## 2 Connected Autonomous Vehicle (CAV) Cyberattacks  
Cyberattacks on CAVs attempt to exploit vulnerabilities in vehicle software, digital systems, and/or communication networks to disrupt functionality, compromise safety, and/or gain unauthorized access to sensitive data [45]. The targets are vehicle-to-vehicle and vehicle-to-infrastructure communication, onboard systems and algorithms, controllers, and software for entertainment, infotainment, safety, and navigation [46]. The potential attacks are spoofing, denial-of-service (DOS), malware injection, jamming, and man in the middle [47,48]. Spoofing can compromise GPS data to corrupt vehicle navigation [49]. A DOS attack can overload systems to degrade services such as communication. Vehicle control can be lost due to malware. Incorrect data can be communicated to neighboring vehicles, which can lead to accidents [50]. Ransomware attacks can result in financial and data losses, transportation system disruption, and even death [47,51]. Thus, robust cybersecurity measures are required to address these attacks.  
Traffic safety is a very important consideration. Cyberattacks can compromise the distance and time headway between vehicles, which creates safety issues [51]. Communicating a larger headway can reduce vehicle speed, while a smaller headway results in an increase in speed. This will not only disturb the flow efficiency and road capacity but also increase congestion and the probability of accidents [47]. Therefore, cyberattacks on CAVs  
Figure 1: A flowchart of the methodology employed.  
are considered here to assess their impact on traffic dynamics. The threshold (intensity) of a cyberattack is determined based on the impact of an attack on the system, the potential for propagation, and the cumulative effect. The factors considered are attacked exposed surface (\(ES\)), severity impact (\(SI\)), propagation rate (\(PR\)), detection latency (\(DT\)), impact scope (\(IS\)), and recovery time (\(RT\)) [48, 50, 51, 52]. This includes the potential number of interfaces and systems that can be attacked, the impact on safety and function, the speed and spread of the attack, the time taken to detect the attack, the vehicles and infrastructure affected, and the time taken to recover. The cyberattack intensity is expressed as  
\[c=w_{1}ES+w_{2}SI+w_{3}PR+w_{4}\frac{1}{DT}+w_{5}\frac{1}{RT}+w_{6}IS \tag{1}\]  
where \(w_{1}\), \(w_{2}\), \(w_{3}\), \(w_{4}\), \(w_{5}\), and \(w_{6}\) are weights based on the severity and importance of the factors. \(ES\) and \(SI\) are integers, \(PR\) is the percentage of the systems affected, \(DT\) and \(RT\) are measured in minutes, and \(IS\) ranges from 1 to 10. A larger value of \(c\) indicates a more severe attack. The factors considered are \(ES=6\), \(SI=7\), \(PR=67.21\%\), \(DT=3\) min, \(RT=21\) min, and \(IS=10\). The corresponding weights are \(w_{1}=1\), \(w_{2}=1.4\), \(w_{3}=1.1\), \(w_{4}=0.7\), \(w_{5}=0.7\) and \(w_{6}=1\). This results in \(c=100\) so the attack is severe. If the propagation rate is reduced to \(PR=3.57\%\), the cyberattack severity is \(c=30\). These intensity values are considered here to evaluate the impact of cyberattacks on traffic.