Feat/spoof tier1#52
Merged
Merged
Conversation
The Self-ID message fields shipped in the consumer (ha-airspace parses self_id since 0.2.32) and in dump3411 v1.0.0, but the canonical wire contract never documented them. Add both as optional detection-object fields, note self_id is untrusted operator free-text, and thread self_id_seen through the relative-time and serialize-time notes. Additive — no schema_version bump. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A replay test using previously-seen REAL serials surfaced the gap: those serials resolve in the FAA registry, so identity/registry validation cannot detect a spoof. RID has no cryptographic authentication. Detection therefore has to be behavioral. Add a SpoofDetector (mirrors OrbitDetector — derived flag, runs in ingest after enrich, pruned on purge) with the two cheap Tier-1 signals: a malformed serial (id_type "serial" but not shaped like ANSI/CTA-2063-A, e.g. the 0x00 placeholder), and a self_id shared across multiple distinct serials in the air (the observed "Spoofing test" across three serials). The flag lands in state.flags, so it composes with alerts, count_by_flag, the flag feed, journaling and the payloads for free. Gated by a new SpoofConfig (off by default) and the enable_spoof_detection add-on toggle. Tier-2 kinematic/cross-time signals need the durable sighting store and are scoped in DESIGN.md, not built here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.