Modeling adversarial physical movement in a railway station: Classification and metrics

Carmen Cheh, Binbin Chen, William G. Temple, William H. Sanders

Research output: Contribution to journalArticlepeer-review

Abstract

Many real-world attacks on cyber-physical systems involve physical intrusions that directly cause damage or facilitate cyber attacks. Hence, in this work, we investigate the security risk of organizations with respect to different adversarial models of physical movement behavior. We study the case in which an intrusion detection mechanism is in place to alert the system administrator when users deviate from their normal movement behavior.We then analyze how different user behaviors may present themselves as different levels of threats in terms of their normal movement behavior within a given building topology. To quantify the differences in movement behavior, we define a WeightTopo metric that takes into account the building topology in addition to themovement pattern.We demonstrate our approach on a railway system case study and showhowcertain user roles, when abused by attackers, are especially vulnerable in terms of the physical intrusion detection probability. We also evaluate quantitatively how the similarity between an attacker's movement behavior and a user's movement behavior affects the detection probability of the evaluated intrusion detection system. Certain individual users are found to pose a higher threat, implying the need for customized monitoring.

Original languageEnglish (US)
Article numberA11
JournalACM Transactions on Cyber-Physical Systems
Volume4
Issue number1
DOIs
StatePublished - Oct 2019

Keywords

  • Adversary model
  • Physical movement
  • Railway transportation system

ASJC Scopus subject areas

  • Human-Computer Interaction
  • Hardware and Architecture
  • Computer Networks and Communications
  • Control and Optimization
  • Artificial Intelligence

Fingerprint

Dive into the research topics of 'Modeling adversarial physical movement in a railway station: Classification and metrics'. Together they form a unique fingerprint.

Cite this