Resiliency of Mobility-as-a-Service Systems to Denial-of-Service Attacks

Mobility-as-a-Service (MaaS) systems, such as ride-sharing services, have expanded very quickly over the past years. However, the popularity of MaaS systems make them increasingly vulnerable to denial-of-service (DOS) attacks, in which attackers attempt to disrupt the system to make it unavailable to the customers. Expanding on an established queuing-theoretical model for MaaS systems, attacks are modeled as a malicious control of a fraction of vehicles in the network. We then formulate a stochastic control problem that maximizes the passenger loss in the network in steady state, and solve it as a sequence of linear and quadratic programs. Combined with a Jackson network simulation and an economic model of supply and demand for attacks, we quantify how raising the cost of attacks (via cancellation fees and higher level of security) removes economical incentives for DoS attacks. Calibrating the model on 1B taxi rides, we dynamically simulate a system under attack and estimate the passenger loss under different scenarios, such as arbitrarily depleting taxis or maximizing the passenger loss. Cost of attacks of U.S.$ 15 protects the MaaS system against DoS attacks. The contributions are thus a theoretical framework for the analysis of the network, and practical conclusions in terms of financial countermeasures to the attacks.