# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
###### Abstract
The recent advances in graph theory, with the use of topological attributes, enable the ranking of important nodes or edges in the graph based on centrality measures (e.g., node degree as the number of edges that are incident to a node) [32]. As a result, the behavior of transportation networks (e.g., efficiency) is studied after node removal [2; 33]. Although centrality-based ranking is employed to identify the most important nodes based on physical attributes (i.e., centrality measures), it lacks information related to security weaknesses and cyber space. Therefore, the identification and removal of nodes based on topological attributes, when cyber-physical attacks are considered, is impractical. Therefore, in order to assess the attack paths that the attacker should follow to achieve their goal, studies in the security engineering domain have highlighted the role of probabilistic methods (e.g., Bayesian network attack graphs [34]. Additionally, the role of probabilistic methods is enhanced when knowledge from publicly available databases and industrial frameworks is applied. For example, a widely used public database is the National Vulnerability Database (NVD) [35]. This assigns a common vulnerability and exposure number (CVE-ID) to every reported vulnerability, which is later assessed through Common Vulnerability Scoring System (CVSS) [36]. Similarly, MITRE ATT&CK is an industrial framework, that provides details related to the capabilities of the attacker based on previous cyber intrusions [37]. Despite the beneficial use of probabilistic methods, along with the integration of knowledge from public databases and industrial frameworks, these studies mainly focus on network security breaches (e.g., through the internet). Therefore, the role of physical space is overlooked. Indeed, the role of the physical space is of major importance when traditional cyber-physical attacks against the sensing layer (e.g., eavesdropping, man-in-the middle attack [38]) of an IoT-enabled transportation infrastructure are considered. In this case, the attacker may be required to initially exploit vulnerabilities in the overlooked physical space (e.g., deficient perimeter protection) to gain physical proximity to the IoT-based WSN. Such physical vulnerabilities are not included in public databases related to cybersecurity. Furthermore, the characteristics of attackers (e.g., skills) are mainly derived from the cyber space. Therefore, characteristics derived from the physical space (i.e., terrorism experience), such as those described in our previous work [18], have not been considered. To bridge the gap, a new vulnerability assessment approach for transportation networks subjected to cyber-physical attacks at the sensing layer is proposed in this paper. In this approach, a transportation network is represented in the form of a graph with a set of nodes that represent the IoT-enabled transportation infrastructure. These IoT-enabled nodes, connected through their edges, are the targets of the cyber-physical attack. The approach relies on a Bayesian network (BN) attack graph [39] that enables us to probabilistically model vulnerabilities as different states of the attack, combining cyber and physical space for the first time. To assist stakeholders (i.e., operators, civil and security engineers) who acts as assessors towards the detailed assignment of probability scores to vulnerability states, a novel probability indicator (PI) is applied. The PI acts as ratio, considering the level of attacker, under certain profile characteristics (e.g., motivation), and the level of control barriers that protect the vulnerability state (e.g., encryption). Following the probabilistic analysis, a new probability-based ranking table is developed that describes the probabilistically most vulnerable nodes to the cyber-physical attack. Finally, the vulnerability of the transportation network is measured as a drop in efficiency after the removal of the highest probability-based ranked nodes.