  Connected and Automated Vehicle (CAV) technology has the potential to greatly
improve transportation mobility, safety, and energy efficiency. However,
ubiquitous vehicular connectivity also opens up the door for cyber-attacks. In
this study, we investigate cybersecurity risks of a representative cooperative
traffic management application, i.e., highway on-ramp merging, in a mixed
traffic environment. We develop threat models with two trajectory spoofing
strategies on CAVs to create traffic congestion, and we also devise an
attack-resilient strategy for system defense. Furthermore, we leverage VENTOS,
a Veins extension simulator made for CAV applications, to evaluate
cybersecurity risks of the attacks and performance of the proposed defense
strategy. A comprehensive case study is conducted across different traffic
congestion levels, penetration rates of CAVs, and attack ratios. As expected,
the results show that the performance of mobility decreases up to 55.19% at the
worst case when the attack ratio increases, as does safety and energy. With our
proposed mitigation defense algorithm, the system's cyber-attack resiliency is
greatly improved.
