# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
###### Abstract
Despite the benefits of IoT-enabled infrastructure, IoT-based cyber-physical systems suffer from security deficiencies in cyber space that can be exploited by attackers [16]. These attackers typically attempt to breach the confidentiality, integrity and availability of data [14]. Although in the past, cyberattacks were assumed to impact only on cyber space, this is no longer the case. An exploitation of a vulnerability in the cyber space by an attacker can result in physical disruption (e.g., unavailability of services), facilitating cyber-physical attacks against critical transportation infrastructure [17]. Therefore, correctly performing vulnerability assessments of transportation networks, especially ones that rely on the constant operation of their integral parts (i.e., IoT-enabled transportation infrastructure), to cyber-physical attacks is of major concern. The significance of cyber-physical attacks against transportation infrastructure has been highlighted, both by our previous research studies [18; 19] and by previous events, such as the two-day denial-of-service attacks (DoS) against the Swedish Transport Administration that led to major delays and degraded services for customers, as reported by European Union Agency for Cybersecurity [20]. However, in our previous research studies related to cyber-physical attacks, the major focus was place on the risk assessment of IoT-enabled transportation infrastructure, rather than the vulnerability assessment. In particular, the risk assessment approach focused on the transportation infrastructure that operates as an individual cyber-physical system. This current study focuses on the vulnerability assessment of an entire transportation network. The entire transportation network in this study operates as a cyber-physical transportation network that is built on different IoT-enabled transportation infrastructure (i.e., see Figure 1). Indeed, the increasing dependence of transportation networks on IoT devices with inherent deficiencies, especially those that are physically exposed to the sensing area of IoT  
Figure 1: An abstract cyber–physical transportation network example. enabled transportation infrastructure, jeopardize the operation of a transportation network when subjected to cyber-physical attacks. The deficiencies of IoT devices originate either from technical weaknesses (e.g., limited energy resources and computational capacity) or vulnerabilities in cyber space due to security gaps (e.g., lack of encryption) [21]. Current approaches that target the assessment of the vulnerability of a transportation networks to different types of attacks (e.g., natural hazards, terrorism) overlook the security issues caused by the deficiencies of IoT-enabled transportation infrastructure [22]. Studies related to security issues in transportation networks focus on the identification of threats against specific transportation elements that operate within it, such as smart traffic lights [23] or modern vehicle systems that enables vehicle-to-vehicle or vehicle-to-infrastructure communication [24; 25]. Similarly, EU projects have studied or are studying the development of a security framework that protects the information and operational technology departments of stakeholders in the transportation domain (e.g., CIPSEC [26]) or in the enhancement of a transportation network serviceability level against cyberattacks (e.g., RESOLUTE [27], RESIST [28]). Other EU projects, such as PRECINCT [29], focus on the interdependencies between transportation networks and other sectors (e.g., energy). Other studies that do not consider specific vulnerable elements (e.g., traffic lights), follow a holistic approach by assessing the vulnerability of transportation networks to both random (i.e., day-to-day disturbances) or targeted attacks (i.e., malicious attacks or large-scale natural disasters) [30]. These approaches rely on graph theory, describing the transportation network in the form of a graph with a set of nodes (e.g., stations) and a set of edges (e.g., distances between the nodes) [31].