<p>With the development of smart civil aviation, the cybersecurity situation for air traffic management (ATM) continues to be critical. The increasingly exposed attack surface demands more advanced technologies and methods for protection. Large language models (LLMs) have been widely applied in cybersecurity, which has provided a novel paradigm for reconstructing ATM cybersecurity defense systems. However, existing vertical domain LLMs in ATM focus on providing passenger services and supporting daily operations, which do not concern cybersecurity. This neglect is a potential risk in the transition from security to safety. In this paper, a prompt-engineering-based method for generating question–answer pairs for ATM cybersecurity is proposed. Knowledge is extracted from multi-source heterogeneous primary sources and converted into uniformly formatted question–answer pairs, and an ATM cybersecurity fine-tuning dataset and benchmark are constructed. By fine-tuning the Deepseek-llm-7B-base model and DeepSeek-R1-Distill-Qwen-14B model using both instruction fine-tuning and reasoning fine-tuning methods, based on Low-Rank Adaptation (LoRA) and full-parameter fine-tuning technologies, a vertical domain LLM named “AeroSec” for ATM cybersecurity was constructed. By comparing the fine-tuned model with the base model, DeepSeek-V3 model, and DeepSeek-R1 model through the third-party model Qwen-Plus, the useful value of AeroSec in answering questions in specialized domains such as ATM network threat analysis and offensive-defensive techniques has been validated.</p>