How and why do human factors impact cyberattack consequences at a connected intersection? − A falsified red light countdown case study

Vehicle-to-infrastructure communication enhances traffic safety but is vulnerable to cyberattacks. Spoofing cyberattacks pose data falsification that endangers road users. Given that achieving high-level (L4-L5) automated driving still requires significant progress, understanding how and why human factors influence cyberattack consequences is novel yet essential for mitigating these risks. Research on this topic remains limited, and collecting driving behavior data under cyberattack conditions is challenging due to safety concerns. To address this, we conducted a driving simulator experiment with 32 drivers spanning a range of experience levels and other factors, replicating a connected intersection under no-attack and cyberattack scenarios. In-vehicle falsified red-light countdown spoofing attacks are designed to provide false information on the dashboard. Using the Surrogate Safety Assessment Model, safety consequences were measured. Results indicate that cyberattacks pose significant threats to traffic safety. Greater speed at the end of the countdown period increases the risk of frontal (pedestrian and right-angle) collisions and reduces rear-end collision risks. Experienced drivers show lower hazards for frontal collisions. Notably, the total hazards under cyberattacks do not differ significantly between male and female drivers. Human factors affect safety by influencing driving behavior. Experienced drivers decelerate over shorter distances, reducing collision risk, while male and female drivers show similar deceleration patterns, resulting in comparable safety consequences. These findings provide a quantitative model describing human factors impacting cyberattack consequences, inform safer transportation management, and, more importantly, educate the public about cyberattacks. Future models can be developed to predict collision probabilities and improve system resilience (i.e., recovery after cyberattack).