# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
## 4 Case Study of a Cyber-Physical Transportation Network
### Case Study Analysis and Results
The vulnerability assessment of the transportation network to the considered cyber-physical attack is measured as a drop in efficiency after the removal of the highest probability ranked nodes (see Table 7). While certain thresholds (e.g., removal of node when probability of success is greater than 0.50) could be determined based on stakeholders' judgment, for this case study all nodes were removed, one by one, in a probabilistically descending order. The results showcase the relationship between their probability scores based on an attack in cyber space and the susceptibility of the transportation network in the physical space using the measure of efficiency [64]. The vulnerability assessment was performed as drop in efficiency based on Equation (4). To calculate initial efficiency and efficiency after the removal of a selected node, the shortest path distances (i.e., \(\mathrm{d_{ij}}\)) between all set of nodes was applied. This method considers that every edge has a weight equal to one, as presented in Table 9. For example, the shortest path distance between Node 1 and Node 5 was equal to two, as Node 3 acts as a bridge between them (i.e., \(\mathrm{d_{15}}=2\)). Initial efficiency of transportation network (i.e., \(\mathrm{E(G)}\)) was calculated based on Equation (3). \[\mathrm{E(G)}=\frac{1}{\mathrm{N}\times(\mathrm{N}-1)}\times\sum_{\mathrm{i} \
eq\mathrm{j}\in\mathrm{G}}\frac{1}{\mathrm{d_{ij}}}=\frac{1}{8\times(8-1)} \times\left(\frac{1}{\mathrm{d_{12}}}+\frac{1}{\mathrm{d_{13}}}+\ldots+\frac{ 1}{\mathrm{d_{87}}}\right)=\frac{1}{56}\times\left(\frac{1}{1}+\frac{1}{1}+ \ldots+\frac{1}{1}\right)=0.369\]  
Using the same method as shown the example in Equation (3), the efficiency of the transportation network for a removed Node \(i\) (i.e., \(\mathrm{E^{\prime}(i)}\)) was calculated considering the probability-based ranking. The vulnerability assessment was calculated as a drop in efficiency. Table 10 presents the vulnerability assessment of the network after the removal of nodes in a probabilistically descending order. The results indicate that the case study transportation network is more vulnerable to the example sensing layer attack when Node 6 is successfully attacked (i.e., drop in network efficiency by 30.6%) even though it ranked as the probabilistically less vulnerable node (i.e., \(\mathrm{P(6)}=0.06\), see Table 7). In contrast, the case study transportation network is less vulnerable to the example sensing layer attack when \begin{table}
\begin{tabular}{c c c} \hline
**Node 8: Probability of Successful Attack/High Level of _Knowledge_** & **Node 8: Probability of Successful Attack/Low Level of _Knowledge_** & **Percentage Change** \\ \hline P(8) = 0.60 & P(8) = 0.30 & \(-\)50.0\% \\ \hline \end{tabular}
\end{table} 
Table 8: Case study sensitivity analysis results for Node 8, considering level of Knowledge. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \(\mathrm{d_{ij}}\) & **Node 1** & **Node 2** & **Node 3** & **Node 4** & **Node 5** & **Node 6** & **Node 7** & **Node 8** \\ \hline
**Node 1** & \(\mathrm{d_{11}}=0\) & \(\mathrm{d_{12}}=1\) & 1 & 2 & 2 & 2 & 3 & \(\mathrm{d_{18}}=3\) \\ \hline
**Node 2** & \(1\) & \(0\) & \(1\) & 2 & 2 & 1 & 3 & 2 \\ \hline
**Node 3** & \(1\) & \(1\) & \(0\) & \(1\) & \(1\) & 2 & 2 & 3 \\ \hline
**Node 4** & \(2\) & \(2\) & \(1\) & \(0\) & \(1\) & \(1\) & 2 & 2 \\ \hline
**Node 5** & \(2\) & \(2\) & \(1\) & \(1\) & \(0\) & \(1\) & \(1\) & 2 \\ \hline
**Node 6** & \(2\) & \(1\) & \(2\) & \(1\) & \(1\) & \(0\) & \(1\) & \(1\) \\ \hline
**Node 7** & \(3\) & \(3\) & \(2\) & \(2\) & \(1\) & \(1\) & \(0\) & \(1\) \\ \hline
**Node 8** & \(3\) & \(2\) & \(3\) & \(2\) & \(2\) & \(1\) & \(1\) & \(0\) \\ \hline \end{tabular}
\end{table} 
Table 9: Shortest path distances \(\mathrm{d_{ij}}\), for every pair of nodes. Node 1 is successfully attacked (i.e., drop in network efficiency by 20.1%), even though it is probabilistically ranked as the second most vulnerable node (i.e., P(1) = 0.57, see Table 7).