Modeling adversarial physical movement in a railway station: Classification and metrics

Carmen Cheh, Binbin Chen, William G. Temple, William H. Sanders

Research output: Contribution to journalArticlepeer-review


Many real-world attacks on cyber-physical systems involve physical intrusions that directly cause damage or facilitate cyber attacks. Hence, in this work, we investigate the security risk of organizations with respect to different adversarial models of physical movement behavior. We study the case in which an intrusion detection mechanism is in place to alert the system administrator when users deviate from their normal movement behavior.We then analyze how different user behaviors may present themselves as different levels of threats in terms of their normal movement behavior within a given building topology. To quantify the differences in movement behavior, we define a WeightTopo metric that takes into account the building topology in addition to themovement pattern.We demonstrate our approach on a railway system case study and showhowcertain user roles, when abused by attackers, are especially vulnerable in terms of the physical intrusion detection probability. We also evaluate quantitatively how the similarity between an attacker's movement behavior and a user's movement behavior affects the detection probability of the evaluated intrusion detection system. Certain individual users are found to pose a higher threat, implying the need for customized monitoring.

Original languageEnglish (US)
Article numberA11
JournalACM Transactions on Cyber-Physical Systems
Issue number1
StatePublished - Oct 2019


  • Adversary model
  • Physical movement
  • Railway transportation system

ASJC Scopus subject areas

  • Control and Optimization
  • Artificial Intelligence
  • Human-Computer Interaction
  • Hardware and Architecture
  • Computer Networks and Communications


Dive into the research topics of 'Modeling adversarial physical movement in a railway station: Classification and metrics'. Together they form a unique fingerprint.

Cite this