combinations of TDOA pairings without repetition
II. P ROBLEM F ORMULATION {τ̂a,b }, a ∈ {1, . . . , N − 1}, b ∈ {a + 1, . . . , N }, a 6= b .
To approach the position verification we start by modeling
the general TDOA problem as in [1]. Here, a network of N Hence, this full TDOA set contains M = N (N − 1)/2
spatially distributed stationary sensors observe appropriate RF measurements.
signals of Q emitters in a synchronized manner. Let the sensor 1) Detection Range: In practice, sensor nodes are often
positions be given by pn = (xn , yn , zn )T , n ∈ {1, . . . , N }. placed over large areas and not all sensor nodes receive the
The unknown position of a corresponding emitter is denoted correspondent emitter signal due to signal range limitations. To
by x = (xe , ye , ze )T , see Fig. 1. model this behavior a detection range per sensor is introduced.
Each sensor node has a specific detection range rn , up to
where a signal can be received (see green circles in Fig. 1).
The emitter lies within the detection range of the n-th sensor
and a TOA measurement can be (correctly) measured, if

k∆pn (x)k ≤ rn . (3)

This means generally, only a subset consisting of M 0 ≤ M

sensor pairs may be able to contribute with TDOA measure-
ments.
Generally, TDOA measurements can be geometrically in-
terpreted as hyperbola (2D) or hyperboloids (3D). Those
Fig. 1: Exemplary scenario with three sensor nodes (black hyperbola or hyperboloids are representing all possible emitter
dots), emitter (red cross) and detection ranges (green circles). positions explaining this measurement. Under ideal conditions,
the intersection of those hyperboloids yields the emitter posi-
tion.
A. TDOA Measurement Model
The relative vector between sensor and emitter reads B. Localization
∆pn (x) = x − pn and therefore, the corresponding propa- As in our previous work, we use a two-step localization
gation time is represented by approach based on TOA/TDOA measurements. Fortunately,
tn (x) = k∆pn (x)k/c , this approach does not require to transmit raw signal data
between sensor nodes, which would become rather expensive
where c is the signal propagation speed (ideal propagation in terms of infrastructural costs. If appropriate sensor hardware
assumed) and k · k is the Euclidean norm. With te as the un- was available, it would also be possible to make use of Angle
known signal emission time, the respective TOA measurement of Arrival (AOA) or Frequency Difference of Arrival (FDOA)
at sensor n ∈ {1, . . . , N } can be modeled by measurements for localization and position verification pur-
poses.
τ̂n = tn (x) + te + vn , (1)
After a sufficient number of corresponding signals is re-
where vn ∼ N (0, στ2n ) is temporally uncorrelated Gaussian ceived at different sensor nodes, a TDOA measurement set
noise representing sensor measurement and synchronization is generated and a closed-form TDOA solution [1] is utilized
aspects. The unknown emission time can now be eliminated to initialize a Maximum-Likelihood Estimator (MLE). The re-
by calculating the TDOA (measurement) of the signal received sulting optimization problem over all possible emitter positions
at two spatially separated sensors (a, b) x is then denoted by
k∆pa (x)k − k∆pb (x)k x̂ = arg min TDOACF (x) , (4)
τ̂a,b = τ̂a − τ̂b = + va,b , (2) x
c
where va,b ∼ N (0, στ2a + στ2b ) . where the cost function with respect to the emitter position x
In this paper, we refer to a TDOA measurement using reads
M0
the notation τ̂(m) = τ̂a,b . The true (noiseless) TDOA is X (τ(m) (x) − τ̂(m) )2
adressed by τ(m) (x) = τa,b (x) = ta (x) − tb (x), respectively. TDOACF (x) = . (5)
m=1
στ2(m)
Specific reference to time instances is omitted without loss of
generality, since position verification will be performed every In this paper, the Nelder/Mead simplex method [12] has been
single time instance separately. used to solve the optimization problem in (4).

Authorized licensed use limited to: University of Arizona. Downloaded on April 04,2025 at 17:23:32 UTC from IEEE Xplore. Restrictions apply.
C. Verification Problem The Fisher Information matrix for the TDOA-based emitter
Under the assumption of a sufficient number of TDOA localization problem using a sensor network with N 0 sensor
measurements (and good localization geometry), the proposed nodes in detection range and the assumption of correlated
ADS-B position verification considers an aircraft emitter po- measurement errors can then be expressed by (see [3])
sition as valid, if the estimated emitter position is consistent  ∂τ1,2 ∂τ1,3 ∂τ1,N 0 
with the appropriately decoded ADS-B/Mode-S position in- ∂xe ∂xe ... ∂xe
formation. 
∂τ1,2 ∂τ1,3 ∂τ1,N 0

 −1
JTDOA (x) =  ... R

However, due to the range limitations of the sensor nodes  ∂ye ∂ye ∂ye 
(see (3)), the number of correctly receiving sensor nodes might ∂τ1,2 ∂τ1,3 ∂τ1,N 0
not be sufficient to completely solve the localization problem. ∂ze ∂ze ... ∂ze
 ∂τ1,2 ∂τ1,2 ∂τ1,2 
As described before, it is not possible to estimate the emitter ∂xe ∂ye ∂ze
position in a 2D plane with only two sensors, i.e. one resulting 
 ∂τ1,3 ∂τ1,3 ∂τ1,3


TDOA measurement implying all possible emitter positions  ∂xe ∂ye ∂ze 
, (8)
 
located on a hyperbola. But exactly this information about 
 .. .. .. 
possible emitter positions can be utilized to compare with  . . . 
 
the decoded ADS-B position. If the ADS-B position fits the ∂τ1,N 0 ∂τ1,N 0 ∂τ1,N 0
TDOA measurement(s) in terms of (5), the ADS-B position ∂xe ∂ye ∂ze
gets a low verification score and is therefore considered valid. with R being the matrix of the TOA measurement variances
The verification score consists of the root mean squared error
over all measured TDOAs for sensors in range (or just one στ21 + στ22 στ21 στ21
 
...
TDOA of one sensor pair) compared to the TDOAs derived  στ21 στ1 + στ23
2
... στ21 
from the transmitted ADS-B position and the positions of R= .. .. .. . (9)
 
..
the sensor nodes. In case of only two sensors in range, the
 . . . . 
verification problem becomes challenging, especially if a false στ21 στ21 ... στ21 + στ2N 0
ADS-B position lies on the hyperbola (2D) corresponding to In the simulation results, the term RCRLB denotes the square
the TDOA measurement. However, this becomes unlikely to root of the corresponding diagonal entry of the CRLB to
happen for every ADS-B position over time. compare it with the localization error.
III. C RAM ÉR -R AO L OWER B OUND (CRLB) IV. SIMULATIONS
To get a prediction of the ideal achievable localization Now, the TDOA localization and position verification is ap-
accuracy of certain areas and its effect on position verification, plied in a simulation environment considering realistic sensor
the CRLB can be analyzed. The CRLB provides a lower bound placement.
on the estimation accuracy and its parameter dependencies
reveal characteristic features of the estimation problem. The
parameters to be estimated
T from the available sensor data
T = τ̂(1) , . . . , τ̂(M 0 ) are given by the emitter state x. In
this case, the CRLB is related to the covariance matrix C of
the estimation error 4x = x− x̂(T ) of any unbiased estimator
x̂(T ) as
C = E 4x 4xT ≥ J−1 (x) ,

(6)
where the inequality means that the matrix difference is
positive semidefinite. If the estimator attains the CRLB then
it is called efficient. The CRLB is given by the inverse Fisher
Information Matrix (FIM) [13]
(  T )
∂L(T ; x) ∂L(T ; x)
J(x) = E , (7)
∂x ∂x
where L denotes the log-likelihood function.
A. Cramér-Rao Lower Bound (CRLB) for TDOA-based Emit-
ter Localization
The TDOA measurements might generally not be indepen-
dent from each other, since they are gained by subtracting Fig. 2: Investigated scenario. Area of interest (blue border),
TOA measurements. As described before, the variance of the sensor positions (black dots) and coverage (colormap).
TDOA measurement τa,b is στ2a,b = στ2a + στ2b .

Authorized licensed use limited to: University of Arizona. Downloaded on April 04,2025 at 17:23:32 UTC from IEEE Xplore. Restrictions apply.
 Fig. 3: Ideally achievable XY localization accuracy (RCRLB, [m]). On the left for στn = 25 ns, right for στn = 100 ns.

A. Investigated Scenario suboptimal due to sensor coverage and geometry (even no

A simulated scenario with a sensor network deployed in the localization possible, in white). When looking at higher TOA
north east of Germany is investigated. N = 13 sensors with noise, the areas with good accuracies start around 50 m (blue)
specific detection ranges rn are considered. 7 sensors have and are naturally smaller in size with an increasing number of
a detection range of 100 NM (nautical miles), 2 sensors 60 red areas. Especially the red belt reaching from West of Berlin
NM and the remaining 4 sensors detect emitters up to 80 NM. to the South-East shows that the localization is challenging
An area of interest is defined which roughly includes the east considering the full area of interest. These red ”gaps” in the
part of germany (see Fig. 2) with Berlin in the center. The ideal localization performance are particularly interesting for
sensors are assumed to have TOA measurement accuracies of the position verification approach.
στn = {25, 100} ns standard deviation, depending on the simu- 2) Localization Simulation: As a second step to face the
lation run. This implicitly incorporates sensor synchronization position verification, the localization accuracy is evaluated in
aspects. Whereas the better measurement accuracy is suited for a Monte-Carlo-Simulation with 1000 runs by considering two
well synchronized sensor networks, the 100 ns accuracy should target trajectories (see colored plots in Fig. 4, foremost left).
represent a worst case synchronization scenario. Aircraft as Whereas aircraft Target 1 flies from West to East, Target 2
emitters were assumed to fly in a fixed altitude of 20, 000 ft. flies from South to North, both at 20, 000 ft altitude. In the
middle and right of Fig. 4, the XY-localization error (red
B. Results crosses) is plotted together with the corresponding square root
As can be seen from the coverage of the sensors in Fig. 2, of the CRLB (blue line) over flight time (index). Here, the
there are areas with a coverage of up to 9 sensor nodes (in localization accuracy can be seen in more detail. First of all,
red) that promise good localization and verification results. the simulation is consistent with the CRLB (blue line). The
However, there exist blue areas, especially in the North, with influence of sensor synchronization can be seen by comparing
less coverage down to even 2 sensors. The question that top (high TOA accuracy) with bottom (low TOA accuracy)
now naturally arises is whether the coverage in blue areas plots. For Target 1, the lower TOA accuracy degrades the
is sufficient for the proposed ADS-B position verification? localization error by around 36 m at flight time 116 (best
1) Achievable Localization Accuracy: The results start with localization error) compared to higher TOA accuracy. For
a general analysis of the ideally achievable TDOA localization Target 2, the localization error is affected by around 26 m
accuracy by evaluating the CRLB for the investigated scenario. at flight time 147, respectively. Further error deterioration is
Fig. 3 shows the resulting heatmap in terms of XY(Lon/Lat)- due to the ”gaps” in the localization performance because of
accuracy [m] for TOA accuracies of 25 ns (left) and 100 ns geometry and coverage as described in IV-B1.
(right), respectively. For small TOA measurement noise, the 3) Position Verification Simulation: Fortunately, our pro-
ideal accuracy starts around 12 m (blue) and is cut above posed position verification technique can handle these gaps in
200 m (red), where the localization accuracy can be considered the localization performance quite well, even in the case of

Authorized licensed use limited to: University of Arizona. Downloaded on April 04,2025 at 17:23:32 UTC from IEEE Xplore. Restrictions apply.
 xy RCRLB, = 25 ns
TOA
200 RCRLB vs. Simulation, TOA
= 25 ns RCRLB vs. Simulation, TOA
= 25 ns
55 Target 1 Target 2
180 200 200
RCRLB RCRLB
54 180 RMSE Sim 180 RMSE Sim
160

160 160
53 140

140 140
120
52

xy-Error/[m]

xy-Error/[m]
120 120
Latitude

rcrlb/[m]
100
51 100 100

80
80 80
50

60 60 60
49
40
40 40

48 20 20
20

0 0
47 0 20 40 60 80 100 120 140 160 180 200 20 40 60 80 100 120 140 160 180 200
5 6 7 8 9 10 11 12 13 14 15
Longitude Index Index

xy RCRLB, = 100 ns
TOA
200 RCRLB vs. Simulation, TOA
= 100 ns RCRLB vs. Simulation, TOA
= 100 ns
55 Target 1 Target 2
180 200 200
RCRLB RCRLB
54 180 RMSE Sim 180 RMSE Sim
160

160 160
53 140

140 140
120
52
xy-Error/[m]

xy-Error/[m]
120 120
Latitude

rcrlb/[m]

100
51 100 100

80
80 80
50

60 60 60
49
40
40 40

48 20 20
20

0 0
47 0 20 40 60 80 100 120 140 160 180 200 20 40 60 80 100 120 140 160 180 200
5 6 7 8 9 10 11 12 13 14 15
Longitude Index Index

Fig. 4: Simulated aircraft trajectories (left) and corresponding localization results (right) as XY-Error [m] plotted over flight
time (index). On the top for στn = 25 ns, on the bottom for στn = 100 ns.

lower TOA measurement accuracy of 100 ns, as can be seen verification, the false targets are almost all correctly assigned
in Fig. 5. Here, 10 simulated targets (Q = 10) are flying over with red scores, see Fig. 5, on the right. The threshold at
the area of interest. 8 of these targets have ADS-B position which positions are considered invalid is here automatically
errors with standard deviation in XYZ-space according to adjusted. If more than one TDOA measurement is available
σ = (100, 100, 100) m (colored in blue). 2 targets broadcast from the sensor network, the TDOA from the sensor pair with
false position information according to errors with standard the maximum TDOA value is selected. This shows that the
deviations of σ = (100, 2000, 100) m (colored in red from position verification also works by just using 2 sensors, i.e. in
West to East) and σ = (2000, 2000, 2000) m (colored in red areas, where sensor coverage might be sparse.
from South to North). Already by inspecting the color of
the target trajectories, false targets can be correctly identified, V. CONCLUSION
since a red color denotes a high verification score. In this contribution, the general TDOA localization perfor-
On the left of Fig. 5, the position verification approach mance and ADS-B position verification by a sensor network
uses all possible sensors that are in detection range to the with realistic operational placement considering sensor detec-
target. The ADS-B position is validated for every single flight tion ranges and sensor synchronization has been investigated.
time index as a ”one-shot-verification”, no fusion over time The proposed position verification works well and can cor-
(tracking) is applied. So, every flight time index, the targets get rectly identify false ADS-B messages, even under suboptimal
automatically assigned to corresponding verification scores, synchronization conditions and by using two sensors only.
depicted in the colormap. Whereas with a low (blue) score the Overall, this kind of work could be used when choosing
ADS-B position is considered valid, it is considered invalid or different sensor sites in operational applications to get a
false with a higher (red) score. Invalid ADS-B positions could general overview of the possible localization capabilities and
then be processed and signalized to an air traffic controller dependencies between different sensor characteristics. This
to enhance situational awareness and increase general aviation could help to minimize infrastructural costs and add possible
safety. If enough sensors detect the signal, the aircraft position safety features. The herein presented methods are the foun-
calculated using the proposed TDOA localization methods dation of further investigations into our position verification
could even be used to initiate further steps. approach with its limitations and extensions. In the future,
Even by only using a single sensor pair for the position combining TDOA with other localization methods such as

Authorized licensed use limited to: University of Arizona. Downloaded on April 04,2025 at 17:23:32 UTC from IEEE Xplore. Restrictions apply.
 ADS-B Verification, = 100 ns ADS-B Verification, TOA
= 100 ns
TOA
All Sensors in Range TDOAmax-Pair of Sensors in Range

55 55
11
9

10 54
54
8

53 53 7
8

Scaled Verification Score

Scaled Verification Score
6
52 7 52

Latitude
Latitude

6 5
51 51

5
4

50 50
4
3

3
49 49
2
2

48 48
1
1

47 47
5 6 7 8 9 10 11 12 13 14 15 5 6 7 8 9 10 11 12 13 14 15
Longitude Longitude

Fig. 5: Results of proposed position verification: by all sensors in range (left) and by only 2 sensors (right).

AOA or FDOA, might enhance the position verification pro- [8] C. Steffes, R. Kaune, and S. Rau, “Determining Times of Arrival of
cess. Almost certainly, tracking valid and invalid emitter posi- Transponder Signals in a Sensor Network using GPS Time Synchroniza-
tion,” in Informatik 2011 - 6th Workshop Sensor Data Fusion: Trends,
tions over time (filtering) is going to increase the verification Solutions, Applications, Berlin, Germany, October 2011.
performance and mitigate outliers. [9] R. Kaune, C. Steffes, S. Rau, W. Konle, and J. Pagel, “Wide Area
Multilateration using ADS-B Transponder Signals,” in 15th International
ACKNOWLEDGMENT Conference on Information Fusion, Singapore, July 2012.
[10] M. Strohmeier, V. Lenders, and I. Martinovic, “Lightweight location
This work was supported by the research program LuFo verification in air traffic surveillance networks,” in Proceedings of
the Cyber-Physical System Security Workshop (CPSS), ser. CPSS ’15,
V-3 (Luftfahrtforschungsprogramm) of the German Federal Singapure, April 2015.
Ministry for Economic Affairs and Climate Action (BMWK, [11] J. Naganawa and H. Miyazaki, “A theory of aircraft position verification
formerly BMWi). using tdoa,” in 2018 Asia-Pacific Microwave Conference (APMC), 2018,
pp. 833–835.
[12] J. A. Nelder and R. Mead, “A simplex method for function minimiza-
R EFERENCES tion,” Computer Journal, vol. 7, pp. 308–313, Jan. 1965.
[1] C. Steffes, W. Konle, and W. Koch, “TDOA/TOA-based Geolocation [13] S. M. Kay, Fundamentals of statistical signal processing. Prentice Hall,
using ADS-B Transponder Signals - Experimental Results,” in Sensor 1993.
Data Fusion: Trends, Solutions, Applications (SDF 2017), Bonn, Ger-
many, October 2017.
[2] K. Ho and Y. Chan, “Solution and performance analysis of geolocation
by TDOA,” IEEE Trans. Aerosp. Electron. Syst., vol. 29, pp. 1311–1322,
Oct. 1993.
[3] T. Sathyan, M. Hedley, and M. Mallick, “An analysis of the error char-
acteristics of two time of arrival localization techniques,” in Proc. ISIF
13th International Conference on Information Fusion, Edinburgh, UK,
Jul. 2010, pp. 4593–4598.
[4] R. Kaune, D. Musicki, and W. Koch, “On passive emitter tracking in
sensor networks,” in Sensor Fusion and its Applications, C. Thomas,
Ed. InTech, 2010, ch. 13, pp. 293–318.
[5] D. J. Torrieri, “Statistical theory of passive location system,” IEEE Trans.
Aerosp. Electron. Syst., vol. 20, pp. 183–198, Mar. 1984.
[6] A. Amar and A. J. Weiss, “Direct geolocation of stationary wideband
radio signal based on time delays and doppler shifts,” in Proc. 15th
Workshop on Statistical Signal Processing, Cardiff, Wales, Sep. 2009,
pp. 101–104.
[7] M. Strohmeier, M. Schäfer, R. Pinheiro, V. Lenders, and I. Martinovic,
“On perception and reality in wireless air traffic communication secu-
rity,” IEEE Transactions on Intelligent Transportation Systems, vol. 18,
no. 6, pp. 1338–1357, 2017.

Authorized licensed use limited to: University of Arizona. Downloaded on April 04,2025 at 17:23:32 UTC from IEEE Xplore. Restrictions apply.