# Security Threats in Intelligent Transportation Systems and Their Risk Levels
## 3 Risk Analysis Study
### Risk Analysis Study in ITSs
#### 3.1.5 Risk Analysis
Three levels of likelihood are defined with an associated numerical value: Likely (3)--all elements in place; Possible (2)--some elements in place; Unlikely (1)--important elements missing (cf. Table 5). Necessary abilities and related motivation are used to determine the probability or likelihood assessment, as shown in Table 6.  
For impact, we consider asset impact: Low (1)--the possible damage is low; Medium (2)--the threat concerns provider/subscriber interests and cannot be ignored; High (3)--a business base is under attack and serious damage may happen in this context as shown in Table 7. To obtain the threat impact, we then assess asset impact in light of the severity of the attack: single instance of attack (0); moderate level of multiple instances (1); high level of multiple instances (2); to obtain the threat impact. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Threat Group** & \multicolumn{4}{c}{**Attack**} & \multicolumn{2}{c}{**Impact**} & **Risk** \\ \hline  & **Factor** & **Range** & **Value** & **Potential** & **Likelihood** & & \\ \hline \multirow{9}{*}{Sybil attack} & Time & \(\leq\)1 week & 1 & & & & \\  & Expertise & Expert & 6 & & & & \\  & Knowledge & Restricted & 3 & & & & \\  & Opportunity & Moderate & 4 & & & & \\  & Equipment & Specialized & 3 & & & & \\  & Motivation & High (committed) & 3 & & & & \\  & Asset impact & High & 3 & & & & \\  & Intensity & High intensity & 2 & & & & \\ \hline \multirow{9}{*}{Eavesdropping} & Time & \(\leq\)1 week & 1 & & & & \\  & Expertise & Expert & 6 & & & & \\  & Knowledge & Public & 0 & & & & \\  & Opportunity & Moderate & 4 & & & & \\  & Equipment & Specialized & 3 & & & & \\  & Motivation & Medium (interested) & 3 & & & & \\  & Asset impact & Medium & 2 & & & & \\  & Intensity & Single instance & 0 & & & & \\ \hline \multirow{9}{*}{Impersonation attack} & Time & \(\leq\)1 week & 1 & & & & \\  & Expertise & Expert & 6 & & & & \\  & Knowledge & Restricted & 3 & & & & \\  & Opportunity & Moderate & 4 & & & & \\  & Equipment & Specialized & 3 & & & & \\  & Motivation & High (committed) & 3 & & & & \\  & Asset impact & High & 3 & & & & \\  & Intensity & Moderate intensity & 1 & & & & \\ \hline \multirow{9}{*}{User Privacy Disclosure} & Time & \(\leq\)1 week & 1 & & & & \\  & Expertise & Expert & 6 & & & & \\  & Knowledge & Public & 0 & & & & \\  & Opportunity & Moderate & 4 & & & & \\  & Equipment & Specialized & 3 & & & & \\  & Motivation & High (committed) & 3 & & & & \\  & Asset impact & High & 3 & & & & \\  & Intensity & Single instance & 2 & & & & \\ \hline \multirow{9}{*}{Spoofing Attack} & Time & \(\leq\)1 week & 1 & & & & \\  & Expertise & Expert & 6 & & & & \\ \cline{1-1}  & Knowledge & Sensitive & 7 & & & & \\ \cline{1-1}  & Opportunity & Moderate & 4 & & & & \\ \cline{1-1}  & Equipment & Specialized & 3 & & & & \\ \cline{1-1}  & Motivation & Medium (interested) & 3 & & & & \\ \cline{1-1}  & Asset impact & Medium & 2 & & & & \\ \cline{1-1}  & Intensity & Single instance & 0 & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Risk Assessment.