# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
## 3 Vulnerability Assessment Approach
### Calculation of PI Ratio  
For reasons of simplicity, we performed in the example detailed in Section 3.2, the assignment of probability scores in an arbitrary way. Traditionally, it is common practice for expert(s) who have bespoke knowledge of their system to determine the probability scores [69]. To enable a more detailed assessment, we propose the integration of a PI in order to assign probabilities scores in every vulnerability state in the BN attack graph. The PI, as shown in Equation (2), requires stakeholders who act as assessors, to consider not only the condition of the IoT-enabled transportation infrastructure but also the attacker profile. The numerator of PI is equal to the weighted average of the level of attacker who attempts to exploit the vulnerability state. The denominator of PI is equal to the level of control barriers that exist to protect the vulnerability state from being exploited in physical and cyber space (see Section 3.3.1). The proposed attacker profile characteristics, for cyber-physical attacks against a sensing layer of IoT-based WSN, has been detailed in our previous work [18]. In summary, it builds on the level (i.e., \(\rm X_{i}\)) and the importance index (i.e., \(\rm W_{i}\)) of the following characteristics, namely _knowledge_ (i.e., \(\rm X_{KN}\), \(\rm W_{KN}\)) (i.e., describes cyber skills, attack methods, etc. ), _resources_ (i.e., \(\rm X_{RE}\), \(\rm W_{RE}\)) (i.e., describes budget, manpower, etc. ), _Psychology_ (i.e., \(\rm X_{PS}\), \(\rm W_{PS}\)) (i.e., describes the motives), and _terrorism experience_ (i.e., \(\rm X_{Te}\), \(\rm W_{Te}\)) (i.e., describes the ability of attacker to remain undetected in public areas and the ability of gaining access to sensitive critical information infrastructure). These characteristics enable the assessment of classified attacker profiles that act against critical infrastructure such as basic users, cybercriminals, nation states, and hostile organizations [70]. For example, if the attacker is considered to be a nation state, then the _knowledge_ (i.e., \(\rm X_{KN}\)), _resources_ (i.e., \(\rm X_{RE}\)), _psychology_ (i.e., \(\rm X_{PS}\)), and _terrorism experience_ (i.e., \(\rm X_{Te}\)) should be in the high level (see Table 1). Figure 3: A Bayesian network attack graph example. The level of control barriers (i.e., \(\chi_{\text{cb}}\)) refers to the level of protection for the vulnerability state, whether in the physical space (i.e., _technological_ means such as motion detectors and _human or non-technological_ means such as perimeter protection, for example) or in the cyber space (e.g., advanced encryption). For example, physical proximity to an IoT-enabled transportation infrastructure may be restricted due to motion detectors that indicate a greater \(X_{\text{cb}}\) in the physical space, but IoT devices may lack encryption when transmitting data that indicate a lower \(X_{\text{cb}}\) in the cyber space. The rating scale of characteristics level (i.e., \(X_{\text{i}}\)) and importance index (i.e., \(W_{\text{i}}\)) is shown in Table 1, and has been detailed in our previous work [18]. For a specific cyber-physical attack scenario, \(X_{\text{i}}\) represents the level of the characteristics and \(W_{\text{i}}\) represents the importance of the characteristic to the successful completion of the attack. For example, if the attacker has access to a large budget (i.e., \(X_{\text{RE}}\) is assigned to a High level), they still must access traditional hardware devices (e.g., laptops) in order for the attack to be successful. Subsequently, the specific characteristic is of lower importance (i.e., \(W_{\text{RE}}\) is assigned to a Low level). The assessment of the level of attacker profile characteristics and control barriers, which enables the calculation of PI, follows the rationale of the widely used cybersecurity industrial standards released by the National Institute of Standards and Technology (NIST), such as NIST SP800-30 [71].