  Emerging technologies drive the ongoing transformation of Intelligent
Transportation Systems (ITS). This transformation has given rise to
cybersecurity concerns, among which data poisoning attack emerges as a new
threat as ITS increasingly relies on data. In data poisoning attacks, attackers
inject malicious perturbations into datasets, potentially leading to inaccurate
results in offline learning and real-time decision-making processes. This paper
concentrates on data poisoning attack models against ITS. We identify the main
ITS data sources vulnerable to poisoning attacks and application scenarios that
enable staging such attacks. A general framework is developed following
rigorous study process from cybersecurity but also considering specific ITS
application needs. Data poisoning attacks against ITS are reviewed and
categorized following the framework. We then discuss the current limitations of
these attack models and the future research directions. Our work can serve as a
guideline to better understand the threat of data poisoning attacks against ITS
applications, while also giving a perspective on the future development of
trustworthy ITS.
