A method for receiving data corresponding to an aircraft in a monitored airspace, comparing the data to rules, each rule corresponding to a threat posed by the aircraft and generating a threat indication based on at least one of the rules triggered by the data. A system having a rule set including a plurality of rules corresponding to potential threats in a monitored airspace and an airspace monitor receiving data corresponding to aircraft in the monitored airspace and comparing the data to the plurality of rules, the airspace monitor generating a threat indication when the data triggers at least one of the rules.