Modeling adversarial physical movement in a railway station: Classification and metrics

Many real-world attacks on cyber-physical systems involve physical intrusions that directly cause damage or facilitate cyber attacks. Hence, in this work, we investigate the security risk of organizations with respect to different adversarial models of physical movement behavior. We study the case in which an intrusion detection mechanism is in place to alert the system administrator when users deviate from their normal movement behavior.We then analyze how different user behaviors may present themselves as different levels of threats in terms of their normal movement behavior within a given building topology. To quantify the differences in movement behavior, we define a WeightTopo metric that takes into account the building topology in addition to themovement pattern.We demonstrate our approach on a railway system case study and showhowcertain user roles, when abused by attackers, are especially vulnerable in terms of the physical intrusion detection probability. We also evaluate quantitatively how the similarity between an attacker's movement behavior and a user's movement behavior affects the detection probability of the evaluated intrusion detection system. Certain individual users are found to pose a higher threat, implying the need for customized monitoring.