Learning to Speak ACARS Using ELK: Using SDR and ELK to Capture and Understand Aviation Data Links

Presented at Kernelcon 2022, April 1, 2022, 10:15 a.m. (60 minutes).

This presentation demonstrates the use of the open-source Elasticsearch-Logstash-Kibana (ELK) technology stack as a data analysis platform for raw Aircraft Communications and Reporting System (ACARS) data captured via software-defined-radio (SDR). The ELK Stack is intended as a log analysis tool capable of ingesting structured data from unknown sources and deriving fields from the structured data for system monitoring, system health, visualizations, and other functions. ELK is routinely used to ingest, index, and display (and natively recognizes) data from common IT utilities such as web servers, security audit logs, etc. For example, security operations teams regularly use the ELK stack to centralize monitoring and perform hunt operations on networks they defend. Here, we demonstrate how to leverage the ELK stack’s capabilities to ingest data that has nothing to do with common IT utilities – in particular, raw aircraft communications data captured via SDR. Using a system of relatively low-cost components, open-source software, and cloud computing, we will demonstrate how we captured raw ACARS data across multiple locations, structured it for transport, and pushed it through an ingestion pipeline for analysis and display on our own AWS-hosted infrastructure for the purpose of trend analysis, reverse engineering, and keyword search.


Presenters:

  • Carl Schuett
    Jesse and Carl are Security Researchers for QED Secure Solutions. A small security firm that specializes in security research and assessments of embedded devices, critical infrastructure, and medical systems. Jesse has extensive cybersecurity experience both with QED as well as with the Air National Guard, Microsoft, and Kaiser Permanente. Carl joined QED after retiring from the Air Force and has experience in aviation and industrial control system cybersecurity.
  • Jesse Young
    Jesse and Carl are Security Researchers for QED Secure Solutions. A small security firm that specializes in security research and assessments of embedded devices, critical infrastructure, and medical systems. Jesse has extensive cybersecurity experience both with QED as well as with the Air National Guard, Microsoft, and Kaiser Permanente. Carl joined QED after retiring from the Air Force and has experience in aviation and industrial control system cybersecurity.

Links:

Similar Presentations: