CYBER-RESILIENCE MODEL FOR DISTRIBUTED INDUSTRIAL TRANSPORT INFORMATION SYSTEMS

Abstract

Industrial transport information systems combine telemetry from rolling stock and trackside devices, communication links and dispatching servers, so a loss of data availability or integrity affects traffic control. The aim is to build a cyber-resilience model of such a system in which detection, isolation and recovery are assessed together with their effect on latency and availability. The methods are STRIDE threat modelling, partitioning of the system into zones and conduits following the IEC 62443-3-2 concept, and message-level discrete-event simulation. The material comprises 240 runs of a system with 80 telemetry sources in two zones. A baseline architecture with manual response was compared with a proposed architecture combining per-source rate limiting, detectors at zone conduits, message authentication, automatic isolation and a hot-standby server. In four of the five attack and fault scenarios the proposed architecture kept mean availability at or above 0.996, whereas baseline availability was 0.20–0.80 under the assumed manual response times; detection took 0.65–3.65 s. No benefit was obtained when infection spread only within one zone. Authentication added the assumed 0.5 ms to median latency, but at 1.8 messages per second per source and 5 ms per check the total load exceeded server capacity and availability was lost entirely. The novelty lies in the joint assessment of cyber-resilience indicators and of the operational cost of security controls, with attacks and benign faults treated separately. The practical value is a procedure for selecting controls with the system's capacity in mind. The results come from simulation with declared parameters and must be verified against data from an operating enterprise.