## 4 Networked ATM-CPS Model and Its Threat Model
### Networked ATM-CPS Model  
The degree of informationization, automation, and integration of the networked ATM is increasing, and different components are deeply integrated to form a complex CPS. The cyber system completes the information-based decision support function, and the physical system supports the state change of the aircraft. The middleware for the interaction between the cyber system and the physical system constitutes an important component for data collection, control command generation, and command execution of the complex system. As a typical complex CPS, the networked ATM based on CNS/ATM architecture will integrate the sensing system, computing system, communication system, and control system, highly integrate the three functions of control, computing, and communication, deeply couple the physical entity with the cyber domain, and effectively realize information sharing and resource optimization. To address the information security threats in networked ATM, sensor-spoofing attack models, such as ADS-B false data injection and Beidou civil navigation message spoofing, are used to uncover CPS security vulnerabilities in ATM which may affect flight safety. On the basis of the security threats faced by the networked ATM, a fine-grained system model of the ATM critical infrastructure (communication, navigation, surveillance, and automation systems) is constructed using complex network theory and CPS theory, focusingon the in-depth analysis of the interaction between the cyber domain and the physical domain to construct a fine-grained CPS model of the networked ATM, as shown in Figure 5. The correlation from the ATM cyberspace (cyber system--SWIM) to the physical space (physical systems--airlines, airports, and aircraft maintenance) and its discrete components (ATM/CNS resource subsystems, e.g., radar, navigation satellites, ground-to-air data chains, and ADS-B) is established in the process of interaction between the aviation operations and maintenance department and between the ATM infrastructure (sensors) and ATM application service delivery departments (actuators). They interact with each other through seamless and frequent interactions between the physical domain (aircraft, airports, and airspace, as well as ground handling, crews, passengers, and flights), between the cyber domain (networks, software, computing, policies and information, and network-enabled services and applications), and between the physical and cyber domains, clearly outlining the physical risks (weather and sunrays, etc.) and cyber risks (system failures and attacks, etc.) facing networked ATM. Define the ATM-CPS as a multivariate group. \[CPS_{ATM}=\left\langle S,\sum T,X,P,F\right\rangle \tag{1}\]  
\(S\) represents the set of states in the ATM-CPS for different operational models, e.g., normal, fault, and alarm; \(\sum\) represents the set of events, e.g., events caused by various risks in cyberspace and physical space; \(X\) refers to parameters and metrics that can be quantified in the ATM-CPS, which is a set of real-valued variables; \(P\) is a protection function that is assigned to each transition state and is used to indicate the discrete changes that occur in the ATM state; \(T\subseteq S\times\sum\times G\times S\) is a set that characterizes the transition states between ATM states; and \(F\) represents the continuous physical operation of the system. In the proposed ATM-CPS model, its state evolves continuously under different business models according to the business processes. Therefore, the evolution process of these states is illustrated by the research methods of graph theory and complex network model of ATM system based on matrix operation. Classical network models, such as small-world network model and scale-free network model, cannot fully reflect the characteristics of real networked ATM, and new strategies need to be used for analysis.