## 3 ATM Security Concerns and Trends
### The Trends  
Networked ATM is a typical large-scale CPS with serious network security threats, and its serious impact on ATM safety has not yet received the attention of management and technical departments at all levels of the ATM field. The analysis of the relationship between network security and system safety is not deep enough, and the analysis of ATM network security is still scattered and not systematic; in particular, the effective threat model has not been established. The basic theories and key technologies for ATM information security need further in-depth research. 1. Networked ATM faces the control challenges of proliferation of flight density and diversification of air vehicle types, and its cyber security is under serious threat. In ATM, the threat to data security of ATM posed by cyber attacks presents a serious challenge to flight safety. Securing ATM data requires effective CPS modeling of ATM based on the networked ATM architecture and information flow analysis and as a basis to study its information security performance. Unlike traditional information systems, the physical and cyber processes of CPS systems are closely coupled with each other, and the existing computing and communication model are quite different from the actual CPS physical process model. The granularity of ATM-CPS modeling in existing research results is relatively coarse, and formal CPS modeling of specific functional subsystems has not yet been performed. In particular, the existing models have not been able to portray the information transmission flow among the nodes of various elements in ATM and to quantify the interaction between the cyber system and the physical system. Research results that abstractly map ATM into CPS and then use CPS security theory to analyze ATM security are not yet available. 2. With the development of software-defined radio technology and the high versatility of ATM devices, the scope of cyber attacks against ATM is expanding, cyber attack modes are emerging, threat models are evolving, yet a unified and effective cyber threat model has not yet been constructed. Due to the openness of the networked ATM wireless channel and security flaws in the protocol design, various important parts of ATM are subject to potential attack threats to varying degrees. For example, ATM uses Global Navigation Satellite System (GNSS), either GPS or Beidou, as a data source for aircraft position and velocity status. Since GNSS civil navigation message (CNAV) is susceptible to jamming and attacks [24], it may directly affect the accuracy of airspace posture in ATM. The CNAV messages of GNSS transmit the messages out in the signal format specified by the GNSS protocol standard, which are not encrypted and authenticated, and the access to the wireless channel is not associated with an anti-collision mechanism. The open nature of wireless propagation determines that it is easy for attackers to eavesdrop, modify, inject, and delete GNSS messages [25]. Mean-time, GNSS receivers continuously receive location or timing information from outside input, which may contain malicious code carefully constructed by attackers. If there is a remote execution vulnerability in the receiver, an attacker can control the GNSS receiver by wireless injection. For airborne GNSS receivers, an attacker could take control of the airborne receiver by sending erroneous data to the on-board surveillance isolation processor, generating conflicting trajectories that could lead to an incident. 3. Due to the lack of effective and credible theoretical research results on the intrinsic connection between information security and flight safety, the analysis of the propagation path of the impact of cyber attacks in the ATM is still largely lacking, resulting in a gap in the understanding of the importance of ATM cyber security between the cyber security field and the ATM field.