A Cascading Failure Model of the Air Traffic Control Network Based on the Theory of Interdependent Networks

Abstract

With the continuous development of information technology, a spontaneous interdependent network has formed within the air traffic control network. Due to the internal interdependence, any small, failed node may trigger a cascade failure of the entire system. The purpose of this study is to investigate the resilience of air traffic control networks. Based on air traffic management regulations, a new cascading failure model for air traffic control networks is proposed, which is based on the theory of interdependent networks. The model establishes a dual-layer dependency relationship between the control coordination network and the air route facility network, including control dependency and service dependency. Through experiments, targeted measures are proposed to improve the safety and reliability of air traffic control. This model introduces parameters such as control cost and node control capability, and reflects the resilience of the air traffic control network, based on the final number of failed nodes after the steady-state of the cascade failure, the network’s cascade failure rate, and the system’s load failure threshold. Simulation results show that enhancing the control capability and increasing the number of control positions can improve the control cost of the air traffic control network. The higher the control cost, the better the resilience of the air traffic control network. Improving the control capability of control nodes has a greater impact on the resilience of the air traffic control network, compared to increasing the number of control nodes. The degree attack on route nodes has a greater impact on the cascade failure of the air traffic control network, compared to random attacks and facility node degree attacks. The cascade failure model proposed in this paper provides a new method for guiding the air traffic control network to resist cascade failure attacks and enhance its resilience.

1. Introduction

With the continuous development of China’s aviation industry, the aviation network has become an indispensable infrastructure network in human society. At the same time, the air traffic control network has also become more complex and has been continuously improved. From 2019 to 2021, there were a total of 49 general aviation accidents and 1569 transport aviation incidents in China’s civil aviation sector [1]. In recent years, traffic accidents that cause flight delays or cancellations due to weather, malicious attacks, equipment failures, and other reasons have occurred frequently, which has raised social concerns about the security of the ATC network [2]. The ATC network is a network that provides air traffic management services by multiple control units through remote networks and related physical service facilities. These control units interact with physical service facilities remotely, such as aircraft, reporting points, ground-to-air communication facilities, ATC monitoring facilities, radar facilities, telemetry facilities, meteorological service facilities, etc. On the one hand, the control units control the operation of physical service facilities, and on the other hand, these physical service facilities provide relevant security services for the control units of the ATC network. A self-organized interdependent network has formed within the ATC network.

These complex interdependent relationships will seriously affect the resilience of the network. When the ATC network is affected by severe weather, deliberate attacks, and other events, some initial failures may cause a control position of the network to fail, and the related service facilities that interact with the control position will also be affected and cause failure. The failure will spread in the network, which may cause a destructive cascading effect [3]. On 8 July 2016, Xiamen Airport was affected by Typhoon Nepartak, which led to the cancellation of 245 inbound and outbound flights. On 16 June 2021, Southwest Airlines in the United States stopped operating due to website crashes, resulting in the cancellation of nearly 300 flights and the delay of more than 500 flights. On 17 April 2022, Sunwing Airlines in Canada was attacked by a network attack, which caused system failures and delays in 188 flights. When the ATC network experiences cascading failure due to special circumstances, it will affect the operation of the entire network, causing the failure of some airports, route points, and sectors, leading to aircraft congestion, flight cancellations, or delays.

Regarding the cascade failure model of interdependent networks, Yanli Gao et al. [4] proposed a “one-to-one” asymmetric interdependent network model. They studied the second-order to first-order transition of the network under random attacks using percolation theory, and analyzed the impact of different phase transition types, from mixed transition to second-order transition, on the network’s vulnerability. Reference [5] proposed an energy-based cascading failure model for the one-to-one interdependent network, based on control nodes. Wang Ning et al. [6] studied the robustness of the one-to-one interdependent network model under different attack strategies, connection strategies, and load distribution mechanisms. Liu Run-Ran et al. [7] studied a cascading failure model of one-to-one interdependent networks under random allocation, and the results showed that, as the number of failed nodes increased, the size of the giant connected component decreased from the first-order phase transition to the second-order phase transition to near-zero values. However, the one-to-one cascading failure model cannot fully reflect the operational characteristics of interdependent network systems, as the nodes in this model depend only on one node in another network to operate, which has certain limitations.

Zhen Huang et al. [8] proposed a “k-n” interdependent network model for network-level cascading failure, in which a node provides service support to multiple nodes and is controlled by only one control node. Nodes disconnected from the giant connected component will also fail. Zheng Kexian et al. [9] studied the robustness of the “one-to-many” multilayer interdependent network model under random attacks, and investigated the relationship between the robustness of the system and the interlayer average degree, and the critical threshold of the maximum connected subgraph in the final stable state. Zhuoyang Wang et al. [10] improved and optimized the dependency relationship in the interdependent network and proposed a “many-to-many” cascading failure model for interdependent networks. Meizhu Li et al. [11] studied different network models, such as multilayer networks, multiplex networks, interconnection networks, and NON networks, to describe the relationships between different systems, and proposed a method to identify critical influential nodes in NON. Xin Su et al. [12] studied a cascading failure model of interdependent networks, based on multiple dependency relationships, and investigated the relationship between network robustness and the number of dependent links and cluster size. Jian Wang et al. [13] proposed a cascading failure model of interdependent networks, based on dependency groups, and studied the relationship between inter-layer correlation and dependency group size and system robustness. Compared with the “one-to-one” model, the “k-n”, “many-to-many”, and NON models, which have non-single dependency relationships, are more suitable for interdependent networks and reflect the complex dependency relationships between networks more accurately.

Sturaro et al. [14] proposed a cascading failure model for heterogeneous interdependent networks. The model constructed interdependent relationships between heterogeneous networks, and studied the heterogeneity of networks and their complex interdependencies, which is more closely related to the cascading failure process in industrial control networks. Zhengcheng Dong et al. [15] proposed a cascading failure model for interdependent networks, based on core-periphery structure. The model consists of a dense core and sparse periphery, and studied the impact of mutual coupling and random coupling on network robustness. Wu Yipeng et al. [16] proposed a cascading failure propagation model for interdependent networks based on discrete dynamic systems. The model used conditional probability between network nodes to represent the cascading failure propagation, and the conditional probability served as the state variable of the discrete dynamic system, proposing the cascading failure propagation process of network nodes in continuous time. Tianqiao Zhang et al. [17] proposed a cascade failure model of interdependent networks with star-shaped links. In this model, network A has f service nodes, and each service node provides services to n nodes in network B. Meng Tian et al. [5] proposed a cascading failure model for interdependent networks, based on control nodes and control support. The model studied the impact of control factors and control nodes on network cascading failures. The “core-periphery”, “discrete dynamic”, and “star-shaped links” cascading failure models, based on network characteristics, reflect the characteristics of different interdependent network dependencies and cascading failure propagation, greatly enriching the research on cascading failure models for interdependent networks.

In the research on cascading failure propagation in interdependent networks, Sisi Duan et al. [18] studied the application of optimal broadcasting algorithms in cascading failure propagation in interdependent networks, proposing distributed algorithms and centralized algorithms for node failure analysis. Yubo Huang et al. [19] proposed a small perturbation analysis method to identify abnormal nodes, enhancing network resilience against cascading failure attacks by controlling the abnormal nodes after an attack. The results also showed that increasing coupling strength can significantly improve network stability. Yi Shen et al. [20] proposed a cascading failure model for interdependent networks, based on traffic redistribution under fluctuating loads, studying the impact of node tolerance and traffic distribution on network robustness. Alexander Veremyev et al. [21] studied the optimization problem of identifying critical nodes in interdependent networks, based on conditional risk values.

The above-mentioned interdependent network cascading failure models have expanded the research methods for interdependent network cascading failures, but there is little research on cascading failures in air traffic control networks, both domestically and internationally. In this paper, based on the characteristics of cyber-physical systems and the actual operation of air traffic control networks, it is modeled as two interdependent complex networks. The cascading failure process of the air traffic control network is analyzed when attacking a certain node in the network, such as control positions, aircraft, reporting points, ground-air communication facilities, air traffic monitoring facilities, meteorological service facilities, etc., exploring its internal interdependencies, the process of initial failure nodes causing multiple dependent nodes to fail, and its internal failure propagation rules. Network attacks can have serious impacts on air traffic control networks, potentially leading to flight delays or cancellations, airport closures, compromising the safety of air traffic control networks, and causing safety and flight accidents. The cascading failure model can be used to address potential network attack threats by enhancing control capabilities, increasing the number of control positions, and implementing emergency response measures to counter network attacks and prevent cascading failures caused by network attacks.

This article focuses on the resilience of air traffic control networks and constructs a cascading failure model, based on the complex interdependent network theory. Relevant concepts such as control cost are introduced to study the propagation process of cascading failures in interdependent networks, with a particular focus on the resilience of air traffic control networks under different interdependence parameter conditions between the control coordination network and the route facility network. A comparison is made with existing models, and the experimental results show that existing models simplify the fault evolution and network functional requirements, leading to an underestimation of cascading failures. To study the robustness of air traffic control networks and the impact of cascading failures, this article proposes optimization directions for air traffic control networks, providing guidance for them to resist cascading failure attacks and enhance their resilience.

The rest of the article is organized as follows: In Section 2, the cascading failure model for air traffic control networks is constructed. Section 3 discusses the propagation process of the cascading failure model in detail, while Section 4 presents the experimental results and discussion. Finally, Section 5 summarizes the conclusions.

2. Cascading Failure Model for Air Traffic Control Networks

A Cyber-Physical System (CPS) [22] is a complex system that integrates sensing, computing, and control, with features such as real-time perception, control management, and information services. The air traffic management network is a complex cyber-physical system [23], formed by the coupling of information and physical networks, integrating facilities such as navigation, radar, communication, surveillance, and sensing, and providing services such as air traffic control, navigation information, air traffic safety, and airspace management, as shown in Figure 1. Currently, in the application of CPS in air traffic control, Ren L et al. [24] studied the application of critical tasks in CPS systems in the aviation network from three aspects: aircraft, aircraft operation control, and air navigation operation and maintenance services. Zheng Xueli et al. [25] established an aviation CPS network model, based on node attributes and mobile tasks. Wang Xinglong et al. [25] proposed an air traffic CPS model, based on control network and route network.

In the air traffic control network, the information and physical network systems are composed of a large number of components, and, in most cases, the impact of most terminals on the system reliability is limited. Therefore, when modeling, only the component nodes that play an important role in the network are considered. Based on the air traffic CPS model [26], this paper considers the differences in node functions and proposes two types of dependencies. According to the civil aviation air traffic management regulations [27] and the interdependence between control units and physical route service facilities, the air traffic control network is modeled as a cascading failure model of interdependent complex networks, as shown in Figure 2.

Within the information and physical networks, the internal links are undirected. When modeling, both networks are represented as undirected graphs. The information network is the control coordination network, which is modeled as a graph:

$$G_c=\left(V_c,E_c\right),$$

(1)

$$V_c=V_{cm}\cup V_{ch},$$

(2)

Here, $G_c$ is the control coordination network, and the node set $V_c$ of the control coordination network is divided into control nodes $V_{cm}$ and coordination nodes $V_{ch}$. Control nodes $V_{cm}$ are control positions in control units, such as airport control positions, ground control positions, approach control positions, procedural control positions, radar control positions, flow management positions, etc. They are mainly responsible for controlling activities of aircraft and reporting points within corresponding control sectors. Coordination nodes $V_{ch}$ are coordination, operation, and support positions in control units, such as release permission release positions, notification coordination positions, director positions, military coordination positions, flight plan processing positions, search and rescue coordination positions, dynamic maintenance positions, etc. They are mainly responsible for reporting navigation dynamic information and plans to aircraft, relevant positions, and related units, and conducting necessary coordination. The edges $E_c$ of the control coordination network represent the transmission of information instructions between connected positions in the control coordination network $G_c$.

The physical network is the air route facility network, which is modeled as a graph:

$$G_a=\left(V_a,E_a\right),$$

(3)

$$V_a=V_{al}\cup V_{ai},$$

(4)

In this network, $G_a$ is the air route facility network, and the node set $V_a$ of the air route facility network is divided into route nodes $V_{al}$ and facility nodes $V_{ai}$. Route nodes $V_{al}$ are geographical nodes on the aircraft route, such as position reporting points, mandatory reporting points, airports, navigation points, important points, transition points, holding points, control transfer points, control permission boundary points, etc. They are mainly key geographical nodes, established on the aircraft route for navigation, reporting aircraft positions, and changing air traffic service settings. Facility nodes $V_{ai}$ are relevant physical service facilities in the physical network, such as aircraft, ground-air communication facilities, satellite communication facilities, monitoring facilities, navigation equipment, meteorological service facilities, terminal information facilities, etc. They are mainly physical facilities, such as sensors, detectors, and transducers, with the function of collecting surrounding information. The edges $E_a$ of the air route facility network represent the transmission of sensing information data between nodes in the air route facility network $G_a$.

After modeling the information network and physical network, we establish edge relationships between the control coordination network $G_c$ and the air route facility network $G_a$. Considering the interdependence within the air traffic control network, two special dependency edge relationships are defined as control dependency and service dependency. In the air traffic control network, control nodes $V_{cm}$ have the ability to control all nodes $V_a$ in the air route facility network. Control dependency refers to the dependence of each node $V_a$ in the air route facility network on $k$ control nodes $V_{cm}$ in the control coordination network $G_c$. Each control node $V_{cm}$ has a control capability of $n$, which means that the operation of route points and related physical service facilities in the air route facility network are managed and controlled by various control positions. At the same time, control coordination nodes $V_c$ in the control coordination network require service data support provided by each route node $V_{al}$ in the air route facility network $G_a$. Due to the difference in address location, all service data is uniformly uploaded to control coordination network nodes $V_c$ by route nodes $V_{al}$. Service dependency refers to the dependence of control coordination network nodes $V_c$ on route nodes $V_{al}$ in the air route facility network $G_a$, indicating that control and coordination positions in the control coordination network are supported by service data from each route point. These two dependency relationships are called dependency edges.

A dependency edge $U\to V$ represents a one-way dependency edge from node $U$ to node $V$. It means that the dependency edge $U$ only works when $V$ is running, but $V$ does not depend on $U$. This dependency relationship is directional and asymmetric. If node $U$ depends on node $V$, it does not mean that node $V$ depends on node $U$. Only when there is a bidirectional dependency edge between nodes $U$ and $V$ is it indicated that $U$ and $V$ depend on each other to work properly. This is shown in Figure 3. In this paper, both control dependency and service dependency are mandatory dependency relationships. The control dependency of the route facility network nodes depends on the control nodes, which reflects the air control in the air traffic management system. The service dependency of the control coordination network nodes depends on the route nodes, which reflects the control and sharing of information resources in the air traffic management system.

When establishing the cascading failure model, the meanings of the node codes are shown in

Table 1. Codes and their meanings in the model.

Code Name	Meaning
$G_c$	Control coordination network.
$V_c$	Nodes in the control coordination network.
$V_{cm}$	Control nodes.
$V_{ch}$	Coordination nodes.
$E_c$	Edges in the control coordination network.
$G_a$	Air route facilities network.
$V_a$	Nodes in the air route facilities network.
$V_{al}$	Air route nodes
$V_{ai}$	Facility nodes.
$E_a$	Edges in the route facilities network.
$k$	The number of control nodes that the nodes in the route facilities network depend on.
$n$	Control capacity of the control nodes.

.

3. The Fault Propagation and Instances of Cascading Failure Models

Under normal circumstances, the air traffic control network maintains a regular operational state, and the control coordination network $G_c$ and the air route facility network $G_a$ support each other. According to the cascading failure model of the air traffic control network, the nodes in the network need to meet the following conditions to maintain normal operation: The node function is intact; the nodes in the air route facility network $V_a$ have control dependency edges; the nodes in the control coordination network $V_c$ have service dependency edges; and they are connected to the largest connected component. The process of cascading failure in the air traffic control network is shown in Figure 4. The process of cascading failure is as follows:

(1)

The attacker attacks a node in the control coordination network $G_c$ or the air route facility network $G_a$ and causes it to fail;

(2)

Nodes that have dependency and internal link relationships with the failed node will also fail, and their normal operation conditions will be checked;

(3)

The failure of the node is then fed back to the corresponding control coordination network $G_c$ and air route facility network $G_a$. This process is iterated repeatedly until there are no new node failures, and the network reaches its final stable state, and the process of cascading failure ends.

To further illustrate the control dependency relationships, service dependency relationships, and failure rules in the cascading failure model of the air traffic control network, an example is presented in this section to analyze the evolution of cascading failures in the network. In this example, as shown in Figure 5, there are two layers of networks, the control coordination network $G_c$ and the air route facility network $G_a$. The control coordination network $G_c$ at the top contains two control nodes, $C1$ and $C2$, and four coordination nodes, $M1$, $M2$, $M3$, and $M4$. The air route facility network at the bottom contains three route nodes $T1$, $T2$, and $T3$, and five facility nodes $I1$, $I2$, $I3$, $I4$, and $I5$. The control dependency relationship between the control nodes and the nodes in the air route facility network is as follows:

$$T1\to C1\hspace{1em}T2\to C1\hspace{1em}I1\to C1\hspace{1em}I4\to C1$$

$$T3\to C2\hspace{1em}I2\to C2\hspace{1em}I3\to C2\hspace{1em}I5\to C2,$$

The service dependency relationship between the route nodes $V_{al}$ and the control coordination network nodes $V_c$ is as follows:

$$M1\to T1\hspace{1em}M4\to T1$$

$$C1\to T2\hspace{1em}M2\to T2$$

$$C2\to T3\hspace{1em}M3\to T3$$

In the air traffic control network, attackers generally use methods such as ADS-B injection to launch network attacks, due to the dispersed and location-differentiated characteristics of route nodes. Control nodes usually have certain protective measures, and it is difficult to directly attack nodes in the control coordination network. This paper mainly studies the resilience of the air traffic control network under network attacks on route facility network nodes by attackers. In the following scenario, the attacker simulates an attack on the route nodes in the route facility network, causing the route nodes to fail, and resulting in the failure of control coordination network nodes that rely on the service data provided by the node, as shown in Figure 6. The process of cascading failure is as follows:

(1)

Node $T3$ fails;

(2)

Due to service dependency, $T3$ causes $C2$ and $M3$ to fail;

(3)

Due to control dependency, $C2$ causes $I2$, $I3$, and $I5$ to fail;

(4)

Due to internal links, $I2$ causes $I4$ to fail.

When the network reaches a steady-state and the cascade failure ends, a total of 7 nodes have failed, while 7 nodes are still functioning normally.

4. Simulation Experiment and Analysis

4.1. Experimental Explanation

Through experimental simulation of the cascading failure model in the air traffic control network, the Network X library in Python [28] was used in the simulation network to explore and analyze network properties. Previously, most complex networks, including air traffic control networks, were considered random networks, with node degree distributions following the Poisson distribution. However, the research by Barabasi and Albert [29] showed that the Internet, computer wiring diagrams, and other networks are different from random networks, with node degree distributions following a power-law distribution and the existence of hub nodes. Zhang Haixia et al. [30] studied the topological characteristics of the global aviation network and found that it is a scale-free heterogeneous network. They also improved the node contraction method and ranked the importance of nodes.

The simulation experiment network topology uses the BA model to generate the control coordination network $G_c$ with power-law degree distribution and scale-free characteristics, and the air route facility network $G_a$ is modeled based on the route map. The control coordination network $G_c$ is modeled as a scale-free network with node degree distribution following a power-law distribution:

$$P(\alpha )\sim {\alpha }^{-\lambda },$$

(5)

Here, $P\left(\alpha \right)$ is the probability that a node has $\alpha$ links, and $\lambda$ is the power-law exponent. The topology of the control coordination network in the air traffic control system is similar to that of real communication networks, such as the Internet. During the generation process of the control coordination network, nodes are iteratively added, and each new node is connected to existing nodes.

We denote the number of air route facility network nodes $N_a$ that a control node $V_{cm}$ can manage as the control capacity of the control node, denoted as $n$. In the construction of the control coordination network $G_c$ in this article, it is assumed that the control capacity of each control node $V_{cm}$ is consistent, and each control node in the control coordination network supports $n$ nodes in the route facility network.

After the construction of the control coordination network $G_c$ and the air route facility network $G_a$, the dependency relationship between the two networks is established. The method of constructing the dependency relationship is as follows: each node $V_a$ in the air route facility network has $k$ control dependency relationships from control nodes, and each control node can manage $n$ nodes in the route facility network. Each node $V_c$ in the control coordination network requires one service dependency relationship from a route node $V_{al}$ in the air route facility network, and all service dependency relationships are randomly assigned. The nodes $V_a$ in the air route facility network all have control dependency edges from the control nodes $V_{cm}$, and the control coordination network nodes $V_c$ all have service dependency edges from the route nodes $V_{al}$. When the simulation network was established, the meanings of the node numbers used were as shown in

Table 2. Codes and their meanings in the simulation.

Code Name	Meaning
$N_c$	Number of control coordination network nodes
$N_{cm}$	Number of control nodes
$N_{ch}$	Number of coordination nodes
$N_a$	Number of air route facility network nodes
$N_{al}$	Number of route nodes
$N_{ai}$	Number of facility nodes
$\theta$	Air traffic control cost
$\gamma$	Load failure threshold

.

In order to effectively reflect the control capability of the air traffic control network, the control cost $\theta$ is defined as the cost required for the control nodes $V_{cm}$ to manage and control the air route facility network nodes $V_a$:

$$\theta =k\times N_a=n\times N_{cm},$$

(6)

Here, $\theta$ represents the control cost of the air traffic control network, which represents the actual meaning of the number of control dependency edges in the air traffic control network. $k$ represents the control cost required for a single air route facility network node $V_a$, and $n$ represents the control capability of a single control node $V_{cm}$. To reflect the anti-destructive ability of the air traffic control network, the load failure threshold value $\gamma$ of the system is defined as the minimum initial failure node quantity required for the air traffic control network to reach complete failure:

$$\gamma =N_{fail} when N_{lose}=N_{ATM},$$

(7)

Here, $N_{fail}$ represents the initial number of failed nodes, $N_{lose}$ represents the final number of failed nodes, and $N_{ATM}$ represents the number of nodes in the air traffic control network. The stronger the anti-destructive ability of the network, the smaller the final number of failed nodes $N_{fail}$ at the steady-state of cascading failure will be, under the same initial number of failed nodes $N_{lose}$, and the larger the load failure threshold value $\gamma$ of the system will be.

The experimental steps are shown in Algorithm 1. In this paper, the route facility network in the air traffic control network is attacked, and the impact of different attack types and parameters on the resilience of the air traffic control network is observed as the attack intensity and initial number of failed nodes increase.

Algorithm 1 Cascade Failure Model for Air Traffic Control Network
Input:
	Modeling of control coordination network:    $G_c=\left(V_c,E_c\right)$;
	Modeling of route facilities network:       $G_a=\left(V_a,E_a\right)$;
	Initial failure nodes:                  $F=F_c+F_a$;
Output:
	Network topology after cascading failure.
	//Initialization
(1)	$t=0$;
(2)	$F\left(0\right)=F_c\left(0\right)+F_a\left(0\right)$;
(3)	$\mathit{do}\left\{\right.$
(4)		$t=t+1$;
		//Failure nodes caused by internal link failure in the route facilities network.
(5)		$F_a\left(t\right)=$ The node in the route facilities network becomes disconnected from the largest connected subgraph of the route facilities network, due to the failure of node in the route facilities network.
(6)		$V_a\left(t\right)=V_a\left(t-1\right)-F_a\left(t\right)$;
		//Failure nodes caused by control dependency failure in the route facilities network.
(7)		$F_a\left(t\right)=$ The node in the route facilities network loses control dependency, due to the failure of the node in the control coordination network.
(8)		$V_a\left(t\right)=V_a\left(t\right)-F_a\left(t\right)$;
		//Failure nodes caused by internal link failure in the control coordination network.
(9)		$F_c\left(t\right)=$ The node in the control coordination network becomes disconnected from the largest connected subgraph of the control coordination network, due to the failure of the node in the control coordination network.
(10)		$V_c\left(t\right)=V_c\left(t-1\right)-F_c\left(t\right)$;
		//Failure nodes caused by service dependency failure in the control coordination network.
(11)		$F_c\left(t\right)=$ The node(s) in the control coordination network lose service dependency, due to the failure of node(s) in the route facilities network.
(12)		$V_c\left(t\right)=V_c\left(t\right)-F_c\left(t\right)$;
	$\left.\right\}\mathit{While}$ (There are new failure nodes.)

4.2. The Impact of the Control Capacity of Control Nodes on the Anti-Destructive Ability of the Air Traffic Control Network

In this set of experiments, when the number of nodes in the network topology of the cascading failure model in the air traffic control network is determined (i.e., $N_a$ and $N_{cm}$ are determined), with the increase of the initial number of failed nodes $N_{fail}$, the final number of failed nodes $N_{lose}$ and the load failure threshold value $\gamma$ of the system were compared under different control capacities $n$ when the cascading failure ended and the network reached the final steady state.

Taking Figure 7a as an example, it can be analyzed that, from top to bottom, the control capacities of the control nodes are 5, 10, 15, and 500, respectively. With the improvement of the control capacity, the initial cascading failure rate of the network decreases, and the fewer final failed nodes are caused under the same initial number of failed nodes. The load failure threshold values of the system are approximately 7, 30, 40, and 50, respectively, and the load failure threshold value of the system with stronger control capacity is higher. When the network is close to complete destruction, the cascading failure rate of the system with stronger control capacity decreases to 0 later. In summary, as shown in Figure 7a,b, when the number of control nodes is determined, with the increase of the control capacity of the control nodes, the number of control dependency edges provided by the control nodes to the air route facility network nodes increases. The destruction of some dependent edges does not easily cause node failure, and the cascading failure rate of the network decreases, enhancing the anti-destructive ability of the air traffic control network. The results show that, by enhancing the control capacity of each control position in the control coordination network, the cascading failure rate of the network can be reduced, which can improve the anti-destructive ability of the air traffic control network and enhance its ability to resist cascading failures.

4.3. The Impact of the Number of Control Nodes on the Anti-Destructive Ability of the Air Traffic Control Network

In this set of experiments, when the control capacity $n$ of the control nodes $V_{cm}$ is determined, with the increase of the initial number of failed nodes $N_{fail}$, the final number of failed nodes $N_{lose}$ and the load failure threshold value $\gamma$ of the system were compared under different numbers $N_{cm}$ of control nodes $V_{cm}$ when the cascading failure ended and the network reached the final steady state.

Taking Figure 8a as an example, it can be analyzed that, from top to bottom, the numbers of control nodes are 2, 4, 100, and 200, respectively. With the increase of the number of control nodes, the initial cascading failure rate of the network decreases, and the fewer final failed nodes are caused under the same initial number of failed nodes. The load failure threshold value of the system is higher for the system with more control nodes. When the network is close to complete destruction, the cascading failure rate of the system with more control nodes decreases to 0 later. In summary, as shown in Figure 8a,b, when the control capacity of the control nodes in the air traffic control network is determined, with the increase of the number of control nodes, the number of control dependency edges provided by the control nodes to the air route facility network nodes increases. The cascading failure rate of the network decreases, enhancing the anti-destructive ability of the air traffic control network. The results show that, by increasing the number of control positions in the control coordination network, the cascading failure rate of the network can be reduced, which can improve the anti-destructive ability of the air traffic control network and enhance its ability to resist cascading failures. From the conclusions of Section 4.2 and Section 4.3, it can be seen that, when the control capacity of the control nodes is enhanced and the number of control nodes is increased, it is equivalent to increasing the control cost of the air traffic control network from two different aspects, which is beneficial to improving the anti-destructive ability of the air traffic control network.

4.4. The Impact of the Control Capacity and the Number of Control Nodes on the Anti-Destructive Ability of the Air Traffic Control Network

In this set of experiments, when the control cost $\theta$ is determined, with the increase of the initial number of failed nodes $N_{fail}$, the final number of failed nodes $N_{lose}$ and the load failure threshold value $\gamma$ of the system were compared under different conditions when the cascading failure ended and the network reached the final steady state.

Taking Figure 9a as an example, it can be analyzed that, with the control cost of the air traffic control network determined, from top to bottom, the control capacities of the control nodes are 50, 250, and 500, respectively. With the increase of the control capacity and the decrease of the number of control nodes, the initial cascading failure rate of the network decreases, and the fewer final failed nodes are caused under the same initial number of failed nodes. The load failure threshold value of the system is higher for the system with stronger control capacity. When the network is close to complete destruction, the cascading failure rate of the system with stronger control capacity decreases to 0 later. In summary, as shown in Figure 9a,b, when the control cost of the air traffic control network is determined, with the enhancement of the control capacity of the control nodes and the reduction of the number of control nodes, the cascading failure rate of the network decreases, enhancing the anti-destructive ability of the air traffic control network. The results show that enhancing the control capacity of the control nodes is more beneficial to improving the anti-destructive ability of the air traffic control network, compared to increasing the number of control nodes.

4.5. The Impact of Targeted Attacks on the Anti-Destructive Ability of the Air Traffic Control Network

In this set of experiments, the degree values of the air route facility network nodes were sorted from high to low for targeted attacks. The degree attack on the route nodes, the degree attack on the facility nodes, and the random attack were compared.

As shown in Figure 10, among the three attack scenarios, the attack effect of the degree attack on the route nodes is the most obvious. The degree value of the route nodes in busy airspace is high. When the attacker attacks these high-value nodes, the attacks cause the control nodes that rely on these route nodes to provide service data support to fail, thus limiting the control capacity of the control and coordination network and triggering further failures, leading to destructive effects. Due to the limitations of their own functions, after the facility nodes are attacked, the route nodes may still work normally. With the increase of failed facility nodes, a certain route node may fail, which will cause a step-like failure effect on the air traffic control network. The results show that the impact of the degree attack on the route nodes on the cascading failure of the air traffic control network is greater than that of the random attack and the degree attack on the facility nodes.

4.6. The Comparison of this Model with Other Models in the Article

In this set of experiments, the cascading failure model of the air traffic control network, based on the theory of interdependent networks proposed in this article, was compared with other single-layer and multi-layer network models.

As shown in Figure 11a, literature [31,32] modeled the airport network and found that the largest connected subgraph of the airport network is approximately inversely proportional to the attack ratio when subjected to random attacks. Literature [32] modeled the airport network, route network, and sector network, based on domestic flight data in China. Under random attacks, the robustness of the network, from weak to strong, is: route network, sector network, and airport network. However, in the actual operation of the air traffic control network, the elements of each node, such as route points, sector nodes, and airport nodes in the route network, sector network, and airport network, are not operated independently. There are certain internal connections between them. The models in literature [31,32,33] did not consider the dependency between the various node elements in the network, greatly underestimating the size of the cascading failure of the air traffic control network.

As shown in Figure 11b, literature [34] modeled the air traffic control network in North China, based on data from the region, and constructed a three-layer interdependent network consisting of airport network, route network, and control network, adding bidirectional and unweighted connections outside to simulate the dependency between networks. Due to its simple failure rules that do not fully describe the actual dependency relationships, the North China air interdependent network model largely underestimates the size of the cascading failure of the air traffic control network. The schematic diagram of the air traffic control network in North China is shown in Figure 12. The interdependent air traffic control network model was used to model the North China air traffic control network. Compared with the North China air interdependent network model in literature [34], the interdependent air traffic control network model takes into account the heterogeneity of the network and defines the complex interaction relationship between the control coordination network and the air route facility network. The model defines control dependency and service dependency, clearly reflecting the propagation rules of cascading failures in the network. Compared with the models in literature [31,32,33,34], the interdependent air traffic control network model performs better and can predict more node failures and better predict changes in cascading failures in the network.

5. Conclusions

In this article, the air traffic control network was modeled using the theory of interdependent networks and CPS theory. A cascading failure model of the air traffic control network, composed of the control coordination network and the air route facility network, was constructed. The dependency relationships of control dependency and service dependency were proposed, and the propagation process of cascading failures under this model was analyzed. This model is closer to the actual operation of the air traffic control network and more clearly reflects the relationship between control and service support within the air traffic control network, as well as the process of cascading failures. The relationship between the resilience of the air traffic control network system and parameters such as the control capacity of control nodes, the number of control nodes, and the control cost was studied. The results showed that, under the condition of determining the topology of the air traffic control network, enhancing the control capacity of each control position can effectively improve the resilience of the network by reducing the rate of cascading failures; under the condition of determining the control capacity of control positions, increasing the number of control positions can also effectively improve the resilience of the network by reducing the rate of cascading failures; enhancing the control capacity and the number of control positions can both increase the control cost of the air traffic control network and also reduce the rate of cascading failures, which is conducive to improving the resilience of the network; compared to increasing the number of control positions, enhancing the control capacity of control positions is more conducive to improving the resilience of the air traffic control network. Degree attacks on route nodes have a greater impact on the cascading failure of the air traffic control network, compared to random attacks or degree attacks on facility nodes.

The cascading failure model of air traffic control networks proposed in this article shows that once a cascading failure occurs in the air traffic control network, it may cause the entire air traffic control system to collapse, leading to serious impacts on flight safety and economy. Although increasing control costs can improve the safety of the air traffic control network, it also increases the operating costs of aviation authorities in operating the air traffic control network. However, compared with the safety and stability of the air traffic control system, these costs and resource inputs are necessary. Implementing the strategies suggested in the cascading failure model is feasible.

Our work can help aviation authorities better understand the risks and safety issues in the air traffic control system, providing a reference for them to develop more scientific and effective safety management measures. Although aviation authorities may need some cost and resource inputs, these measures can effectively improve the safety and reliability of the air traffic control system, reduce flight delays and cancellations, enhance the robustness of the air traffic control network, ensure the time cost, economy, and safety of airlines and passengers, and bring safer and more convenient air traffic services to society.

Although this article provides some ideas and methods for studying cascading failures in the air traffic control network, it has not yet considered the differences in control nodes under different sectors and the elasticity of the air traffic control network’s own recovery. Further improvements are needed in the next step, combined with the actual application background.