# A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber-Physical Attacks
## 4 Case Study of a Cyber-Physical Transportation Network
### Case Study Application of Vulnerability Assessment Approach  
Experimental and theoretical studies have highlighted the security issues of Zigbee [83; 84]. One of the main security issues of ZigBee technology relies on key management, enabling the sniffing of security keys and the conduction of denial-of-services attacks (DoS) [62; 82]. This will be considered in this case study as Activity 1 (i.e., see Figure 2, _Selection of a sensing area cyber-physical attack scenario_).The selected attack has been experimentally tested with success [62; 82]. Key management is of vital importance for the security specifications of ZigBee devices. One of the ZigBee devices (i.e., Trust Center) is responsible for the security key management, providing the network key as a security key. The network key acts as a security mechanism which enables secure communication within the devices of the ZigBee network. The Trust Center is also responsible for the selection of the security level that determines whether the network key is transmitted encrypted over the air (i.e., high security level) or is transmitted unencrypted over the air (i.e., standard security level). When the latter security level is used (i.e., standard security level), the network key is not pre-installed to all legitimate devices of the ZigBee network by the administrator and is transmitted unencrypted over the air. In this case, the administrator has opted for a less secure but more usable option, which is typical for large-scale networks. By capturing the over-the-air transmitted packets, the attacker can legitimately communicate with the victim ZigBee network and exploit additional vulnerabilities, such as limited energy resources, resulting in an unavailability of data (e.g., Denial-of-Service attack (DoS)). Following Activity 2 (i.e., see Figure 2, _Division of cyber-physical attack scenario into vulnerability states in physical and cyber space_), the cyber-physical attack scenario can be divided into the following vulnerability states. Initially, the attacker needs to infiltrate the physical sensing area of the critical transportation infrastructure where the ZigBee enabled network is located. In order to accomplish this, the attacker should overcome the physical control barriers (i.e., physical space) that rely on non-technological or human operation (i.e., State A, V\({}_{\text{A}}\)) and technological operation (i.e., State B, V\({}_{\text{B}}\)). The specific physical control barriers operate individually and therefore the attacker should overcome both, where those are applicable. Then, the attacker should capture the over-the-air traffic and parse the network key by using packet sniffers (e.g., KillerBee [85]) and legitimately communicate  
Figure 4: Case study of a cyber–physical transportation network. with other ZigBee devices. The attacker should overcome the cyber control barriers (i.e., cyber space) that rely on the security level used (e.g., standard) and the subsequent level of encryption (i.e., State C, V\({}_{\text{C}}\)) and flood the other ZigBee devices with bogus messages. Bogus messages will result in transmission failure and the denial of services by overcoming the cyber control barriers that rely on the energy resources level and audit mechanisms (i.e., State D, V\({}_{\text{D}}\)). In order to compute the probability score of a successful attack given the previous exploitation of vulnerability states in the physical and cyber space, the completion of Activity 3 (i.e., see Figure 2, _Development of conditional probability table for every node i_) and Activity 4 (i.e., see Figure 2, _Calculation of probability indicator (PI)_) is necessary. An example of the BN attack graph and CPT structure is provided by considering Node 6 in the graph (i.e., see Figure 4), as shown in Figure 5. We assume that. for the considered node (i.e., Node 6), the successful exploitation (i.e., True as T, False as F) of State A (i.e., V\({}_{\text{A}}\)) and B (i.e., V\({}_{\text{B}}\)), C (i.e., V\({}_{\text{C}}\)), D (i.e., V\({}_{\text{D}}\)) is required.