## 5 Networked ATM-CPS Game Model
### Game Modeling of Networked ATM-CPS  
The establishment of the CPS game model for the networked ATM system is necessary (hereinafter referred to as \"the ATM-CPS game model\"; note: this model is different from the \"networked ATM-CPS model\"). The security situation of each resource subsystem in the ATM system is comprehensively evaluated from both attack and defense perspectives, and the development trend of the security situation of the entire networked ATM system is obtained by using the quantitative evaluation method of network security situation. On the basis of the ATM-CPS game model, Bayesian game theory is used to analyze the impact of security threats (such as data tampering and privacy leakage) and attacks (such as ADS-B counterfeit signals and Beidou civil navigation message information deception) on the ATM system, and a Bayesian sequential game model of ATM-CPS is established. According to Bayesian Nash equilibrium security protection strategy, it can comprehensively master and control the security status of ATM-CPS. * ATM-CPS information security situation assessment. In view of the wide area distribution of location, multi-source heterogeneity of data, multiple communication protocols and inconsistent interface standards of networked ATM system, the main research contents are as follows. * Design the architecture of security situational awareness system of ATM system based on multi-sensor. For the processing mode of distributed collection and acquisition of ATM business data by ATM system equipment, the resource equipment and system mesh physical structure of ATM system and the hierarchical model of equipment layer, transmission layer, and application layer should be designed. * Design a solution for eXML format of multi-source heterogeneous security information in ATM. The system structure framework of security situation awareness of the ATM system is divided into information collection layer, element extraction layer, and situation decision-making layer from bottom to top, including three steps: detection data fusion, establishment of threat propagation network (TPN), and evaluation of CPS game model. The CPS game model is used to comprehensively evaluate the security situation of each subsystem of the ATM system from the perspectives of attack and defense, and the development trend of the security situation of the entire networked ATM system is obtained through the quantitative evaluation method of network security situation, thus providing a reference for the security situation prediction of the ATM. * ATM-CPS information security situation prediction. According to the huge composition and complex hinge relationship of networked ATM system, the deep learning model is used to predict the security situation of networked ATM system. It includes two main contents. * Security event embedding method. The security events faced and suffered by networked ATM should be sorted out, and the security event embedding method should be investigated to represent them as dense vectors using Neural Tensor Network (NTN) and train them for security events. * Dynamic prediction model of security situation based on deep convolutional neural network. The deep convolutional neural network should be used to model the impact of security incidents in the networked ATM; thus, a dynamic prediction model of the security situation of the networked ATM based on the deep convolutional neural network is established. Genetic algorithm should be used to optimize the model and realize the nonlinear time series prediction of the security situation of networked ATM. * Bayesian Nash equilibrium security protection strategy for ATM-CPS. On the basis of the established ATM-CPS model and its threat model, starting from the physical space of the ATM-CPS, it is possible to reduce the damage caused by the cyber space intrusion event of the ATM-CPS due to malicious attacks and protect the safe operation of the physical entities in the CPS system.