The need to protect air traffic control against attacks and detect security incidents is widely accepted. Nevertheless, depending on the systems and procedures, it is sometimes difficult to distinguish whether ``something is not as it should be''. On the one hand, it could be due to a failure, on the other, it could be because of an intentional interruption/abuse. This paper lists five specific kinds of indications that may be found analyzing the traffic situation and the radio communication at a controller working position and details how they are detected. Those indications are non-conformant movements, conflicts, unusual clearances/behavior, unauthorized speakers and detected stress. Furthermore, a correlation function is described which determines the security situation indicator. This indicator categorizes the security situation into three different states expressing how likely it is that the detected indications may represent a security situation needing attention: ``green'', meaning there are no security-related actions needed; ``yellow'', meaning something seems strange, be aware; and ``red'', meaning that there is most properly a security incident. The Traffic Management Intrusion and Compliance System (TraMICS) is supposed to assist as well the air traffic controllers and the operators in a security operation center by being part of an airport security architecture.