## 2 Literature Review
### Smart Mobility
#### 2.2.2 Countermeasures
Because of system and infrastructure digitalization, the automation of railway processes, mass transit concerns, and expanding linkages with external and multimodal systems, the railway industry is experiencing a significant change in its operations, procedures, and infrastructure. Cybercriminals may target ticket vending machines, passenger information screens, and the Wi-Fi infrastructure. These systems are becoming more vulnerable to cyber attacks as they transition from bespoke stand-alone systems to open-platform, standardized equipment built with commercial off-the-shelf components and increased use of networked control and automation systems accessible remotely via public and private networks. Many signals transmitted and received over insecure communication links are critical to railway operations. Constant monitoring, immediate notice of any departure from ordinary circumstances, and decisive measures to resolve the issue allow for effective risk reduction and business continuity. Fur thermore, uninterrupted and safe traffic operation depends on recognizing and addressing threats to telecom, train management, and signaling systems as soon as possible. Complete visibility and the capacity to identify and mitigate hazards as they emerge give a route to reducing uncertainty and operational interruptions [58,59]. Though various studies on critical infrastructures have been conducted from the aspect of cyber security, there has been little research conducted from the standpoint of cyber-physical security in application areas such as the railway infrastructure. This is the first complete empirical evaluation of the cyber-physical vulnerability of communication-based train control systems [60]. The writers carefully analyze communication-based train control and the cyber-physical vulnerabilities that may seize control of the train. They discover that a man-in-the-middle assault combined with knowledge of railroad signaling may result in substantial train crashes. They propose a countermeasure for communication-based train control resilience to overcome the issue and meet these difficulties. The primary idea behind this countermeasure design is to create a subsystem with a host that the attacker cannot reach. The cable links the subsystem to the SDN switch. The SDN controller, on the other hand, logically disconnects the link between the SDN switch and the subsystem. The subsystem stays undiscovered due to the logical separation while the attacker seeks victims. Consequently, during a man-in-the-middle attack, the subsystem may go undiscovered. For the subsystem to warn the automated railway protection system of the attack scenario, the SDN switch should detect ARP spoofing. The SDN switch continuously monitors ARP messages and creates an IP-MAC list for ARP messages across the structure's SDN switches. They validate their findings by developing a realistic communication-based train control testbed environment that yields promising outcomes. In addition, this research [61] looks at the security of railway control equipment against cyber or physical attacks. The authors offer a cyber-physical authentication approach that combines an add-on security module with a cyber security protocol for device authentication and data transmission. A 'hot swappable' bump-in-the-wire security module adds cryptographic capabilities to current control devices. The suggested system offered tamper resistance by encapsulating the hardware in a tampered-detection box and using tamper-resistant hardware to secure the cryptographic key. The device authentication protocol secures server-to-control-device communication. Setup, first handshake, acknowledgement/critical exchange, and data transmission make up the protocol. Due to storage needs, the first handshake used RSA signatures, and the data transmission phase used AES with a 256-bit session key. Tests show that overall overhead has a minor impact on the railway's control device.