Advances in radio and RADAR research have considerably contributed to the emergence of novel air traffic control (ATC) protocols. In particular, Automatic Dependent Surveillance Broadcast (ADS-B) has proven to be a viable option that could complement and extend current technologies. Despite the benefits offered by ADS-B, such as more precise location, easier deployment, and lower costs, cyber-security issues have arisen due to the open, clear-text broadcasting of ADS-B messages making it vulnerable to many attacks. In this paper, we propose an intrusion detection system (IDS) specifically designed to detect malicious or questionable ADS-B messages. We leverage prior work on cyber-defense mechanisms against ADS-B attacks and physical aspects of aircraft motion to classify received ADS-B traffic as potential attacks and retain digital artifacts that might support post-attack forensic investigations.