{"id":"https://openalex.org/W7134193724","doi":"https://doi.org/10.5220/0014628700004061","title":"Offensive Security Testing of Aviation Systems: A Case Study of SWIM and Air Traffic Control Using the MITRE ATT&CK Framework","display_name":"Offensive Security Testing of Aviation Systems: A Case Study of SWIM and Air Traffic Control Using the MITRE ATT&CK Framework","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7134193724","doi":"https://doi.org/10.5220/0014628700004061"},"language":"en","primary_location":{"id":"doi:10.5220/0014628700004061","is_oa":false,"landing_page_url":"https://doi.org/10.5220/0014628700004061","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th International Conference on Information Systems Security and Privacy","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://vbn.aau.dk/ws/files/829538040/146287.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5127577329","display_name":"Borna Radoj\u010di\u0107","orcid":null},"institutions":[{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Borna Radoj\u010di\u0107","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark","institution_ids":["https://openalex.org/I891191580"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128344439","display_name":"Severen Fernandes","orcid":null},"institutions":[{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Severen Fernandes","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark","institution_ids":["https://openalex.org/I891191580"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125055837","display_name":"Hannes K\u00fcnstner","orcid":null},"institutions":[{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Hannes K\u00fcnstner","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark","institution_ids":["https://openalex.org/I891191580"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065729216","display_name":"JT Pedersen","orcid":null},"institutions":[{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Jens Pedersen","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark","institution_ids":["https://openalex.org/I891191580"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128335724","display_name":"Rasmus Olsen","orcid":null},"institutions":[{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Rasmus Olsen","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, A. C. Meyers V\u00e6nge 15, Copenhagen, Denmark","institution_ids":["https://openalex.org/I891191580"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I891191580"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"447","last_page":"458"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11489","display_name":"Air Traffic Management and Optimization","score":0.8687999844551086,"subfield":{"id":"https://openalex.org/subfields/2202","display_name":"Aerospace Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11489","display_name":"Air Traffic Management and Optimization","score":0.8687999844551086,"subfield":{"id":"https://openalex.org/subfields/2202","display_name":"Aerospace Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12125","display_name":"Aerospace and Aviation Technology","score":0.031300000846385956,"subfield":{"id":"https://openalex.org/subfields/2202","display_name":"Aerospace Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10525","display_name":"Human-Automation Interaction and Safety","score":0.007600000128149986,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/aviation","display_name":"Aviation","score":0.7150999903678894},{"id":"https://openalex.org/keywords/air-traffic-control","display_name":"Air traffic control","score":0.6916999816894531},{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.6696000099182129},{"id":"https://openalex.org/keywords/airport-security","display_name":"Airport security","score":0.5651999711990356},{"id":"https://openalex.org/keywords/drone","display_name":"Drone","score":0.4465999901294708},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.4106999933719635},{"id":"https://openalex.org/keywords/aviation-safety","display_name":"Aviation safety","score":0.37130001187324524},{"id":"https://openalex.org/keywords/air-travel","display_name":"Air travel","score":0.3343000113964081}],"concepts":[{"id":"https://openalex.org/C74448152","wikidata":"https://www.wikidata.org/wiki/Q765633","display_name":"Aviation","level":2,"score":0.7150999903678894},{"id":"https://openalex.org/C166961238","wikidata":"https://www.wikidata.org/wiki/Q221395","display_name":"Air traffic control","level":2,"score":0.6916999816894531},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.6696000099182129},{"id":"https://openalex.org/C180646296","wikidata":"https://www.wikidata.org/wiki/Q1378517","display_name":"Airport security","level":2,"score":0.5651999711990356},{"id":"https://openalex.org/C178802073","wikidata":"https://www.wikidata.org/wiki/Q8421","display_name":"Aeronautics","level":1,"score":0.5335000157356262},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.48100000619888306},{"id":"https://openalex.org/C59519942","wikidata":"https://www.wikidata.org/wiki/Q650665","display_name":"Drone","level":2,"score":0.4465999901294708},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4433000087738037},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4106999933719635},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.38670000433921814},{"id":"https://openalex.org/C538199239","wikidata":"https://www.wikidata.org/wiki/Q640853","display_name":"Aviation safety","level":3,"score":0.37130001187324524},{"id":"https://openalex.org/C2985550459","wikidata":"https://www.wikidata.org/wiki/Q376880","display_name":"Air travel","level":3,"score":0.3343000113964081},{"id":"https://openalex.org/C2780387288","wikidata":"https://www.wikidata.org/wiki/Q13693","display_name":"Windshield","level":2,"score":0.3314000070095062},{"id":"https://openalex.org/C512918668","wikidata":"https://www.wikidata.org/wiki/Q206814","display_name":"Civil aviation","level":3,"score":0.288100004196167},{"id":"https://openalex.org/C2779017403","wikidata":"https://www.wikidata.org/wiki/Q9640723","display_name":"Commercial aviation","level":3,"score":0.27810001373291016},{"id":"https://openalex.org/C22212356","wikidata":"https://www.wikidata.org/wiki/Q775325","display_name":"Transport engineering","level":1,"score":0.2777000069618225},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C2778788726","wikidata":"https://www.wikidata.org/wiki/Q3569648","display_name":"Air cargo","level":2,"score":0.26190000772476196},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.2599000036716461},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5220/0014628700004061","is_oa":false,"landing_page_url":"https://doi.org/10.5220/0014628700004061","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th International Conference on Information Systems Security and Privacy","raw_type":"proceedings-article"},{"id":"pmh:oai:pure.atira.dk:publications/da5ee6d8-92e3-41d3-b8de-69c49fabed42","is_oa":true,"landing_page_url":"https://vbn.aau.dk/da/publications/da5ee6d8-92e3-41d3-b8de-69c49fabed42","pdf_url":"https://vbn.aau.dk/ws/files/829538040/146287.pdf","source":{"id":"https://openalex.org/S4306401731","display_name":"VBN Forskningsportal (Aalborg Universitet)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I891191580","host_organization_name":"Aalborg University","host_organization_lineage":["https://openalex.org/I891191580"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Radoj\u010di\u0107, B, Fernandes, S, K\u00fcnstner, H, Pedersen, J & Olsen, R L 2026, Offensive Security Testing of Aviation Systems : A Case Study of SWIM and Air Traffic Control Using the MITRE ATT &CK Framework. in Proceedings of the 12th International Conference on Information Systems Security and Privacy - Volume 2: ICISSP. SciTePress, ICISSP, pp. 447-458, 12th International Conference on Information Systems Security and Privacy, Marbella, Spain, 04/03/2026. https://doi.org/10.5220/0014628700004061","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"pmh:oai:pure.atira.dk:publications/da5ee6d8-92e3-41d3-b8de-69c49fabed42","is_oa":true,"landing_page_url":"https://vbn.aau.dk/da/publications/da5ee6d8-92e3-41d3-b8de-69c49fabed42","pdf_url":"https://vbn.aau.dk/ws/files/829538040/146287.pdf","source":{"id":"https://openalex.org/S4306401731","display_name":"VBN Forskningsportal (Aalborg Universitet)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I891191580","host_organization_name":"Aalborg University","host_organization_lineage":["https://openalex.org/I891191580"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Radoj\u010di\u0107, B, Fernandes, S, K\u00fcnstner, H, Pedersen, J & Olsen, R L 2026, Offensive Security Testing of Aviation Systems : A Case Study of SWIM and Air Traffic Control Using the MITRE ATT &CK Framework. in Proceedings of the 12th International Conference on Information Systems Security and Privacy - Volume 2: ICISSP. SciTePress, ICISSP, pp. 447-458, 12th International Conference on Information Systems Security and Privacy, Marbella, Spain, 04/03/2026. https://doi.org/10.5220/0014628700004061","raw_type":"info:eu-repo/semantics/publishedVersion"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7134193724.pdf","grobid_xml":"https://content.openalex.org/works/W7134193724.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"aviation":[1,43,129],"domain":[2],"is":[3,27],"undergoing":[4],"rapid":[5],"digital":[6],"transformation,":[7],"exposing":[8],"air":[9],"navigation":[10],"systems,":[11],"surveillance,":[12],"communication,":[13],"and":[14,32,58,65,67,80,110,131,139,145],"data":[15],"sharing":[16],"architectures":[17],"to":[18,54,98,103],"evolving":[19],"cyber":[20],"threats.":[21],"While":[22],"the":[23],"MITRE":[24],"ATT&CK":[25,63],"framework":[26,135],"widely":[28],"adopted":[29],"in":[30,42,70,108,128],"defense":[31],"detection":[33],"contexts,":[34],"its":[35],"potential":[36],"for":[37,147],"guiding":[38],"offensive":[39,94],"security":[40],"testing":[41,60],"remains":[44],"underexplored.":[45],"In":[46],"this":[47,122],"paper,":[48],"we":[49],"present":[50],"a":[51,71,133],"structured":[52],"methodology":[53],"map":[55],"adversary":[56],"emulation":[57],"penetration":[59],"activities":[61],"onto":[62],"tactics":[64],"techniques,":[66],"apply":[68],"it":[69],"case":[72],"study":[73],"targeting":[74],"System":[75],"Wide":[76],"Information":[77],"Management":[78],"(SWIM)":[79],"related":[81],"Air":[82],"Traffic":[83],"Control":[84],"(ATC)":[85],"systems.":[86],"We":[87,141],"demonstrate":[88],"how":[89],"each":[90],"phase":[91],"of":[92],"an":[93],"workflow,":[95],"from":[96],"reconnaissance":[97],"impact":[99],"can":[100,124],"be":[101],"contextualized":[102],"aviation-specific":[104],"assets,":[105],"identify":[106],"gaps":[107],"defenses,":[109],"derive":[111],"mitigation":[112],"strategies":[113],"aligned":[114],"with":[115],"ATT&CK\u2019s":[116],"mitigations.":[117],"Our":[118],"results":[119],"show":[120],"that":[121],"approach":[123],"systematically":[125],"uncover":[126],"vulnerabilities":[127],"systems":[130],"provide":[132],"common":[134],"b":[136],"ridging":[137],"offense":[138],"defense.":[140],"discuss":[142],"challenges,":[143],"limitations,":[144],"directions":[146],"further":[148],"research.":[149]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-09T00:00:00"}