# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
## 5 Discussion  
The results indicate that the case study transportation network is vulnerable to sensing layer attacks on the IoT-enabled network. The proposed vulnerability assessment approach enables stakeholders, who acts as assessors, to measure the vulnerability of a transportation network to cyber-physical attacks. The results indicate that IoT-enabled transportation networks which lack physical and cyber control barriers are probabilistically more vulnerable to sensing layer attacks. Although only one cyber-physical attack was considered (i.e., DoS attack), the notion of other well-established sensing layer attacks is based on similar attributes as they require a sufficient physical proximity and interference with the IoT-based WSN (e.g., man-in-the-middle attack [38]). The case study IoT-enabled transportation infrastructure, in the form of a node in this approach, embedded with deficient control barriers (i.e., low level) both in the physical and cyber space (i.e., node 8 in the case study), is probabilistically more vulnerable (i.e., P(8) = 0.60, see Table 7) than an IoT-enabled transportation infrastructure that is protected by a high-level control barriers (i.e., P(6) = 0.06, see Table 7). The correlation coefficient, r, for this case study (i.e., r = \(-\)0.63) indicates that the existence of at least one high-level control barrier (i.e., Xcb) can result in a significant lowering of the probability of exploitation. This enhances the applicability of the proposed approach in relation to the implementation of security measures in a transportation network. For example, it should be considered that high-level security (i.e., encryption over-the-air of network key transmission) is implemented in the IoT-based WSN of node 8, and that this results in it being probabilistically the most vulnerable node of the transportation network (i.e., P(8) = 0.6, refer to Table 7). Implementing such a high security level intervention results in a new probability score that is significantly reduced (i.e., P'(8)= 0.34). The structure of the proposed vulnerability assessment approach (refer to Figure 2) necessitates the role of stakeholders (i.e., civil and security engineers, operators), to assess rating scales, control barriers, etc. Expert opinion is required as there is still significant underreporting of cyberattacks, leading to a lack of statistical data [91]. Additionally, experts have developed bespoke knowledge of their system and previous attempts of exploitation. For example, the impact of the assessed attacker profile characteristics (i.e., Xi) can affect the calculated total probability score, as shown in the sensitivity analysis in Table 8 (i.e., a 50.0% percentage change). The new probability-based ranking enables the measurement of vulnerability of a transportation network to cyber-physical attacks. The ranking probabilistically allows the identification of vulnerable nodes and can result in a great reduction in network efficiency, as shown in Table 10 (i.e., reduction of 23.2% after removal of Node 8). \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Initial Efficiency E(G)**} & **Efficiency E(i) after** & **Vulnerability Assessment as** \\  & **Node Removal** & **Drop in Efficiency (\%)** \\ \hline \multirow{8}{*}{0.369} & E\({}^{\prime}\)(8) = 0.283 & \(\frac{0.369-0.283}{0.369}=0.23=23.3\%\) \\  & E\({}^{\prime}\)(1) = 0.295 & 20.1\% \\ \cline{1-1}  & E\({}^{\prime}\)(7) = 0.283 & 23.4\% \\ \cline{1-1}  & E\({}^{\prime}\)(3) = 0.265 & 28.2\% \\ \cline{1-1}  & E\({}^{\prime}\)(4) = 0.279 & 24.2\% \\ \cline{1-1}  & E\({}^{\prime}\)(2) = 0.283 & 23.3\% \\ \cline{1-1}  & E\({}^{\prime}\)(5) = 0.256 & 30.6\% \\ \cline{1-1} \hline \hline \end{tabular}
\end{table} 
Table 10: Case study vulnerability assessment as drop in efficiency for every Node i. It is acknowledged that, due to the premature level of IoT-enabled transportation infrastructure and the integration of the physical and cyber space, the assessment of vulnerability states can be challenging.