# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
## 2 Related Work
[53] proposed the use of a model based on attack graphs to enable organisations to identify the most vulnerable nodes in their security analysis by reducing their complex use (i.e., attack graphs). The model is based on reported vulnerabilities in NVD and is assigned scores based on CVSS. Despite the consideration of industrial databases and frameworks that reduce the complexity of the attack graph, the method is applicable only when vulnerabilities in the cyber space are considered, such as those included in NVD. In contrast, the study in this paper integrates vulnerabilities into the physical space, considering the cyber-physical perspective of a transportation network. Similarly, [PERSON] et al. [54] proposed an approach that merges kill chains as a means to model attacks as sequences of steps [55] and attack graphs. The kill chain attack graph relies on the current knowledge for attacker modelling provided by the MITRE ATT&CK framework [37]. The approach provides information to security administrators, although this is strictly for network intrusions, as the applied attacker modelling is based on previous cyber events. However, the approach used in this paper explicitly considers additional attacker characteristics (i.e., terrorism experience) necessary to exploit vulnerabilities in the physical space. Probabilistic graphical models based on Bayesian networks have been previously applied in studies related to cybersecurity. [PERSON] et al. [56] highlighted the role of BN in inherently qualitative cybersecurity models. The structure of the BN, as a directed acyclic graph of an arc that represents the dependencies between the nodes and variables, enables the efficient conversion of qualitative metrics (e.g., low) into quantitative values. Specifically, the child node has the cause element, and the parent node has a result element from the child nodes. A probability table then summarizes the occurrence probability between the causal relationship nodes, which can be updated at any time. The use of BN in studies related to cybersecurity and transportation networks is mainly associated with security issues in advanced vehicles (e.g., connected and autonomous vehicles) [57]. [PERSON] et al. [58] developed belief network-based attack modelling at signalized traffic networks under connected vehicle and intelligent signals frameworks. Vulnerability scores for signal controllers' equipment (e.g., sensor), as part of the Bayesian network, were based on metrics with certain ranges of assigned scores (i.e., low, medium, etc. ), resulting in the quantification of impact (e.g., delays). In this approach, a new PI is applied. This enables stakeholders, who act as assessors, to accurately assign a probability score, based on a detailed attacker profile and the control barriers that protect the system. Although related studies have succeeded in raising awareness of the susceptibility of transportation networks to traditional threats (e.g., terrorism) or emerged threats (e.g., cyberattacks), they have certain deficiencies. Firstly, they focus on threats which are mainly derived from the physical space, overlooking the increased vulnerability of transportation network due to cyber-physical attacks [41]. Furthermore, studies that follow a static analysis assess the vulnerability of transportation network after the removal of nodes following centrality measure-based ranking [43]. Such an approach is misleading, as topological attributes lack details related to security issues. Other approaches within the domain of security engineering and transportation networks either focus on attacker profiles with limited characteristics [50], or on exploitable vulnerabilities of advanced vehicles [58], overlooking the security weaknesses of IoT-enabled transportation infrastructure at the sensing layer. The approach used in this paper considers the vulnerability of an entire transportation network against cyber-physical attacks by integrating a detailed attacker profile to accurately identify the most vulnerable nodes.