# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
## 3 Vulnerability Assessment Approach
### Calculation of PI Ratio
According to this standard, assessment can be further facilitated by several organizational factors such the use of stakeholders' expertise, previous incident reports or the monitoring of public available catalogues (e.g., CAPEC [60]). \[\text{PI}=\frac{\text{Weighted average attacker level}}{\text{Control barrier level}}=\frac{\frac{W_{\text{KN}}\times X_{\text{KN}}+W_{\text{BE}}\times X_{\text{BE}}+W_{\text{PE}}\times X _{\text{SB}}+W_{\text{PE}}\times X_{\text{BE}}}{W_{\text{KN}}+W_{\text{BE}}+ W_{\text{PE}}+W_{\text{PE}}}}{X_{\text{cb}}} \tag{2}\]  
As in several cybersecurity studies, the role of stakeholders in this approach that considers cyber-physical transportation networks is of major importance. Indeed, the role of stakeholders as experts combines the logical and mathematical procedures to elaborate their assessment for the considered system [72]. Their involvement is mainly necessitated due to the lack of statistical data for cyberattacks and in order to understand the characteristics of recent attacks and their patterns of occurrence [73]. These reasons are amplified due to the premature level of development IoT-enabled transportation networks. Currently, no validated procedure exists that enables the assessment of values related to cybersecurity issues, such as the probability of a successful exploitation. Therefore, the assessment of different metrics, such as assignment of probability scores, highly depends on the judgement of experts with a bespoke knowledge of their system [69]. However, recent studies in cybersecurity have highlighted that attacker characteristics (e.g., skills) should be additionally integrated into the assessment procedures [74]. Therefore, we propose the integration of a PI to drive that a more detailed assessment process (i.e., assignment or probability scores). The PI acts as a ratio that considers both the bespoke knowledge of the system through control barriers and the attackers characteristics. Therefore, based on the calculation of PI for very vulnerability state, the probability scores should range within the values shown in Table 2. Due to the abovementioned lack of validated procedures, the ratio builds on a linear relationship between the attacker characteristics and control barriers. Specifically, \(X_{\text{i}}\) (see Table 1) ranges from one (i.e., low level) to three (i.e., high level). Therefore, the PI is linearly distributed to five scales that consider the upper and the lower boundaries of \(X_{\text{i}}\), as shown in Equation (2). For example, if the assessment of \begin{table}
\begin{tabular}{c c} \hline \hline
**Qualitative Rating Scale/Level \(X_{\text{i}}\)** & **Qualitative Rating Scale/Importance Index \(W_{\text{i}}\)** \\ \hline Low/0.01–1 & Very Low/0.00–0.20 \\ Medium/1–2 & Medium/0.41–0.60 \\  & High/0.61–0.80 \\ High/2–3 & Very High/0.81–1.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Rating scale per level \(X_{i}\), and importance index \(W_{i}\). the numerator (i.e., attacker assessment) ranges in high-level values (i.e., 2-3) and the assessment of denominator (i.e., control barriers) ranges in low level values (0.01-1), then PI ranges from two to three. Stakeholders can determine their own probability boundaries, availing themselves of the use of attacker characteristics. For the purposes of this approach, we evenly distribute the range of probability scores to five scales in order to match them with the range of PI, as shown in Table 2.  
It is evident that a greater attacker level with a lower control barrier level will result in higher values of PI (i.e., values ranging from two to three) and subsequently in a higher range of probability scores for a vulnerability state, \(i\) (i.e., P(i)). For example, in a vulnerability state \(i\), if the level of attacker is equal to 2.5 (i.e., a high level of attacker) while the control barrier level is equal to 1 (i.e., a low level of protection), then, based on PI, the probability score of successful exploitation ranges from 0.75 to 1.