# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
###### Abstract  
Transportation networks are fundamental to the efficient and safe functioning of modern societies. In the past, physical and cyber space were treated as isolated environments, resulting in transportation network being considered vulnerable only to threats from the physical space (e.g., natural hazards). The integration of Internet of Things-based wireless sensor networks into the sensing layer of critical transportation infrastructure has resulted in transportation networks becoming susceptible to cyber-physical attacks due to the inherent vulnerabilities of IoT devices. However, current vulnerability assessment methods lack details related to the integration of the cyber and physical space in transportation networks. In this paper, we propose a new vulnerability assessment approach for transportation networks subjected to cyber-physical attacks at the sensing layer. The novelty of the approach used relies on the combination of the physical and cyber space, using a Bayesian network attack graph that enables the probabilistic modelling of vulnerability states in both spaces. A new probability indicator is proposed to enable the assignment of probability scores to vulnerability states, considering different attacker profile characteristics and control barriers. A probability-based ranking table is developed that details the most vulnerable nodes of the graph. The vulnerability of the transportation network is measured as a drop in network efficiency after the removal of the highest probability-based ranked nodes. We demonstrate the application of the approach by studying the vulnerability of a transportation network case study to a cyber-physical attack at the sensing layer. Monte Carlo simulations and sensitivity analysis are performed as methods to evaluate the results. The results indicate that the vulnerability of the transportation network depends to a large extent on the successful exploitation of vulnerabilities, both in the cyber and physical space. Additionally, we demonstrate the usefulness of the proposed approach by comparing the results with other currently available methods. The approach is of interest to stakeholders who are attempting to incorporate the cyber domain into the vulnerability assessment procedures of their system. transportation network; vulnerability; internet of things; cyber-physical attacks; Bayesian network attack graph; efficiency; Monte Carlo 202312  
(IoT)) [6; 7]. For example, transportation infrastructure is embedded with IoT devices in the form wireless sensor networks (i.e., IoT-based wireless sensor network (WSN)) that provide data in real time for engineering services. These engineering services are related with, but not limited to. early warning systems against hazards (e.g., foundation scour) [8], wireless structural health monitoring (e.g., monitoring through image processing) [9], or traffic monitoring [10]. Additionally, IoT devices will enable transportation infrastructure to be part of a wider transportation system by providing data to other interacting transportation elements, such as such as smart vehicles [11; 12]. This integration of the physical world with computational facilities enables the operation of critical transportation infrastructure as cyber-physical systems [13]. The transition from traditional transportation infrastructure and network to an IoT-enabled transportation infrastructure and cyber-physical network, as shown in Figure 1, relies on a fundamental three-layer IoT architecture, namely sensing, network and application [14]. The sensing layer includes the IoT devices (e.g., sensors, gateways), located in the physical space (e.g., deck of a bridge), that collaboratively detect, collect, and process data to the network layer. The network layer is responsible for wireless transmission, having assisted in recent advances in wireless network protocols (e.g., ZigBee, Bluetooth [15]), until data are sent through base stations to the end-user for data analytics and processing through the application layer.