Airspace awareness from open ADS-B data

For most of aviation history, "who is flying over this region right now?" was a question only air navigation service providers could answer well. Today a researcher with a laptop can query open ADS-B data for most of the commercial traffic over Europe or North America. That shift is real and useful for safety research, crisis response, environmental studies and newsroom verification. It is also easy to over-trust. This post explains how ADS-B works, what open networks can and cannot tell you, and how we model a fused air picture in Kimo Defense Intelligence.

§01What is ADS-B and how does it work?

ADS-B (Automatic Dependent Surveillance–Broadcast) is a surveillance technique in which an aircraft determines its own position, usually from GNSS, and broadcasts it together with other state data. It is automatic because no pilot or controller input is needed, dependent because it depends on the aircraft's own navigation system, and broadcast because anyone with a receiver can listen. On the widely used 1090 MHz Extended Squitter link, each message is a 112-bit frame carrying a 24-bit ICAO aircraft address and a 56-bit payload whose first five bits, the type code, say what the message contains: identification, surface position, airborne position, velocity or status¹Source 1 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle: ADS-B basicsmode-s.org.

Broadcast rates differ by message type. Under ADS-B version 2, airborne position and airborne velocity are each sent at about 2 Hz, identification at 0.2 Hz in flight, and aircraft status jumps from 0.2 Hz to 1.25 Hz when the squawk code changes¹Source 1 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle: ADS-B basicsmode-s.org. That last detail matters for alerting: a change of transponder code is announced more frequently, so an emergency code reaches receivers quickly.

Every position also comes with quality indicators. NIC (Navigation Integrity Category) expresses a containment radius the aircraft is confident its true position lies within, and NACp (Navigation Accuracy Category for position) expresses a 95% accuracy bound; NACp 9, for example, means the estimated position uncertainty is under 30 m²Source 2 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle: Uncertainty, accuracy and integritymode-s.org. These fields are easy to ignore when you only want dots on a map. They turn out to be the most interesting part of the feed, as we explain in Mapping GNSS interference with ADS-B quality indicators.

§02What can open receiver networks actually see?

A single ADS-B receiver is a small radio, an antenna and a decoder. Networks aggregate thousands of them. The OpenSky Network, built by academic researchers, started as a sensor network in Central Europe; its founding paper reported coverage of roughly 720,000 km² and more than 30% of European commercial air traffic after about two years of operation⁴Source 4 · Schäfer, Strohmeier, Lenders, Martinovic, Wilhelm — IPSN 2014, 2014Bringing up OpenSky: A large-scale ADS-B sensor network for researchopensky-network.org. It has grown considerably since, but the principle holds: you see what volunteers' antennas can hear.

OpenSky exposes this data as state vectors, one row per aircraft per time step, through a public REST API. A state vector includes the ICAO24 address, callsign, longitude, latitude, barometric and geometric altitude, velocity, track, vertical rate, squawk, an SPI flag, an on_ground flag and a position_source that tells you whether the position came from ADS-B, ASTERIX, MLAT or FLARM³Source 3 · OpenSky NetworkOpenSky REST API documentationopenskynetwork.github.io. Anonymous users get the most recent vectors at 10-second resolution with a daily credit quota; authenticated users get 5-second resolution and up to an hour of history³Source 3 · OpenSky NetworkOpenSky REST API documentationopenskynetwork.github.io.

§03What open ADS-B data cannot tell you

Good analysis starts with honest limits. We keep this list on the wall of our defense team:

• Absence is not evidence. If an aircraft disappears, the first suspects are receiver coverage, terrain and low altitude, not anything dramatic. Coverage thins out over oceans, mountains and sparsely populated areas.
• Not every aircraft broadcasts. Equipage rules vary by airspace and aircraft type, and some aircraft legitimately fly without ADS-B Out. An open air picture is a picture of cooperative traffic.
• Messages are unauthenticated. ADS-B carries no cryptographic protection; the security literature has long documented that messages can be spoofed or injected⁵Source 5 · Strohmeier, Lenders, Martinovic — IEEE Communications Surveys & Tutorials (arXiv 1307.3664), 2015On the Security of the Automatic Dependent Surveillance-Broadcast Protocolarxiv.org. Treat implausible tracks as data-quality events first.
• Positions are only as good as the aircraft's navigation. When GNSS is degraded, ADS-B positions degrade with it, which is exactly what NIC and NACp reveal²Source 2 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle: Uncertainty, accuracy and integritymode-s.org.
• Identity is partial. The ICAO24 address identifies a transponder, not a flight plan. Callsigns may be missing or reused; enrichment requires reference data.

§04How multilateration and reference data fill the gaps

Some aircraft carry Mode S transponders that reply to radar interrogations but do not broadcast their position; Mode S adds altitude reporting and data exchange to classic secondary-radar replies⁶Source 6 · SKYbrary Aviation SafetyTransponderskybrary.aero. When enough time-synchronized receivers (typically four or more) hear the same reply, the network can compute a position from the time difference of arrival. That technique, multilateration (MLAT), is why OpenSky labels some positions with position_source = 2³Source 3 · OpenSky NetworkOpenSky REST API documentationopenskynetwork.github.io. MLAT positions are independent of the aircraft's own GNSS, which makes them a useful cross-check, but they need dense receiver geometry and are usually less precise.

Reference layers turn raw tracks into context: airport and airspace boundaries, terrain, OpenStreetMap infrastructure for points of interest, aircraft registry data for type and operator, and the regulatory meaning of transponder codes. None of these are glamorous. All of them are required to answer "is this normal?"

§05How to fuse ADS-B into one air picture

We think of fusion as four modeling steps, each of which produces a table you can query on its own. This is the structure of the Airspace watch template and of the step-by-step ADS-B ingestion guide.

1. 01
   Step 1:

   Normalize state vectors

   Convert every feed (OpenSky, your own receivers via ADS-B, a Kafka topic) into one schema: icao24, ts, lat, lon, alt_baro_m, alt_geo_m, gs_ms, track_deg, squawk, position_source, nic, nacp. Units in SI, timestamps in UTC.

2. 02
   Step 2:

   Deduplicate and order

   Multiple receivers hear the same message. Keep one row per aircraft per time bucket, preferring ADS-B over MLAT and fresher over staler, and drop vectors whose implied speed between consecutive points is physically implausible.

3. 03
   Step 3:

   Segment into flights and tracks

   Split each aircraft's timeline into flights using ground/air transitions and gaps longer than a threshold (we default to 15 minutes airborne). A flight is the unit analysts reason about.

4. 04
   Step 4:

   Score confidence and enrich

   Attach coverage (how many receivers heard it), source type, quality indicators and reference context. The output is a tracks model that maps, alerts and Ask Kimo all share.

12345678910111213select icao24, ts, lat, lon,
       haversine_km(lat, lon, prev_lat, prev_lon)
         / nullif(extract(epoch from ts - prev_ts), 0) * 3600 as implied_kmh
from (
  select *,
         lag(lat) over w as prev_lat,
         lag(lon) over w as prev_lon,
         lag(ts)  over w as prev_ts
  from state_vectors
  window w as (partition by icao24 order by ts)
) v
where haversine_km(lat, lon, prev_lat, prev_lon)
      / nullif(extract(epoch from ts - prev_ts), 0) * 3600 > 1500;

The 1,500 km/h ceiling is a deliberately generous plausibility bound for civil traffic, not a physics constant; tune it per region and aircraft category. Rows that fail it are not deleted. They are routed to a data-quality view, because a burst of impossible jumps in one area is itself a signal worth investigating.

§06What is an open-data air picture good for?

Used with its limits in mind, a fused air picture supports a wide range of legitimate work:

• Safety and resilience monitoring: emergency squawks, unusual descents, and regional GNSS degradation. EASA notes that GNSS interference is increasing, particularly in regions surrounding conflict zones, and around the Mediterranean, the Black Sea, the Middle East, the Baltic Sea and the Arctic⁷Source 7 · EASAGlobal Navigation Satellite System outages and alterationseasa.europa.eu.
• Crisis and disaster response: which airports are still receiving traffic after a storm, where medical and firefighting flights are operating.
• Research and journalism: verifying claims about airspace closures or diversions with reproducible queries.
• Operations analytics: holding patterns, diversions and delay propagation for airports, operators and regulators.

In Kimo, the Airspace view renders the tracks model on a map with confidence styling, and Alerts run rules against the same model. Because both sit on one definition, the number in the alert is the number on the map. For alert design, read Emergency squawks and flight anomalies; for the full methodology and limits, the Airspace Awareness from Open Data whitepaper.

§07Where should the air picture live?

Many teams that collect their own receiver data cannot ship it to a third-party cloud. With Kimo Bridge, the receiver database stays on your server and Kimo queries it live through an outbound-only tunnel; with Cloud mode, Kimo keeps a synced copy for long history. Fully disconnected environments can run Kimo air-gapped, as described in the on-premise docs.