With the development of the Air Traffic Management System (ATM), the ATM network has transitioned from a closed physical isolation network to an open Cyber-Physical System (CPS). As a result, the surface of cyber-attacks is constantly expanding, and the degree of automation and correlation of attacks is constantly increasing. Traditional penetration testing attack path planning relies on the expertise of specific field experts, which can be time-consuming and resource-intensive when dealing with large networks. A large number of useful cyber security information are seriously fragmented and not integrated. In this paper, we aim to address these challenges by constructing a novel ATM system cyber threat knowledge graph called ATMCyKG. This knowledge graph is based on ATT&CK attack TTP style templates, including attack tactics, techniques, and processes. It defines entities and attributes, and their relationships. By combining ATT&CK tactics and techniques with the knowledge graph, we propose an attack path planning method based on ATMCyKG and integrate it into a reinforcement learning model. We use a variety of reinforcement learning algorithms to conduct comparative experiments and conduct a panoramic analysis of its attack process. Finally, the experimental results of the three reinforcement algorithms are analyzed and summarized. This paper introduces the ATMCyKG for the first time and utilizes Neo4j for its construction. From the perspective of an attacker, we utilized reinforcement learning to discover vulnerability sequences by selecting effective action sequences to achieve the desired target. By planning automatic attack paths, we can eliminate the reliance on expert experience, save manpower and time, and improve the operability and testing efficiency of automated penetration testing in ATM. This is of significant importance in ensuring aviation transportation safety and maintaining airspace order.

As a core technology of the new generation Air Traffic Management (ATM) system, Automatic Dependent Surveillance-Broadcast (ADS-B) becomes increasingly crucial and its anomaly detection is important for safeguarding flight safety and enhancing the efficiency of air traffic. Deep learning has been used for ADS-B flight trajectory prediction and anomaly detection, but it is known for its susceptibility to poisoning attacks when updated to adapt feature distributions from new ADS-B flight data. In the study, we propose time neighborhood interpolation combined back gradient descent poisoning attacks which not only make full use of the gradient information of ADS-B anomaly detection models but also fully consider temporal correlations and maneuvering characteristics of ADS-B data during aircrafts take-off, climb, turning and descent phase. The experimental results show that our proposed poisoning attack method can successfully poison the four state-of-the-art deep learning-based ADS-B time series unsupervised anomaly detection models. Whats more, the experimental results also show that our method is superior to other poisoning attack methods in terms of success rate and stealthiness. To the fullest extent of our knowledge, we exhibit, for the first time, the susceptibility of ADS-B time series unsupervised anomaly detection models to poisoning attacks, which is vital in safety-critical and cost-critical air traffic industry. For ease of understanding, our proposed poisoning attack method is referred to as ADS-Bpois.

Deep learning has shown significant advantages in Automatic Dependent Surveillance-Broadcast (ADS-B) anomaly detection, but it is known for its susceptibility to adversarial examples which make anomaly detection models non-robust. In this study, we propose Time Neighborhood Accumulation Iteration Fast Gradient Sign Method (TNAI-FGSM) adversarial attacks which fully take into account the temporal correlation of an ADS-B time series, stabilize the update directions of adversarial samples, and escape from poor local optimum during the process of iterating. The experimental results show that TNAI-FGSM adversarial attacks can successfully attack ADS-B anomaly detection models and improve the transferability of ADS-B adversarial examples. Moreover, the TNAI-FGSM is superior to two well-known adversarial attacks called the Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM). To the best of our understanding, we demonstrate, for the first time, the vulnerability of deep-learning-based ADS-B time series unsupervised anomaly detection models to adversarial examples, which is a crucial step in safety-critical and cost-critical Air Traffic Management (ATM).

With the continuous development of information technology, a spontaneous interdependent network has formed within the air traffic control network. Due to the internal interdependence, any small, failed node may trigger a cascade failure of the entire system. The purpose of this study is to investigate the resilience of air traffic control networks. Based on air traffic management regulations, a new cascading failure model for air traffic control networks is proposed, which is based on the theory of interdependent networks. The model establishes a dual-layer dependency relationship between the control coordination network and the air route facility network, including control dependency and service dependency. Through experiments, targeted measures are proposed to improve the safety and reliability of air traffic control. This model introduces parameters such as control cost and node control capability, and reflects the resilience of the air traffic control network, based on the final number of failed nodes after the steady-state of the cascade failure, the network’s cascade failure rate, and the system’s load failure threshold. Simulation results show that enhancing the control capability and increasing the number of control positions can improve the control cost of the air traffic control network. The higher the control cost, the better the resilience of the air traffic control network. Improving the control capability of control nodes has a greater impact on the resilience of the air traffic control network, compared to increasing the number of control nodes. The degree attack on route nodes has a greater impact on the cascade failure of the air traffic control network, compared to random attacks and facility node degree attacks. The cascade failure model proposed in this paper provides a new method for guiding the air traffic control network to resist cascade failure attacks and enhance its resilience.

With the continuous development of the civil aviation industry toward digitalization and intelligence, the closed architecture of traditional air traffic information networks struggles to meet the rapidly growing demands for air traffic services. Network function virtualization (NFV) is one of the key technologies that can address the rigidity of traditional air traffic information networks. NFV technology has facilitated the flexible deployment of air traffic services, but it has also expanded the attack surface of the network. In addressing the network attack risks faced by service function chains (SFCs) in NFV environments, a SFC protection method based on honeypots and backup technology (PBHB) is proposed to reduce the resource cost of protecting air traffic information networks while enhancing network security. Initially, PBHB utilizes the TAPD algorithm to deploy the primary VNFs as closely as possible to the shortest path between the source and destination endpoints, thus aiming to reduce SFC latency and save bandwidth resource costs. Subsequently, the RAHDR algorithm is employed to install honeypot VNFs in each physical platform that is at risk of side-channel attacks, thus updating the deployment status of honeypot VNFs in real time based on the VNF lifecycle in order to offer primary protection for SFCs. Lastly, the BDMPE algorithm was used to calculate the backup scheme with the highest protection efficiency to implement secondary protection for the SFCs that still do not meet the security requirements. Through experiments, the maximum backup limit for SFCs in PBHB was determined, confirming its satisfactory performance across various SFC arrival rates. Furthermore, performance comparisons with other SFC protection methods revealed that PBHB achieves optimizations in resources cost while ensuring SFC security and latency.

With the development of the air traffic management system (ATM), the cyber threat for ATM is becoming more and more serious. The recognition of ATM cyber threat entities is an important task, which can help ATM security experts quickly and accurately recognize threat entities, providing data support for the later construction of knowledge graphs, and ensuring the security and stability of ATM. The entity recognition methods are mainly based on traditional machine learning in a period of time; however, the methods have problems such as low recall and low accuracy. Moreover, in recent years, the rise of deep learning technology has provided new ideas and methods for ATM cyber threat entity recognition. Alternatively, in the convolutional neural network (CNN), the convolution operation can efficiently extract the local features, while it is difficult to capture the global representation information. In Transformer, the attention mechanism can capture feature dependencies over long distances, while it usually ignores the details of local features. To solve these problems, a TextCNN-Flat-Lattice Transformer (TCFLTformer) with CNN-Transformer hybrid architecture is proposed for ATM cyber threat entity recognition, in which a relative positional embedding (RPE) is designed to encode position text content information, and a multibranch prediction head (MBPH) is utilized to enhance deep feature learning. TCFLTformer first uses CNN to carry out convolution and pooling operations on the text to extract local features and then uses a Flat-Lattice Transformer to learn temporal and relative positional characteristics of the text to obtain the final annotation results. Experimental results show that this method has achieved better results in the task of ATM cyber threat entity recognition, and it has high practical value and theoretical contribution. Besides, the proposed method expands the research field of ATM cyber threat entity recognition, and the research results can also provide references for other text classification and sequence annotation tasks.