Identifiering av anomalier i Automatic Dependent Surveillance Broadcast med Explainable AI : Förbättrar tillit med SHapley Additive exPlanations

Automatic Dependent Surveillance–Broadcast (ADS-B) is a core component of modern air traffic management, enabling aircraft to broadcast real-time information such as position and velocity. However, the protocol lacks cryptographic protection, making it susceptible to spoofing, message injection, and data manipulation. In response to these threats, this thesis explores a reconstruction-based anomaly detection approach using Long Short-Term Memory (LSTM) autoencoders. The model is trained on a hybrid dataset consisting of real ADS-B data from the OpenSky Network and synthetic attack scenarios generated via AttackScope. A second model was also trained on a smaller dataset, which only used real data to verify the robustness. To address the "black box" nature of deep learning models, explainable AI (XAI) techniques are applied, with a primary focus on SHapley Additive exPlanations (SHAP) and a comparative evaluation using Local Interpretable Model-Agnostic Explanations (LIME). The LSTM autoencoder trained on the simulated data achieves strong performance, with a precision of 0.9951, a recall of 0.7588, and an AUC-ROC of 0.9591, confirming its ability to distinguish between benign and anomalous flight sequences. The model trained on the real data achieved a perfect score, getting a score of 1.0 inaccuracy, precision, recall, F1-Score and AUC-ROC. This further confirms its ability to differentiate between normal and anomalous flight behavior. SHAP visualizations provide global and local insight into model behavior. Features such as geo_altitude and long are consistently identified as key contributors to anomaly detection. The results also show distinct attribution patterns between the normal and manipulated sequences. Altough LIME offers supporting explanations, its higher variability suggests that SHAP is better suited for applications requiring interpretive stability. This study shows that using SHAP to explain LSTM-bases anomaly detection yields interpretable results without compromising classification performance, which may helpinform future deployment of machine learning tools in surveillance applications.