On Cybersecurity of Freeway Control

1 This article focuses on cybersecurity of transportation systems and investigates their vulnerability 2 to attacks on the sensing and control infrastructure. An array of different attack points, classi3 fied into physical, close-proximity, and virtual layers, are reviewed and investigated. We construct 4 two benchmark scenarios which exploit these vulnerabilities to identify the potential harm of a 5 traffic control system compromise. A more in-depth analysis is then presented on the takeover of 6 a series of networked onramp metering traffic lights. The analysis is conducted using a method7 ology for precise and intelligent onramp metering attacks based on finite-horizon optimal control 8 techniques and multi-objective optimization. The methodology is demonstrated in simulation for 9 two examples of high-level attack objectives: congestion-on-demand, which aims to create precise 10 pockets of congestion, and catch-me-if-you-can, which attempts to aid a fleeing vehicle from chasing 11 pursuants. 12 Reilly, Martin, et al. 2 INTRODUCTION 1 Public traffic infrastructure is arriving in the cyber age with increasing connectivity between the 2 different segments of roadways. For example, freeways are commonly instrumented with loop 3 detectors that allow for real-time monitoring of roadway speeds (1). Estimates of road traffic 4 conditions are then fed directly into onramp traffic light metering algorithms which regulate traffic 5 flow to improve congestion (2). Finally, these metering algorithms can be coordinated and controlled 6 by a remote command and monitoring center, leading to a regional network of interconnected sensors 7 and controllers (3). 8 Increased efforts to build systems which understand and utilize the interconnectivity are 9 evidenced by integrated-corridor-managament (ICM) projects such as Connected Corridors (4) and 10 mobile applications which use GPS probe data to improve navigation (5). 11 This connectivity offers great potential to better analyze, control and manage traffic but 12 also poses a significant security risk. A compromise at any level of the traffic control infrastructure 13 can lead to both direct access of an attacker to alter traffic lights and changeable message signs, and 14 indirect access via spoofing of sensor readings, which may trick the control algorithms to respond 15 to false conditions. 16 A number of traffic-related atacks of infrastructure systems have already been demonstrated 17 in the past few years. A man-in-the-middle attack on GPS coordinate transmissions from mobile 18 navigation applications showed it is possible to trick navigation services into inferring non-existent 19 jams (6), while a similar attack used a fleet of mobile phone emulators to mimic the presence of 20 many virtual vehicles on a roadway (7). A popular type of vehicle-detection sensor was revealed to 21 use a type of wireless protocol vulnerable to data injection attacks, and a demonstration showed 22 that the access point could be tricked into receiving arbitrary readings (8). Cyber attacks on a 23 centralized command center remain a serious threat given the frequent discovery of networking 24 vulnerabilities, such as the Heartbleed bug (9). Even insider attacks on command centers have 25 precedent as two Los Angeles traffic engineers in 2009 were found guilty of intentionally creating 26 massive delays by adjusting signal times at key intersections (10). 27 Given the existence of such vulnerabilities and the scale at which they can be exploited, 28 understanding the nature and costs of such attacks becomes paramount to public safety. In this ar29 ticle, we present a systematic approach to analyzing the topic of traffic control system vulnerabities 30 and their potential impact. 31 To do so, we begin by constructing a taxonomy of different vulnerabily locations in traffic 32 control systems, defining three distinct layers: physical, close-proximity, and virtual. Difficulty, im33 pact, and cost values are also associated with each potential attack. We motivate our classifications 34 by presenting two scenarios that combine a number of attacks to accomplish a high-level goal. 35 We then focus our analysis on an in-depth exploration of freeway attacks using coordi36 nated, ramp metering.. We show using the developed method that ramp metering control permits 37 an attacker to achieve very precise congestion patterns. An attacker can then consider high-level 38 objectives, such as permitting a fleeing vehicle to escape pursuants on a particular freeway stretch. 39 To achieve this, we develop a methodology based on adjoint computations and finite-horizon op40 timal control for finding optimal metering rates to create a desired disruption on the freeway. We 41 additionally give an overview of multi-objective optimization and discuss how such an approach is 42 useful for solving high-level attack objectives which contain many conflicting sub-goals. 43 Two detailed applications of the multi-objective optimal control approach to ramp metering 44 attacks are then given. The first application shows how ramp metering can allow an attacker to 45 cause congestion in precise locations and at precise moments in time along a freeway. The second 46 application finds a strategy to solve the aforementioned problem of allowing a fleeing vehicles to 47 escape pursuants. Numerical results are presented, as well as a discussion of the benefits of the 48 Reilly, Martin, et al. 3 Wireless connection 2070 Controller Ramp-meter Loop detectors GPS data Internet mobile/radio connection Waze, Google nav. (a) Local freeway control system. 207