metadata: authors: 0: author: Zou,Bo
1: author: Choobchian,Pooria
2: author: Rozenberg,Julie
count: World
docna: 0: docna: Cyber Resilience of Autonomous Mobility
            Systems : Cyber Attacks and Resilience-Enhancing Strategies
docty: Policy Research Working Paper
subtopic: Transport Services,ICT Applications,Intelligent Transport Systems,Crime and Society,Common Carriers Industry,Food & Beverage Industry,Business Cycles and Stabilization Policies,Plastics & Rubber Industry,Construction Industry,General Manufacturing,Textiles, Apparel & Leather Industry,Pulp & Paper Industry
teratopic: Information and Communication Technologies,Transport,Social Development,Macroeconomics and Economic Growth,Industry
abstracts: cdata!: The increasing cyber connectivity of
            vehicles and between vehicles and infrastructure will
            drastically reshape mobility in the coming decades. Although
            the advent of connected mobility is expected to benefit
            travelers and society by smoothing traffic, improving rider
            convenience, and reducing accidents, the augmented cyber
            components in connected and autonomous vehicles and related
            infrastructure also give rise to cyber attacks on the
            transportation system. Yet, little attention has been paid
            to transportation cyber resilience. This paper thus proposes
            an investigation on this topic with a comprehensive
            literature review. Cyber components and plausible autonomous
            mobility systems operation scenarios are discussed, before
            identifying possible cyber attacks to autonomous mobility
            systems at the vehicle and system levels. The discussion
            then moves to existing practices to enhance cybersecurity,
            and several strategies are investigated toward enhancing
            autonomous mobility system cyber resilience. At the vehicle
            level, creating layers and separation to reduce cyber
            component connectivity and deploying an independent
            procedure for data collection and processing are important
            in vehicle design and manufacturing. At the system level,
            recommended strategies include keeping redundancy in
            transportation capacity, maintaining a separate road
            network, and deploying different sub-autonomous mobility systems.
repnme: repnme: Cyber Resilience of Autonomous Mobility
            Systems : Cyber Attacks and Resilience-Enhancing Strategies
display_title: Cyber Resilience of Autonomous
            Mobility Systems : Cyber Attacks and Resilience-Enhancing Strategies
listing_relative_url: /research/2020/01/31743752/cyber-resilience-autonomous-mobility-systems-cyber-attacks-resilience-enhancing-strategies
topicv3: Manufacturing Sectors m1326521 1281,Transport m1326661 135,ICT Security m1326856 670,Criminal Justice m1326993 1014,Traffic Management m1583399 4231
publishtoextweb_dt: 2020-01-30T00:00:00Z
historic_topic: Information and Communication Technologies,Transport,Social Development,Macroeconomics and Economic Growth,Industry
origu: Urban LCR (SLCUR)
no_of_pages: 24
author_keys: 0: author_key: 1296276
model_extractions: Policy Research Working Paper 9135 Cyber Resilience of Autonomous Mobility Systems Cyber Attacks and Resilience-Enhancing Strategies _Bo Zou Pooria Choobchian Julie Rozenberg_ Sustainable Development Office of Chief Economist January 2020
Policy Research Working Paper 9135

# **Abstract**

The increasing cyber connectivity of vehicles and between vehicles and infrastructure will drastically reshape mobility in the coming decades. Although the advent of connected mobility is expected to benefit travelers and society by smoothing traffic, improving rider convenience, and reducing accidents, the augmented cyber components in connected and autonomous vehicles and related infrastructure also give rise to cyber attacks on the transportation system. Yet, little attention has been paid to transportation cyber resilience. This paper thus proposes an investigation on this topic with a comprehensive literature review. Cyber components and plausible autonomous mobility systems operation scenarios are discussed, before identifying possible cyber attacks to autonomous mobility systems at the vehicle and system levels. The discussion then moves to existing practices to enhance cybersecurity, and several strategies are investigated toward enhancing autonomous mobility system cyber resilience. At the vehicle level, creating layers and separation to reduce cyber component connectivity and deploying an independent procedure for data collection and processing are important in vehicle design and manufacturing. At the system level, recommended strategies include keeping redundancy in transportation capacity, maintaining a separate road network, and deploying different sub-autonomous mobility systems.

This paper is a product of the Office of the Chief Economist, Sustainable Development, and was funded by the Korean Green Growth Trust Fund. It is part of a larger effort by the World Bank to provide open access to its research and make a contribution to development policy discussions around the world. Policy Research Working Papers are also posted on the Web at http://www.worldbank.org/prwp. The authors may be contacted at jrozenberg@worldbank.org.

_The Policy Research Working Paper Series disseminates the findings of work in progress to encourage the exchange of ideas about development issues. An objective of the series is to get the findings out quickly, even if the presentations are less than fully polished. The papers carry the names of the authors and should be cited accordingly. The findings, interpretations, and conclusions expressed in this paper are entirely those of the authors. They do not necessarily represent the views of the International Bank for Reconstruction and Development/World Bank and its affiliated organizations, or those of the Executive Directors of the World Bank or the governments they represent._ Produced by the Research Support Team
Cyber Resilience of Autonomous Mobility Systems: Cyber Attacks and Resilience-Enhancing Strategies Bo Zou<sup>(1)</sup> , Pooria Choobchian<sup>(1)</sup> , Julie Rozenberg<sup>(2)</sup> (1) University of Illinois at Chicago, (2)World Bank

**JEL** : R42 R48

**Keywords** : autonomous mobility systems; cyber resilience; cyber attacks; vehicle- and system-level strategies
# **1 Introduction**

The objective of this paper is to understand the cyber resilience of transportation systems, with a focus on future autonomous mobility. Cyber resilience is becoming a prominent issue in transportation as an increasing number of vehicles are Internet—and more generally cyber—connected. Taking the United States as an example, currently about 50 million vehicles or 20% of all vehicles on the road have Internet connectivity. All major car manufacturers have been committed to adding more connectivity features to their upcoming models. As a result, it is estimated that about 17 million new “connected cars” will be added to the US roads each year (Consumer Watchdog, 2019). These vehicles will be interconnected through not only cyber components in the vehicles, but also the associated infrastructure.

While the increased cyber connectivity is expected to enhance vehicle control, communication, and diagnostic functions, which contribute to improved vehicle- and system-level functioning and mobility management, cyber connectivity also exposes vehicles and the mobility system to significant risks of cyber attacks. Yet, little is known about what can be done to prepare the increasingly cyber connected vehicles and the mobility system for potential cyber attacks. Anticipating the growing trend of vehicle cyber connectivity and the eventual dominance of autonomous vehicles—which will be even more cyber connected—in the future mobility environment, this paper takes a forward-looking view by focusing on ways to enhance the cyber resilience of autonomous mobility systems (AMS). Various types of cyber attacks on AMS will be investigated and strategies to enhance AMS cyber resilience will be explored. Given the interdisciplinary nature of transportation cyber resilience, our investigation and exploration are based on a comprehensive, multifaceted literature review through journal articles and technical reports from disciplines including transportation engineering, computer science, electrical engineering, systems engineering, urban planning, and public policy. The review and subsequent analysis provide the building blocks for understanding the current practices and prospective strategies for AMS cyber resilience enhancement.

It is worth highlighting that although the focus of the paper is on AMS, many of the findings can inform enhancing the cyber resilience of today’s transportation systems given the common feature of cyber connectivity. In fact, as AMS is yet to be deployed, many discussions in the paper draw insights from research and experimentation on today’s connected vehicles and transportation systems. In the ensuing section, we first discuss the cyber components in AMS and plausible AMS operation scenarios. Understanding the AMS operation scenarios is a premise besides understanding cyber attacks to design effective measures to enhance AMS cyber resilience. A variety of plausible types of cyber attacks, at 2
<!-- Start of picture text --> Global P. os Lighti Detection and<br>Uk Cameras<br>a a Radio Detection<br>aay <— and Ranging<br>Prebuik $< an SOsTy<br>Dedicated; Short-Range Inertial Navigation SensorsInfrared<br>Communication (DSRC) Systems (INS)<br><!-- End of picture text -->
**Fig. 1.** Sensors and other technologies in a future AV

(source: Center for Sustainable Systems, 2018).

# **2.2 Plausible AMS operation scenarios**

Since AVs in an AMS do not rely on human drivers, future mobility would look quite differently from what it is today. While research on future transportation with AVs has been booming, a consensus has not been achieved on the exact operation scenario of future transportation systems. Three plausible scenarios have attracted most attention:

- _Autonomous mobility with private ownership:_ In this scenario, most vehicles running on the street will be driverless and owned by individual households. The possibility of household members coordinating schedules so that a single AV can accommodate their daily activities has been investigated. Relevant research has been further extended to looking into AVs coownership by residents in a neighborhood or a community, which can reduce the ownership cost of each individual and increase use flexibility.

- _Shared autonomous mobility:_ The second scenario also conceives a world dominated by AVs. However, these AVs will be assets of large fleet operators such as a driverless version of future transportation network companies such as Uber and Lyft. Given that all major auto manufacturers nowadays are partnering with AV technology companies and/or developing AVs independently, it is possible that auto manufacturers may also become AV mobility service providers.

- _A mixed private and shared autonomous mobility with coexistence of human-driven vehicles:_ This may be the most plausible scenario considering the long transition time from today to a complete self-driving environment, which may take at least a few decades (Fig. 2). A mix of traffic will persist on the road, including privately owned human-driven vehicles, shared human-driven vehicles, privately owned AVs, and shared AVs (see Fig. 3, which forecasts the total miles driven in the United States). The coexistence of the four types of vehicles would make traffic control very complex and  challenging for modeling and analysis (Noruzoliaee and Zou, 2019).

Note that most transportation systems of today have car and non-car modes. The coexistence of different modes is also expected to persist in the foreseeable future. Public transportation is an important non-car mode in helping mitigate traffic congestion, energy use, and emissions. In a future AMS, alternative modes other than AVs, especially those that could be immune to cyber attacks, would 4
<!-- Start of picture text --> 100%<br>=== Sales - Optimistic<br>— — — Sales - Pessimistic<br>80% ——— Travel - Optimistic<br>—-—-Travel- Pessimistic<br>60% —————-—Fleet- Fleet - OptimisticPessimisticpam<br>40%<br>20%<br>0%<br>2020 2030 2040 2050 2060 2070<br><!-- End of picture text --> <!-- Start of picture text --> 2025: Shared driver-<br>4,500,000 cedof milesfordriven>40%<br>4,000,000<br>w 3,500,000 2040: Shared<br>5 mobility accounts<br>= for ~80% of<br>= 3,000,000 miles driven<br>&<br>§ 2,500,000<br>$<br>PH 2,000,000<br>E 1,500,000<br>3<br>c<br>& 1,000,000<br>Introduction of shared (2020)<br>500,000 andpipiens personally heownedvehicles(2022)<br>5 v<br>2015 2020 2025 2030 2035 2040<br>@ Personallyowned driver-driven Ml Shared driver-driven @TM@ Personowned a utonomouslly ‘ll Shared autonomous<br>Source: Deloitte analysis based on publicly available information. See appendix for data sources.<br>Graphic: Deloitte University Press | DUPress.com<br><!-- End of picture text -->
Cyber-attacks Autonomous Mobility System Cyber vulnerabilities Harmful consequences on e Operational efficiency e Safety e Privacy
Many types of cyber attacks are relevant to AMS. We classify a range of plausible cyber-attacks on AMS based on two criteria. The first criterion is whether an attack is more likely for a single AV or for a system. Vehicle-level attacks target functions and devices such as the camera, radar instruments, and internal communication within an AV. By contrast, system-level attacks aim at the sensing, control, and communication infrastructure (e.g., road sensors, traffic lights, and wireless Internet servers) that serves AVs in an area or a type(s) of AVs. Note that aggregating vehicle-level attacks does not necessarily make up a system-level threat because the points of vehicle-level attacks are individual AVs, whereas the points of system-level attacks are not individual AVs but the infrastructure that supports operations and communications of AVs.

The second criterion for cyber attack classification is whether an attack is active or passive. An active cyber attack is highly malicious, aggressive, and blatant, attempting to negatively alter the communications and/or operations of AVs. AMS operator(s) will be able to detect once the attack is successful and react immediately. By contrast, a passive cyber attack employs non-disruptive and covert methods. As a result, there is no immediate harmful consequence in altering AMS communications and operations. Passive cyber attacks are often about gathering AV operation/communication data and less likely to draw attention from AMS operators.

Below we provide brief descriptions of different plausible cyber attacks to AMS.

# **3.1 Vehicle-level attacks**

_<u>Gaining steering control of an AV (active attack):</u>_ Under this attack, an attacker will fully control the motion of an AV toward damaging consequences, for example, by stroking the brake-pedal suddenly or turning the steering wheel of the vehicle to cause crashes. Such malicious attacks, aiming at passenger injury or death, impose very serious safety concerns for AMS. Gaining steering control of an AV can be realized through masquerade attacks (Yagdereli et al., 2015).

_<u>Deactivating sensors of an AV (active attack):</u>_ This type of attack compromises only the sensor components of a vehicle. Nonetheless, the potential harm could still be considerable. For example, deactivating sensors responsible for detecting surrounding objects (e.g., other AVs, human-driven vehicles, and pedestrians) and lights in the environment will cause traffic accidents. Alternatively, the risks will trigger vehicle safety warnings that result in unexpected stopping of the AV.

_<u>Exfiltrating data (active attack):</u>_ Data exfiltration is a security breach in which data stored in an AV are illegally copied, retrieved, and transferred by attackers. The breach could be through a remote application or a physical access point on the AV. Exfiltrated data can be subsequently used to influence 7
human interactions with AVs and even fool AV users and/or AMS operators to take actions towards nefarious activities (Axelrod, 2017).

_<u>Rebroadcasting message (active attack):</u>_ A cyber attacker can replay a previous message (e.g., an accident alert) to elicit a wanted reaction of an AV (e.g., stroke of a brake pedal). This reaction could force an AV into a vulnerable state (e.g., system reset) or allow the attacker to store information for future attacks. With message rebroadcasting, not only the information integrity but also message authentication and access control of an AV can be compromised.

_<u>Introducing incorrect input signals (active attack):</u>_ If an attacker has access to the vehicle-tovehicle and/or vehicle-to-infrastructure communication networks of an AV, the attacker can trick the AV into an incorrect action by generating erroneous process information. For example, an accident alert can be sent by an attacker to an AV to activate the braking-pedal action, creating traffic disruptions in the surrounding area (Yagdereli et al., 2015).

_<u>Modifying message (active attack):</u>_ A cyber attacker can modify messages either between AVs or between AVs and the AMS operator. The most common means of message modification is through “man-in-the-middle” attacks (Yagdereli et al., 2015). The modification can be delaying the sending/receiving time; inserting/deleting contents; and reordering the sequence that messages are sent. As such, modified messages can direct AVs to take actions wanted by the attacker.

_<u>Eavesdropping (passive attack):</u>_ In eavesdropping, an attacker acquires vehicle movement and communications information by intercepting data traffic to and from an AV. The acquired data are used to plan future active attacks. Data interception often takes place at devices in the middle of data transmission between AVs and AMS servers. In general, eavesdropping is difficult to detect since it does not cause abnormal data transmissions (Dobran, 2019).

_<u>Traffic analysis (passive attack):</u>_ Similar to eavesdropping, traffic analysis does not affect the normal functioning of AV(s). An attacker deducts certain properties of information transactions including duration, timing, and bandwidth that are difficult to disguise in communications. With the deducted information, traffic analysis can be performed to allow an attacker to examine the AV network for other malicious purposes (Yagdereli et al., 2015).

# **3.2 System-level attacks**

_<u>Denial-of-Service (active attack):</u>_ A common issue for cybersecurity of communication networks, denial-of-service refers to prevention of authorized user access to AMS. A denial-of-service attack can involve malicious coding and message spamming that absorb all available bandwidth, making communications between AVs and infrastructure unavailable. The AMS communications network will 8
be infected by malicious software or by the attacker constantly sending packets to AMS server ports to jam needed communications for normal AV functions such as routing, warning, and spatial sensing.

_<u>Interrupting communications (active attack):</u>_ A cyber attacker interferes with communications between the control components of an AMS. By issuing a data request that causes the control systems to obstruct the normal processing sequence of the systems to respond to the request, this interference undermines the stability of routine communications and therefore operations of AMS (Kisner et al., 2010; Kisner, 2009). Such disruptions, once detected, will prompt the AMS operator to reduce or even cease provisions of mobility service in order to recover or switch to backup communication networks.

_<u>Generating incorrect output values or commands (active attack):</u>_ This type of attacks generates erroneous output values or commands and sends them to devices in AMS that enable interaction between cyber and physical components. Consequently, an AMS operator can be misled to take AV routing and dispatching decisions that are not the best for the current operational status, or even disrupt AMS operations and traffic on the roads.

_<u>Collecting AMS operational information (passive attack):</u>_ This type of attack attempts to gain access to AMS operation data through eavesdropping AMS servers. Although not disrupting normal functioning of AMS, the information collected can be used to estimate the operational parameters and states of AMS such as distribution, speed, and fueling of AVs, and to help forge more targeted active cyber attacks in the future.

# **4 Enhancing the cyber resilience of AMS**

Given the variety of plausible cyber attacks, making AMS resilient to cyber attacks is critically important. The premise of doing so is to understand what cyber resilience means for AMS. Answering this question will build on the understanding of cyber resilience and resilience in general, as is in subsection 4.1. In subsection 4.2, we will examine current practices in strengthening AV cybersecurity, a closely related issue to AMS cyber resilience. Further strategies at both vehicle and system levels to enhance AMS cyber resilience are proposed in subsection 4.3.

## **4.1 Resilience and cyber resilience**

### **4.1.1 Resilience**

We start our discussion with the most general definition of resilience. Following the 2019 version of the Merriam-Webster dictionary, resilience is described as the “ability to recover from or adjust easily to misfortune or change”. In the academic literature, the concept of resilience is initialized in the 9
context of ecological systems by Holling (1973), who refers to resilience as a system’s ability to persist without eventually moving to a different state of behavior when exposed to changes or shocks (Zou et al., 2018). Later, Bruneau et al. (2003) adapt the resilience concept in earthquake engineering, as the ability of a system to resist and absorb the impact of disruptions. Focusing on infrastructure systems, the definition of resilience is enriched by Faturechi and Miller-Hooks (2014) who argue that resilience accounts for possible interventions that help return system performance to near pre-disruption levels. The authors stress the importance of resilience measures in quantifying the potential benefits of predisruption mitigation actions for increasing the system’s ability to cope with disaster impact, as well as post-disaster adaptive actions that aim to restore system functionality. Another widely-used definition of resilience is from the US National Academy of Science (2012), which relates resilience to the ability of a system to plan for, absorb, recover from, and more successfully adapt to adverse events.

While the definitions/descriptions of resilience vary in emphasis depending on the application context, resilience covers two essential aspects: 1) preparing a system before disruptions; and 2) recovering the system after disruptions occur. The preparation aspect can be alternatively interpreted as enhancing the resistance of a system to attacks. The aim of implementing a comprehensive resilience plan, therefore, is to reduce the potential damages caused by attacks through resistance and enhance fast recovery (Linkov et al., 2013). This two-aspect view is echoed by Zhou et al. (2019), who focus on transportation systems resilience and conclude that all resilience definitions for transportation systems take the following two perspectives: i) the ability to maintain the system functionality under disruptions; and ii) the time and resources required to restore performance after disruptions. As shown in Fig. 5, the first perspective is related to a disruption phase, beginning from the occurrence of a disruption and ending when the system performance reaches the minimum level. In this phase, robustness and redundancy of system functionalities are key to minimize the consequence of disruptions. The second perspective is associated with a recovery phase. When it starts, system performance is expected to improve, till return to the original performance level which means full recovery. This phase usually takes a longer time than the disruption phase. The abundance and optimal and speedy use of resources are critical to recovery.

10
<!-- Start of picture text --> P P(to) P(t2)<br>100%<br>!|<br>i !<br>PG) |<br>! ' '<br>fo ty f2 Time<br>Disruption phase Recovery phase<br>(Robustness + Redundancy) (Resourcefulness + Rapidity)<br><!-- End of picture text -->
Moreover, the evolving possible surfaces of cyber attacks adds to the difficulty in ranking and prioritizing the importance of each attack and corresponding mitigation strategies.

The third particularity is about strategies to enhance cyber resilience. Cyber resilience deals with connected complex systems involving hardware, software, and sensing components. In comparison to natural disasters, the smart nature of cyber attackers places another layer of complexity for cyber resilience enhancement. Cyber attackers have the flexibility to attack either part of a system or use more sophisticated attacking methods to cause deeper and broader consequences. Not surprisingly, strategies for resilience enhancement in the cyber world are more varied than strategies dealing with physical system resilience.

Any enhancement of cyber resilience must be built on solid assessment of cyber resilience, which is still at an infant stage. Linkov and Kott (2019) argue that the assessment should draw ideas from the general resilience literature in which two primary approaches have been developed: metric-based and model-based (Fig. 6). The metric-based approach uses metrics of individual properties of system functions to assess the overall performance of a system. For instance, one metric for AMS cyber resilience, following the idea of Hallegatte et al. (2019), can be the ratio of unfulfilled rider trips to the number of malfunctioning AVs for a period starting from the outset of a cyber attack. For this metric, the number of unfulfilled rider trips represents the loss of system functionality. The number of malfunctioning AVs captures the loss of assets. Intuitively, a lower metric value corresponds to greater cyber resilience.

The model-based approach employs system configuration models and performs scenario analysis to predict system evolution before, during, and after an attack. This approach requires knowledge of the critical functions of the system, temporal patterns of the system, thresholds, and system memory and its learning process (Linkov and Kott, 2019). As an example, the interactions between a cyber attacker and the AMS operator can be modeled as a sequential attack-defend game. Resilience will be measured based on the expected costs of Nash equilibrium between the attacker and the defender. A lower expected cost means higher AMS cyber resilience.

12
<!-- Start of picture text --> Measuring Resilience<br>Metrics Based | — Model Based<br>Process<br>Individual_ Metrics. Statistical / Baysian<br>Indices aa<br>Dashboards Game- Theoretical<br>Decision Analytics Simulations/ Agent Based<br><!-- End of picture text -->
stakeholders including computer scientists/electrical engineers, transportation systems modelers/ analysts, mobility business executives/engineers, urban planners, policy makers, etc.

# **4.2.1 Cybersecurity algorithm development**

The auto industry has put tremendous efforts in developing algorithms to enhance vehicle cybersecurity (Tuncali et al., 2018; Zhang et al., 2018), to enable vehicles to respond to abnormal situations not experienced before (Pei et al., 2017; Tian et al., 2018). These situations could well be signals of cyber attacks. By training cybersecurity algorithms to recognize and respond to the situations, the ability of AVs to withstand cyber attacks will be enhanced.

Artificial intelligence, particularly deep neural networks, has been the prevalent technique for developing cybersecurity algorithms. However, at this moment data for algorithm training is limited, which suggests that failures to cope with unrecognized cyber attacks can occur. This is because traditional, manual collection of data from tests or unguided simulations to identify cyber attacks would be prohibitively expensive (Karapathy, 2017; Sculley et al, 2014). Instead, machine-based testing methodologies are being developed toward automatically detecting erroneous behaviors of AVs (Tian et al., 2018). Given that the attacking forms and techniques are constantly evolving, detecting all abnormal situations tied with cyber attacks is still a daunting if not impossible task even with the machine-based testing methodologies.

The research and development efforts for cybersecurity algorithm development goes beyond the auto industry. In the United States, the National Highway Traffic Safety Administration has established a department for research on safety, security, and reliability of connected and electronic vehicle systems. An Electronic Council is set up in the agency to enhance collaboration on and alignment of research related to vehicles and cybersecurity (McCarthy et al., 2014). Besides algorithm development, government agencies are also making endeavors in cybersecurity standard development, cyber risk assessment, cybersecurity test, and enforcement efforts.

# **4.2.2 Legislation and guidelines**

National and subnational governments are playing active roles in enacting legislation and introducing guidelines to address cybersecurity issues arising from future AVs as well as today’s vehicles. In the United States, the federal government has recently passed the SPY Car Act (2017) to address vehicle cybersecurity risks. The Act includes considerations to guard against the hacking of vehicles, such as requiring penetration testing to evaluate vehicle resilience to hacking and separating critical and non-critical software systems. In addition, the Act provides specifications to ensure security of collected information in vehicle electronic systems while the data are on the vehicle, in transit from 14
the vehicle to a different location, or in any offboard storage. This Act requires vehicles to have the capability to detect, prevent, and report attempts to hijack the control of the vehicle and capture the stored data (Lim and Taeihagh, 2018; Taeihagh and Lim, 2019).

Specific for AVs, the U.S. National Highway Traffic Safety Administration has published a nonmandatory document to facilitate integration of automated driving technologies that encourage the “development of systems that guard against cyber attacks” (NHTSA, 2017). The document provides recommendations for planning cyber incident responses, developing cyber vulnerability disclosure and reporting policies, and publishing Voluntary Safety Assessment letters. One purpose of this guideline is for standardization, i.e., encouraging entities to design AV systems in compliance with standards established by stakeholder organizations such as the Automotive Information Sharing and Analysis Center, the Society of Automotive Engineers, and auto manufacturer associations (NHTSA, 2017).

At the subnational level, a rule is drafted by the California Department of Motor Vehicles that requires auto manufacturers to certify the ability of their manufactured AVs to detect and react to cyber attacks according to industry standards (Cal DMV, 2018). The state of Massachusetts has introduced a state bill authorizing the state Department of Consumer Affairs and Business Regulation to implement regulations consistent with federal regulations to protect personal information and data collected by an Internet-of-Things device, which includes AVs (Senate Bill 179, 2017). Pennsylvania’s bill makes recommendations for AV testers to provide proof that cybersecurity precautions are taken. Immediate notification of cybersecurity intrusion attempts is required between AV testers and the Pennsylvania Department of Transportation (PennDOT, 2016; Senate Bill 427, 2017). Many other states in the United States, such as Georgia, Michigan, and Texas, have also enacted legislation to address cybersecurity for larger systems inclusive of AVs (Senate Bill 315, 2018; Senate Bill 632, 2017; Texas Cybersecurity Act, 2017).

# **4.3 Plausible strategies to enhance AMS cyber resilience**

Consistent with the discussions on cyber attacks and cyber resilience, we argue that plausible strategies to enhance AMS cyber resilience should consider both vehicle and system levels. Vehiclelevel strategies are expected to be implemented during AV design and manufacturing, while systemlevel strategies will focus on the planning and operation of AMS.

## **4.3.1 Vehicle-level strategies**

Auto manufacturers can mitigate the negative impact of cyber attacks on AVs by adopting a layered approach (GAO, 2016). In vehicle design, cyber-physical networks in a vehicle can be separated by artificial layers. For instance, one can create an engine control unit layer, an in-vehicle 15
<!-- Start of picture text --> ) Firewall (¥)Gateway<br>Safety-critical systems Restricts Facilitates Infotainment and<br>communication | |<br>between communicationbetween other systems.<br>Braking networks networks Telematics<br>system system? —e<br>(wv) Wt 011010 @<br>encryptionMessage and yA nem: fat a{ y eee 001001 ee ;<br>authentication . LJ<br>communicationAllows secure (@) : ®) Intrusion Detection (w) itigation technologies<br>between two Engine Steering System / Intrusion Radio Avehicle cyberattack can<br>devices control unit | | control unit Prevention System system be halted at various points<br>Detects anomalous messages along an in-vehicle network<br>and prevents them from<br>being acted upon<br><!-- End of picture text -->
2) providing diversity, and 3) controlling propagation (Linkov and Kott, 2019). The first strategy pertains to maintaining redundancy in transportation capacity, which can be realized by: 1) operating an AV fleet size larger than the minimum necessary to meet day-to-day travel demand; 2) coordinating the operations of AVs with other modes, especially public transportation. The question of how much redundancy is important. A larger fleet contributes to greater AMS cyber resilience by mitigating the potential loss when a cyber attack disables the operations of a given number of AVs in the system. However, a larger AV fleet means greater capital and operating cost. To determine the optimal fleet size, careful economic analysis must be performed to quantify the trade-off between increased capital and operating cost due to redundancy under normal conditions and cyber resilience benefits under cyber attacks.

It should be noted that some cyber attacks such as denial-of-service can be immune to an increase in AV fleet size, because the whole AMS will be affected. In such cases, providing alternative transportation modes independent of AMS will be particularly important. An obvious candidate is public transportation. While some argue that AMS would ultimately eliminate today’s humanoperating transit systems, the claim may be less valid under attack situations. Transit can provide valuable backup capacity to move disrupted AV travelers under cyber attacks. As such, the possibility of cyber attacks provides a valid argument for preserving an independent public transportation system in the future even after AMS takes place.

For the second strategy, diversity is realized by maintaining a separate road network for AVs that is free of connectivity. When AVs are using this network, they can only use their automation capability, with no communications between vehicles or between vehicles and infrastructure. AVs would operate like conventional vehicles except that the movement of each AV will rely only on information collected by the AV’s own sensing instruments. This strategy aims to make AMS resilient to cyber attacks on communication networks. For example, if a distributed denial-of-service attack occurs which can affect communications between AVs and the infrastructure serving the AVs, the AMS operator can divert AVs from the normal road network to this separate network.

Maintaining a separate network, however, begs careful planning of the network. This network may be a newly built one but will be costly. Alternatively, one can dedicate part of the existing road system to only conventional vehicles under normal conditions, and to both conventional vehicles and AVs when a cyber attack occurs. The size and connectivity of this separate network must be judiciously chosen by accounting for many factors such as travel demand, overall road network intensity and capacity, and mode share between AVs and conventional vehicles. Similar to the strategy of maintaining redundancy, this strategy should strike a balance between the cost of preserving the 17
network under normal conditions and the benefits of the network in serving travel demand under cyber attacks.

The third strategy is deploying different sub-autonomous mobility systems rather than a single homogeneous AMS. Among these subsystems, only limited data exchange and connections would be allowed so that when a cyber attack incurs to one subsystem, its negative consequences are contained in the subsystem while other subsystems have high probability of retaining normal functionality. The idea is in fact analogous to the vehicle-level strategy of creating artificial layers and separation in subsection 4.3.1. One way to create subsystems is to have an AMS operator run independent sub-fleets, or mandate competing AMS operators. While market competition is known to benefit AMS users by reducing service price, introducing competing subsystems in AMS brings the additional benefit of enhancing cyber resilience of the overall AMS. The disruption and recovery efforts would be smaller than if the attack spreads over the entire AMS.

# **5 Conclusion and future research**

The increasing cyber connectivity of vehicles and between vehicles and infrastructure will drastically reshape the way humans move in the coming decades. While the advent of connected mobility—along with the coupled trend of vehicle automation—is expected to benefit travelers and the society by smoothing traffic, improving rider convenience, and reducing accidents, the augmented cyber components in connected and autonomous vehicles and related infrastructure also give rise to the issue of cyber attacks to the transportation system and how the system can be more resilient to such attacks. It is believed that malicious acts to exploit connected and autonomous vehicles are only a matter of time and will increasingly become a prominent issue in the future of our society.

In view that little attention has been paid to transportation cyber resilience and autonomous vehicles are likely to dominate in the future mobility system, this paper takes a forward-looking approach looking into cyber resilience of AMS. A first-of-its-kind investigation on this topic with a comprehensive literature review is offered. In the investigation, we start by discussing the cyber components and plausible AMS operation scenarios. Then a considerable amount of effort is devoted to identifying possible cyber attacks to AMS at both vehicle and system levels. Building upon the literature of resilience and cyber resilience, the discussion moves to the concept of AMS cyber resilience and exploring existing practices to enhance AV cybersecurity, a concept intimately related to AMS cyber resilience. A number of strategies are subsequently investigated toward enhancing AMS cyber resilience. At the vehicle level, creating layers and separation to reduce cyber component 18
connectivity and deploying an independent procedure for data collection and processing are important in vehicle design and manufacturing. At the system level, recommended strategies include keeping redundancy in transportation capacity, maintaining a separate road network, and deploying different sub-autonomous mobility systems. To quantitatively assess the benefits of these strategies, more elaborate, modeling-based research is needed.

As AMS differs from today’s transportation system only by the extent of connectivity and automation and the shift from human-driven to autonomous mobility is going to be gradual, today’s transportation can also be informed by the findings, insights, and recommendations obtained in this paper. We hope that the effort presented in the paper makes a start toward greater understanding cyber resilience of AMS and connected transportation in general. More in-depth investigations can be stimulated in this important but still underappreciated area for a better future of human mobility.

19