Mobility as a service: MAnaging Cybersecurity Risks across Consumers, Organisations and Sectors (MACRO)

移动性即服务(MAAS)概念为用户提供在单个网关结合各种形式的传输的统一服务。MAAS承诺通过促进使用公共交通来减少交通拥堵、改善客户便利性、减少社会不平等和碳排放。MAAS的关键推动因素包括(1)允许计划和执行行程的单一应用程序，(2)允许多个参与者提供MAAS的软件系统，以及(3)允许行程和资源优化的基于人工智能的分析。所有这些都容易受到各种类型的网络攻击和MAAS生态系统(客户、运输提供商、数据提供商等)的复杂性。从网络安全的角度来看，它对数据的依赖构成了一个独特的挑战。这项跨学科的建议利用了克兰菲尔德大学在能源转换、基础设施系统建模和人工智能方面的领先研究专业知识和卓越，以及肯特大学的网络安全和人为因素。其目标是开发世界上第一个基于代理的建模框架，明确关注MAAS生态系统的网络安全方面。这将通过使用基于代理的模拟技术来定义建模框架来实现，该框架将在移动、数据共享和网络安全威胁的背景下涵盖跨部门和跨组织的代理交互。虽然我们的目标是定义MAAS生态系统的全面观点，但该提案打算关注MAAS客户的视角：交通需求和网络安全行为和态度方面的激励和行为-这将通过开发基于代理的模拟来实现，这些代理能够优化其行为。MAAS生态系统的关键推动因素之一是通过预测性人工智能(AI)模型利用数据。人们普遍认为，恶意行为者可以利用机器学习和人工智能算法进行复杂的网络攻击。其中一个拟议的工作流程将探讨如何以相反的方式愚弄服务提供商快速部署新的深度学习算法，从而在个别部门和更广泛的MAAS生态系统中造成不公平和失败，以及如何在广泛的案例研究中有效地缓解这一问题。将通过整合案例研究数据来验证该框架的实用价值及其捕捉MAAS物理方面和网络领域之间相互依赖的能力。将在一系列专家讲习班和知识传播活动期间审查模型定义和产生的产出的有效性。将有利益相关者和主题专家参加，其中包括学者、政府、监管机构和行业的代表，包括我们过去/现在的合作者，如Ofgem、National Rail、地方当局、巴士运营商、数据通信公司，以及开发集成技术或服务的商业提供商(如IBM)。将在重点小组中分析公众对制定的军事行动方案和战略的接受度，以确保这些方案的安全。最后报告将讨论从制定跨部门网络安全框架中获得的见解和经验教训，现有体制格局是否适合发展多部门网络安全系统，以及协调通信、运输和能源系统的政策和监管框架以从网络安全角度解决潜在冲突和脆弱性的机会、障碍和风险。

Mobility as a service (MaaS) concept offers a user a unified service that combines various forms of transport at a single gateway. MaaS carries a promise of reduction of traffic congestion, improvement of customer convenience, reduction of social inequalities and carbon emissions by fostering the use of public transport. Key enablers for MaaS encompass (1) a single application allowing to plan and conduct journeys, (2) software system allowing multiple actors deliver MaaS, and (3) AI-based analytics allowing journey and resource optimisation. All those are susceptible to a wide range of types of cyber-attacks and the complexity of the MaaS ecosystem (customers, transportation providers, data providers, etc.) and its dependence on the data creates a unique challenge from the cyber security perspective. This interdisciplinary proposal leverages leading research expertise and excellence on energy transitions, infrastructure systems modelling, and artificial intelligence from Cranfield University and cybersecurity and human factors from University of Kent.The ambition is to develop the world's first agent-based modelling framework that will explicitly focus on the cyber security aspects of the MaaS ecosystem. This shall be achieved by use of agent-based simulation techniques to define a modelling framework that will encompass cross-sector and cross-organizational agent interactions in the context of mobility, data sharing, and cybersecurity threats. While our ambition is defining a comprehensive view of the MaaS ecosystem, the proposal intends to focus on a MaaS customers' perspective: incentives, behaviours in both terms of transportation needs and cybersecurity behaviours and attitudes - this will be achieved by developing agent-based simulation with complex, adaptive agents who are capable optimise their behaviour.One of key enablers of the MaaS ecosystem is exploitation of data by means of predictive Artificial Intelligence (AI) models. It has been widely accepted that machine learning and AI algorithms can be exploited by malicious actors using sophisticated cyber attacks. One of the proposed work streams will explore how the rapid deployment of new deep learning algorithms by service providers can be adversarially fooled to create unfairness and failures in the individual sectors and in the wider MaaS ecosystem and how this can be effectively mitigated in a wide range of case studies.The practical value of the framework and its ability to capture interdependencies between physical aspects of MaaS and cyber domain will be validated by means of integration of case studies data. The validity of model definition and produced outputs will be reviewed during a series of expert workshops and knowledge dissemination activities. These would be attended by stakeholders and subject matter experts comprising a mix of representatives of academics, government, regulators and industry, including our past/ current collaborators such as Ofgem, National Rail, local authorities, bus operators, Data Communications Company, and commercial providers developing integrated technologies or services (e.g. IBM). The public acceptability of the developed MaaS scenarios and strategies to make them secure will be analysed in focus groups. The final report will discuss insights and lessons learned from development of a cross-sector cyber security framework, the fitness of existing institutional landscape for the development of MaaS and opportunities, barriers and risks for the alignment of policy and regulatory frameworks across communications, transport and energy systems to address potential conflicts and vulnerabilities from the cyber security perspective.