Bayesian Network Modeling of Cyber-Physical Risk and System Dependencies in Railway Control Systems

Railway systems increasingly depend on integrated control, communications, and operational technologies, and this growing connectivity exposes them to cyber disruptions that can cascade across interdependent subsystems and compromise operations and safety. Existing cybersecurity assessment methods are largely static or deterministic and poorly suited to representing cascading effects in complex railway environments, motivating a probabilistic framework for understanding disruption propagation, critical vulnerabilities, and the resilience benefits of alternative mitigation strategies. This project develops a railway-specific Bayesian network model representing major cyber-physical components, dependencies, and disruption pathways in railway control systems. The methodology first identifies and characterizes critical railway subsystems and their cyber-physical interdependencies, then defines the model structure and key variables capturing system states, disruption pathways, and operational consequences. Conditional probabilities are developed from available empirical evidence, published literature, and expert-informed estimates. Bayesian inference is applied to quantify how cyber events propagate through the system and influence safety and operational outcomes, and scenario-based resilience analysis identifies critical bottlenecks, assesses mitigation effectiveness, and compares risk-reduction strategies. Expected products include a validated probabilistic modeling framework for cyber-physical risk in railway control systems, quantitative risk metrics for operational disruption and safety impact, scenario-based analysis tools, and methods for identifying high-impact components and vulnerability concentrations. Outputs will support railway operators, infrastructure owners, and regulators in cyber risk management, infrastructure hardening, investment prioritization, and operational resilience planning, and may inform future guidance and regulatory discussions on railway cybersecurity.

Language

• English

Project

• Status: Active
• Funding: $150,000.00
• Contract Numbers:

  69A3552348323

• Sponsor Organizations:

  Office of the Assistant Secretary for Research and Technology

  University Transportation Centers Program
  Department of Transportation
  Washington, DC  United States  20590
• Managing Organizations:

  Howard University

  2400 6th Street, NW
  Washington, DC  United States  20059
• Project Managers:

  Bruner, Britain

• Performing Organizations:

  Howard University

  2400 6th Street, NW
  Washington, DC  United States  20059
• Principal Investigators:

  Attoh-Okine, Nii

• Start Date: 20260803
• Expected Completion Date: 20270504
• Actual Completion Date: 0
• USDOT Program: University Transportation Centers

Subject/Index Terms

• TRT Terms: Computer security; Control systems; Railroad safety; Railroads; Risk assessment
• Subject Areas: Data and Information Technology; Planning and Forecasting; Railroads; Safety and Human Factors; Security and Emergencies;

Filing Info

• Accession Number: 01999934
• Record Type: Research project
• Source Agency: Research and Education for Promoting Safety (REPS) University Transportation Center
• Contract Numbers: 69A3552348323
• Files: UTC, RIP
• Created Date: Aug 19 2026 4:14PM