Cyberattack impacts and mitigation tradeoff in CAV-based fixed-route and demand-responsive transit systems

Connected and autonomous vehicles (CAVs) can improve public transit (PT) systems, yet their vulnerability to cyberattacks threatens efficiency and public trust, making it crucial to identify risks, measure disruptions, and design mitigation strategies. This study introduces a scenario-based framework to quantify cyberattack impacts and mitigation trade-offs in CAV-based fixed-route transit (FRT) and demand-responsive transit (DRT) systems. Within the framework, FRT is formulated through an on-demand bus scheduling model, while DRT is captured via a two-phase optimization approach; model-informed mitigation strategies are developed for both systems, and a multidimensional set of quantitative metrics is established to evaluate disruptions across operational, financial, energy, service quality, and trust dimensions. Using real-world data, single- and multi-vehicle attack scenarios are evaluated to quantify disruptions and assess the effectiveness of mitigation strategies. The findings indicates that CAV-based PT operations may suffer severe disruptions from cyberattacks, even if only a single vehicle is compromised. This framework enables scenario-based quantification of cyberattack consequences and mitigation benefits, showing that mitigation reduces service disruption but increases operating cost, which motivates integrating cybersecurity monitoring with resilience mechanisms for future autonomous PT systems.