# Security Threats in Intelligent Transportation Systems and Their Risk Levels
## 1 Introduction  
Intelligent Transport Systems are the solution to modern transportation problems such as congestion, accidents, etc. As mentioned in [PERSON] et al. (2013), within an ITS, the drivers will be notified in advance of hazards on the road ahead before they are visible, and vehicles will be kept at a safe distance from one another by suggesting an optimum speed based on various parameters related to traffic conditions. For integrated communication technologies, users will be able to use vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications. These communications provide system components with interaction capacity by exchanging real-time information on public transport services, real-time travel and traffic information (RTTI), as well as smart and seamless ticketing solutions.  
Like any connected system, intelligent transport systems, especially vehicular ad-hoc network (VANET) systems, expose transport operators to increased risks in terms of cybersecurity. Indeed, these systems are often collaborative and communicate with each other, with equipment, or with heterogeneous information systems, and allow access to various networks such as the internet. The interconnection of these networks increases the vulnerability of attacks and can generate the possibility of being the target of intrusions and cyberattacks. Damage from these attacks can be dramatic. Protection of these systems requires a deep risk analysis (qualitative and quantitative) and the implementation of efficient methods adapted to critical environments while taking into account the ease of use and the real-time context. As ITSs propose critical road safety applications that may affect humans, security of ITSs is an important and emerging issue (U.S. Department of Transportation 2017; [PERSON] et al. 2017). These systems are based on vehicular communications that inherit traditional problems associated with wireless networks. ITS security is a complex task as it deals with various elements (applications, communication architecture and protocols). To guarantee this security, it is pertinent to identify the likely potentialthreats to the ITS and then create apposite security solutions to mitigate threats. To achieve this, we conduct a risk analysis study to classify risks so as to understand the degree of seriousness of a particular threat and to be able to propose countermeasures for identified threats using the Threat, Risk, Vulnerability Analysis (TVRA) methodology.  
Many risk analysis methods exist in the literature, such as Expression des Besoins et Identification des Objectifs de Securite (EBIOS). The aim of EBIOS is to formalize objectives and safety requirements adapted to the studied system and its context while taking into account business processes. The difference between EBIOS and TVRA is that EBIOS is a generic method, while TVRA is a detailed method usually used to determine specific vulnerabilities.  
In this paper, we focus on ETSI ITS communication architecture, applying the Threat Vulnerability Risk Assessment (TVRA) method ETSI (2011). The results of our analysis is a list of vulnerabilities with the seriousness of their risk level. The rest of this paper is organized as follows: Section 2, provides an introduction to the ETSI ITS-S communication stack. Then, in the following section, we present the detailed risk analysis with applications and proposed vulnerabilities. In Section 5, we propose a review of countermeasures for identified critical attacks, and the last section concludes the paper.