Abstract: An Automatic Dependent Surveillance Broadcast (ADS-B) system may include a plurality of ADS-B terrestrial stations, with each ADS-B terrestrial station comprising an antenna and wireless circuitry associated therewith defining a station gain pattern. The system may further include a controller including a variational autoencoder (VAE) configured to compress station pattern data from the plurality of ADS-B terrestrial stations, create a normal distribution of the compressed data in a latent space of the VAE, and decompress the compressed station pattern data from the latent space. The controller may also include a processor coupled to the VAE and configured to process the decompressed station pattern data using a probabilistic model selected from among different probabilistic models based upon a game theoretic reward matrix, determine an anomaly from the processed decompressed station pattern data, and generate an alert (e.g., a station specific alert) based upon the determined anomaly.

Abstract: Systems and methods for detecting anomalies in aviation data communication systems (e.g., air traffic control surveillance systems), include a processor receiving device status information. A variational autoencoder receives and optimizes the device status information and determines whether it qualifies as an anomaly. Optimized device status information is compared to either non-anomalous or anomalous device status data in a latent space of the variational autoencoder. The latent space preferably includes an n-D point scatter plot and hidden vector values. The processor optimizes the device status information by generating a plurality of probabilistic models of the device status information and determining which of the plurality of models is optimal. A game theoretic optimization is applied to the plurality of models, and the best model is used to generate the n-D point scatter plot in latent space. An image gradient sobel edge detector preprocesses the device status information prior to optimization.

Abstract: Network security anomaly detection systems and methods include a processor, in communication with the network, receiving network device status information. A variational autoencoder receives the device status information, optimizes the device status information, and determines whether the device status information qualifies as an anomaly. Optimized device status information is compared to either non-anomalous or anomalous device status data in a latent space of the variational autoencoder. The latent space preferably includes an n-D point scatter plot and hidden vector values. The processor optimizes the device status information by generating a plurality of probabilistic models of the device status information and determining which of the plurality of models is optimal. A game theoretic optimization is applied to the plurality of models, and the best model is used to generate the n-D point scatter plot in latent space.