One Bus is All it Takes: The Impact of Cyber Attacks in Customised Bus Services

Connected and Autonomous Vehicle (CAV) technologies have the potential to revolutionise public transport systems, making them more financially and environmentally sustainable, accessible, and user-centric. However, CAV-based bus services are vulnerable to cyber attacks manifesting in unwanted, deceitful behaviour. This includes behaviours such as suppression, overloading, and substitution, which could be used by malicious actors to disrupt service and cause significant damage to both the transport operator and passengers. This paper raises awareness about the potential impact of deceitful behaviour on transport systems by instantiating the ideas in a customised bus system example. More specifically, this work evaluates the impact of a deceitful vehicle in Customised Bus (CB) services, when considering (i) different customer demand profiles, (ii) at what point in planning and control the attack occurs, and (iii) whether the controller has detected the attack. Our empirical analysis shows how an attack aimed at compromising a single vehicle can lead to a surge in operating costs of up to 48%. Further, there is an increase in cost, distance travelled, and unserved passengers when the attack goes undetected. The results underscore the importance of preventing and detecting cyber attacks in the deployment of CAV-based solutions and emphasise the need for a proactive approach in managing the associated risks.