Analysis of Factors Influencing Cybersecurity in Railway Critical Infrastructure: A Case Study of Taiwan Railway Corporation, Ltd.

Abstract

The present study investigated factors influencing cybersecurity in railway critical infrastructure by identifying relevant factors and criteria and then prioritizing them in order of importance. To address the lack of multi-criteria analysis in previous studies on this topic, the present study applied the analytical hierarchy process to identify factors and criteria influencing cybersecurity and then selected the top 70% of influencing criteria to serve as a reference for railway cybersecurity project management. A total of 25 valid expert questionnaires were collected for weight vector analysis, revealing that the influencing criteria in the top 70% were inability to monitor train occupancy in track sections (locations); inability of controllers to issue commands to safety control systems; inability to provide drivers with information on upcoming signals, block status, and train occupancy; failure to automatically apply brakes when the train exceeds the speed limit; increased risk of catastrophic accidents due to power system security vulnerabilities; and inability of the dispatching system to automatically track train numbers.

1. Introduction

Technologies such as artificial intelligence (AI), blockchains, and the Internet of Things (IoT) have converged to drive the next wave of the digital revolution. When integrated into critical infrastructure (CI), these technologies have the potential to improve quality of life and enhance national productivity and economic growth [1,2]. However, CI remains vulnerable to both human-caused disruptions and natural disasters. Damage to these systems can severely impact governmental and societal functions, leading to casualties, property loss, economic downturns, environmental degradation, and broader threats to national security and interests [3,4,5,6]. CI can be classified into eight major sectors based on functional attributes: energy, water resources, communications, transportation, finance, emergency services and healthcare, government institutions, and science and industrial parks [7]. These infrastructures are not only vital to public welfare but also play a pivotal role in maintaining economic stability and national sovereignty [8,9]. Moreover, the dependencies and interdependencies among different types of infrastructure can lead to cascading effects [10]. Taiwan Railway Corporation, Ltd. (TRC) is the earliest-developed and most historically established railway infrastructure operator in Taiwan. Until the entry of Taiwan High Speed Rail Corporation (THSRC) in 2007, TRC remained the sole provider of railway services in the country. Owing to its long operational history, TRC now faces the dual challenges of legacy infrastructure modernization and increasing susceptibility to disruption from emerging digital technologies. TRC primarily serves medium- and short-distance passenger routes, whereas THSRC focuses on medium- and long-distance transportation. In terms of ridership, TRC handles approximately twice the passenger volume of THSRC.

The present study focused on issues of information integration and cybersecurity management within TRC. TRC was preceded by the Taiwan Railways Administration (TRA), which is better known as “Taiwan Railway”. Throughout its 138-year history, Taiwan Railway has played a foundational role in Taiwan’s development and achieved marked improvements in ridership and passenger service quality. In particular, its information and communication systems have gradually evolved toward greater digitization and integration [11]. TRC’s operational systems encompass several core subsystems, including train control, signal communications, station dispatching, information and communication technology networks, and maintenance facilities. These systems are critical to Taiwan’s daily commuter traffic and freight logistics. However, as system complexity increases, so too do associated cybersecurity risks [12]. In recent years, TRC has experienced incidents involving communication failures, dispatching errors, and cybersecurity breaches. These events have not only disrupted operations and safety but also significantly impacted the public’s daily lives [13]. Despite the growing importance of these issues, studies examining the cybersecurity aspects of railway safety remain limited; therefore, the present study aimed to analyze the cybersecurity risks facing TRC in the context of digital transformation and to identify key influencing factors. In addition to evaluating the relative importance of these factors, the researcher team further proposed the development of a cybersecurity checklist to serve as a reference for railway administrators in establishing CI network security.

1.1. CI and Cybersecurity

In 2024, the frequency of global cyberattacks surged dramatically. On average, organizations faced 1308 cyberattacks per week during Q1 alone [14], representing a 28% increase compared to Q4 of 2023. Notably, high-impact attacks targeting CI rose by 140% during this period [15]. As such, protecting CI from cyber threats has become an increasingly urgent priority. In the face of escalating cyber risks, enhancing cyber resilience in CI systems is essential [16]. The ultimate goal of cyber resilience is to ensure that digital infrastructure continues to support innovation and functionality under adverse conditions [17]. For railway systems in particular, cyber resilience has become especially vital.

The growing integration of IoT technologies, such as energy distribution networks, into CI has led to significant improvements in continuous monitoring, operational efficiency, and service delivery [18]. However, because railway systems rely heavily on electric power to support their full range of operational functions, their power systems also represent a potential point of vulnerability for cyberattacks. Establishing measurable cyber resilience indicators for CI is a key step toward protecting increasingly interconnected systems from sophisticated cyberattacks [19]. Cybersecurity vulnerabilities in railway systems may lead to cascading failures that cripple the overall transportation network [20]; however, human error is also widely recognized as one of the primary causes of cybersecurity incidents [21]. Railway infrastructure increasingly leverages IoT devices, sensors, software, and automation technologies to collect and monitor safety-related data. When such infrastructure is targeted by cyberattacks, these safety detection systems may be rendered ineffective—resulting in a greater risk of traffic accidents and even casualties.

1.2. CI and Analytical Hierarchy Process-Based Analytical Studies

Numerous studies have applied the analytical hierarchy process (AHP) to CI issues, and AHP is widely acknowledged as a suitable method for establishing prioritization within infrastructure management. He et al. [22] conducted an AHP-based landslide susceptibility assessment to evaluate threats to railway safety and operational sustainability; the study revealed that high-risk zones are strongly associated with mountainous terrain, high-precipitation areas, and regions with concentrated populations and economic activity—factors that critically affect railway infrastructure. Panchal et al. [23] developed a landslide hazard map along National Highway 5 using AHP-derived weightings combined with the Weighted Linear Combination technique, overlaying causal factor layers to generate a spatial risk map. Abuzwidah et al. [24] utilized AHP to systematically analyze how climate change variables influence transportation networks. Al-Barqawi et al. [25] developed an integrated model and framework combining AHP with artificial neural networks to prioritize watermain renewal within the water distribution system. Piratla et al. [26] applied AHP to determine the renewal prioritization of culverts. Udie et al. [27] explored how extreme weather events impose varying degrees of stress on critical oil and gas infrastructure; through the use of AHP, they conducted vulnerability assessments to support management strategies for climate adaptation in these infrastructure systems.

Previous AHP studies on railway critical infrastructure have included landslide susceptibility assessment, the high rainfall factor, and the impact assessment of extreme climate change. These studies mostly focus on the impact of the external environment on railway transportation. Our study, however, specifically conducts a risk assessment analysis on the information security of the railway’s internal systems, including the railway radio dispatching system, the centralized traffic control system, the automatic train protection system, and the power system. This approach differs from past research and represents a key contribution of this study.

2. Materials and Methods

The present study examined potential cybersecurity risks associated with railway transportation CI and identified key risk factors for risk management in this context. Based on secondary data collection and a comprehensive review of the relevant literature, the research team synthesized critical factors influencing risk management and then adopted these factors as the foundation for questionnaire design. The resulting survey data were analyzed using AHP to determine the relative weights of each key factor. The analysis further identified which risk factors should be prioritized during the execution of project management tasks [28].

2.1. Research Targets

To ensure the reliable evaluation of risk management in railway-related project implementation, the present study targeted individuals with practical experience in railway transportation, including industry professionals, government personnel, and academic researchers in related fields. Based on a comprehensive review and analysis of the literature, the research team developed a hierarchical structure of influencing factors related to cybersecurity in railway CI. These key factors were then incorporated into an expert questionnaire aimed at collecting valuable and actionable insights. The responses were used to statistically analyze the relative weights of each factor influencing cybersecurity in railway CI. The questionnaire was conducted anonymously and asked railway experts to assess the weights of various risk dimensions and influencing factors. No personal information was collected, and informed consent was obtained from all participants prior to the administration of the questionnaire.

2.2. Expert Questionnaire Design Using AHP

AHP is one of the most widely adopted survey-based methods in social science research for analyzing the relative weights of risk factors. It is particularly effective for capturing expert knowledge and experience regarding specific events or conditions. As previously noted, numerous studies on railway safety have applied AHP to conduct weight analysis of influencing factors [22,23,24,25,26,27].

Through an extensive literature review and expert consultation, the research team identified four primary dimensions of cybersecurity risks associated with railway CI: (1) dispatch radio communication systems; (2) centralized traffic control (CTC) systems; (3) automatic train protection (ATP) systems; and (4) power systems. Based on the consolidation of relevant causes, key influencing factors were identified under each of the four major cybersecurity risk dimensions. These factors were organized and summarized, as shown in Figure 1. A total of 16 critical cybersecurity risk factors related to threats in railway infrastructure were listed under the four dimensions and used as evaluation elements in the AHP cybersecurity risk assessment.

The four assessment dimensions for railway systems are also closely interconnected. The centralized traffic control (CTC) system directly influences the automatic train protection (ATP) system. Specifically, the CTC system manages and dispatches all train routes and signals. The ATP system receives commands from the CTC to ensure that trains operate at the designated speeds. The operational commands for the ATP system originate from the CTC. If the information security of the CTC system is compromised, for instance, through a cyberattack that results in the alteration of commands, the ATP system will execute incorrect instructions, potentially leading to train collisions or derailments.

The railway radio dispatching system is a critical communication link between the dispatcher and the train driver. Any malfunction, interference, eavesdropping, or forgery within this system can pose a risk to operational safety. The radio dispatching system on the train, the centralized traffic control (CTC) system, and the network systems all depend on the power system for their operation. If the power system is compromised, all other train systems will become inoperable.

• Establishing the Hierarchical Framework Structure

A hierarchical framework provides a structural backbone that allows for a comprehensive representation of a system’s full functionality and dimensions. The number of levels within the hierarchy depends on the complexity of the problem under investigation and the variability of its influencing factors. In 1980, Saaty [28] proposed several principles for constructing hierarchical structures in decision-making processes.

Accordingly, the present study disassembled the complex problem into multiple levels (as shown in Figure 2). The first level represented the expected outcome or goal of the problem to be solved; the second level consisted of evaluation criteria for achieving that goal; the third level included the factors used to assess the criteria in the previous level; and the fourth level presented the possible alternatives or solutions for addressing the problem [29].

• Questionnaire Design

To determine the relative importance of each element, pairwise comparisons must be conducted. Saaty recommended the use of a nine-point scale for evaluation (as shown in

Table 1. Explanation of the AHP evaluation scale and Random Index (RI).

n	1	2	3	4	5	6	7	8	9	10	11
RI	0	0	0.58	0.9	1.12	1.24	1.32	1.41	1.45	1.49	1.51

). Based on this scale, a pairwise comparison questionnaire was designed (see

Table 2. AHP pairwise comparison questionnaire.

Intensity of Importance	Extreme importance	—	Very strong importance	—	Strong importance	—	Moderate importance	—	Equal importance	—	Moderate importance	—	Strong importance	—	Very strong importance	—	Extreme importance	Intensity of Importance
Personnel Risk	9	8	7	6	5	4	3	2	1	2	3	4	5	6	7	8	9	Owner Risk

Note: The symbol “—” indicates that the importance is between the importances listed before and after. For example, the importance of 8 is between the importances of 7 and 9.

). When there are n criteria, a total of n (n − 1)/2 pairwise comparisons are required [30]. Table 1 presents the Sample Size and corresponding Random Index (R.I.). Saaty proposed the use of the Consistency Index (C.I.) to represent the degree of consistency [30]. The Consistency Ratio (C.R.) is calculated by dividing C.I. by R.I.

2.3. AHP Hierarchical Structure and Construction of Risk Factors

The present study adopted the AHP, a multi-criteria decision-making method, as a tool for analyzing risk factors related to project management threats. To construct a hierarchical decision-making structure addressing key threats in project management, the present study followed AHP hierarchy theory. Based on a review of the relevant literature, four major cybersecurity risk dimensions were synthesized: (1) dispatch radio communication systems, (2) centralized traffic control (CTC) systems, (3) automatic train protection (ATP) systems, and (4) power systems. Each dimension included several influencing factors, for a total of 16 critical risk factors. The contents of these dimensions and their respective key factors are presented in

Table 3. Cybersecurity risk dimensions of dispatch radio communication systems.

Dimension	Critical Influencing Factors	Description
Cybersecurity Risk Dimensions of Dispatch Radio Communication Systems	Inability of dispatchers to issue dispatch instructions [31]	Failure to transmit dispatch instructions in a timely manner may compromise operational safety and scheduling efficiency.
	Inability of train crew to communicate with one another [32,33]	When train crew are unable to report abnormal conditions, it may lead to delayed responses, accident escalation, and disruptions to operational safety and order.
	Failure of the emergency reporting system [34]	The loss of emergency communication capabilities may hinder timely emergency handling and alerts.
	Inability to record calls, resulting in the loss of critical information [35]	Lack of call recordings may result in the loss of key information, hindering accident investigation and responsibility clarification.

,

Table 4. Cybersecurity risk dimensions of CTC systems.

Dimension	Critical Influencing Factors	Description
Cybersecurity Risk Dimensions of CTC Systems	Inability to monitor train occupancy in track sections (locations) [36]	Inability to detect train positions may result in misjudgments, dispatching errors, and compromise both safety and dispatching efficiency.
	Inability of controllers to issue commands to safety control systems [37]	When controllers are unable to operate signaling equipment and track switches, it may cause loss of train control and collisions, threatening operational safety and dispatching.
	Inability of the dispatching system to automatically track train numbers [38]	Inability to track train numbers automatically may lead to dispatching errors and misjudgment of train positions, affecting operational safety.
	Inability to automatically record train arrival, departure, or passing times at stations [39]	The lack of automated time records may hinder understanding of train movements, reduce the accuracy of root cause analysis, and impair the effectiveness of transportation planning decisions.

,

Table 5. Cybersecurity risk dimensions of ATP systems.

Dimension	Critical Influencing Factors	Description
Cybersecurity Risk Dimensions of ATP Systems	Inability to provide drivers with information on upcoming signals, block status, and train occupancy [40]	Drivers are required to make operational decisions in responsibility mode, as ATP assistance becomes unavailable.
	Inability to determine the speed limit for following trains based on the position of the preceding train [41]	Failure to impose speed restrictions accordingly may lead to rear-end collisions and compromise train safety and dispatch control.
	Inability to transmit speed restriction information to trains [42]	Failure to convey speed restriction information to trains may result in overspeeding, increasing the risk of accidents and threatening operational safety.
	Failure to automatically apply brakes when the train exceeds the speed limit [43]	Overspeed without automatic braking may result in block violations or Signals Passed at Danger, posing serious risks to passenger safety and operational stability.

and

Table 6. Cybersecurity risk dimensions of power systems.

Dimension	Critical Influencing Factors	Description
Cybersecurity Risk Dimensions of Power Systems	Train operation disruptions and delays [44]	Train stoppages en route result in passengers being stranded, which is especially hazardous in tunnels or remote sections.
	Increased passenger Safety risks [45]	Prolonged power outages may cause overheating and oxygen depletion inside the train, which is particularly dangerous during summer.
	Malfunctions in signal and communication systems [46]	Signal blackouts and track switch failures increase the risk of collisions.
	Increased risk of catastrophic accidents [47]	Some braking systems rely on electrical power. Failures may result in extended stopping distances or complete braking loss.

. The AHP expert questionnaire was designed using pairwise comparisons to evaluate the relative importance and weight of each criterion across hierarchical levels.

In the dimension of cybersecurity risks associated with dispatch radio communication systems, the first critical factor was the inability of dispatchers to issue dispatch instructions, which can compromise operational safety and scheduling efficiency [31]. The inability of train crew to communicate with one another was also a significant cybersecurity risk associated with the dispatch radio communication system, as it may delay reporting of faults or abnormalities [32,33]. The failure of the emergency reporting system may prevent timely emergency alerts [34]. Furthermore, the inability to record calls results in the loss of critical information, which poses challenges for future investigation and clarification of incidents [35].

Within the dimension of cybersecurity risks in CTC systems, some studies point out that the inability to monitor train occupancy in track sections may lead to train collisions, dispatching difficulties, and safety hazards [36]. When controllers are unable to issue commands to safety control systems—such as signaling equipment and track switches—it can compromise operational safety and disrupt train dispatching [37]. The inability of the dispatching system to automatically track train numbers can result in dispatching errors and misjudgment of train positions [38]. Additionally, the inability to automatically record train arrival, departure, or passing times at stations is another risk factor that impairs real-time awareness of train operations [39].

In terms of cybersecurity risks associated with ATP systems, the inability to provide drivers with information on upcoming signals, block status, and train occupancy deprives drivers of ATP assistance [40]. The inability to determine the speed limit for following trains based on the position of the preceding train increases the risk of rear-end collisions [41]. The inability to transmit speed restriction information to trains may cause trains to travel too fast or too slow, resulting in accidents [42]. Additionally, the failure to automatically apply brakes when the train exceeds the speed limit poses a significant threat to passenger safety [43].

Regarding the cybersecurity risks in power systems, power outages can lead to train operation disruptions and delays, posing operational safety risks [44]. Prolonged blackouts and halted trains may cause overheating and oxygen depletion inside the train, endangering passenger safety [45]. Power failures may also result in signal and communication system malfunctions, such as signal blackouts and track switch failures, increasing the likelihood of collisions [46]. Since certain braking systems rely on electrical power, the inability to apply brakes during power failures may result in catastrophic accidents [47].

3. Results

The research team established a hierarchical analytical structure, consisting of four risk dimensions and sixteen evaluation criteria (risk factors), as detailed above. Next, they applied AHP to compute the relative weights of the criteria based on data collected from expert questionnaires.

In this study, the AHP questionnaire only asked respondents to evaluate the relative weights of the dimensions and evaluation criteria. No personal data from respondents were collected. At the beginning of the questionnaire, participants were informed that their responses would remain anonymous and unidentifiable. The research team is committed to protecting respondents’ privacy and maintaining confidentiality to minimize any potential risk of personal data exposure. The data will be analyzed in aggregate and published in an international journal, with no commercial interests involved. Participation is entirely voluntary, and respondents are free to decline or withdraw from the questionnaire at any time without any pressure.

A total of 28 expert questionnaires were distributed, with 25 valid responses received, yielding a response rate of 89%. The respondents included professionals from government agencies and experienced practitioners in the communications industry, which ensured that the overall evaluation criteria effectively addressed the risk objectives while maintaining objectivity. The background information of the participating experts is summarized in

Table 7. Expert background information of current organization.

Background Type	Railway Administrative Authority	Railway Operating Organization	Information and Communications Industry
Number of Experts	4	15	6

,

Table 8. Expert background information of position.

Background Type	Senior Executive	Middle Management/Technical Supervisor	Frontline Manager/ Operations Staff
Number of Experts	9	8	8

and

Table 9. Expert background information of area of expertise.

Background Type	Communication and Information Systems	Railway Dispatch and Transportation Management	System Integration and Professional Management	Electromechanical Engineering
Number of Experts	8	4	6	7

.

The AHP survey respondents’ expertise covers four key domains: communications and information systems, railway traffic dispatching and transportation management, systems integration and project management, and mechatronics and power engineering. These specializations align with the four major risk factors explored in this study. The organizational levels of the respondents include senior executives, middle management/technical supervisors, and grassroots management and operational staff. The organizations they represent include railway regulatory authorities, railway operating agencies, and information and communication technology vendors. This diverse background of the respondents is sufficient to confirm the representativeness of the sample in this study.

To ensure the validity of the expert questionnaire results, consistency testing was conducted. This included the C.I., which assesses internal consistency of individual expert judgments; the C.R., which evaluates consistency within a single hierarchical level; and the Consistency Ratio of the Hierarchy (C.R.H.), which assesses consistency across the overall hierarchical structure. When C.I., C.R., and C.R.H. are all ≤0.1, the rankings assigned by experts to both major dimensions and evaluation criteria are considered logically consistent, thus confirming the overall rationality of the hierarchical structure. The computations in the present study were performed using the decision support software Expert Choice 11.0. In addition to satisfying the threshold of ≤0.1 for C.I., C.R., and C.R.H., the Overall Inconsistency was calculated to be 0.0013, well within the acceptable limit (≤0.1), indicating a high degree of overall consistency.

Preliminary results based on responses from 25 experts are presented in

Table A1. Summary of major dimensions.

	Evaluation Criteria	Dispatch Radio Communication System Cybersecurity	CTC System Cybersecurity	ATP System Cybersecurity	Power System Cybersecurity
Questionnaire No.
1		0.093	0.435	0.036	0.435
2		0.038	0.115	0.236	0.610
3		0.321	0.321	0.321	0.036
4		0.069	0.310	0.412	0.210
5		0.318	0.318	0.318	0.045
6		0.056	0.474	0.332	0.138
7		0.059	0.254	0.577	0.110
8		0.088	0.276	0.052	0.585
9		0.192	0.052	0.704	0.052
10		0.061	0.446	0.416	0.077
11		0.067	0.427	0.427	0.079
12		0.175	0.042	0.304	0.479
13		0.060	0.383	0.383	0.175
14		0.053	0.318	0.558	0.071
15		0.338	0.205	0.288	0.169
16		0.083	0.417	0.083	0.417
17		0.188	0.678	0.047	0.088
18		0.036	0.435	0.435	0.093
19		0.061	0.416	0.077	0.446
20		0.048	0.203	0.599	0.151
21		0.129	0.143	0.687	0.040
22		0.100	0.700	0.100	0.100
23		0.063	0.586	0.288	0.063
24		0.205	0.685	0.046	0.064
25		0.041	0.361	0.079	0.520
Average		0.121	0.399	0.293	0.186

,

Table A2. Summary of cybersecurity risk dimension for dispatch radio communication system.

	Evaluation Criteria	Inability of Dispatchers to Issue Dispatch Instructions	Inability of Train Crew to Communicate with One Another	Failure of the Emergency Reporting System	Inability to Record Calls, Resulting in the Loss of Critical Information
Questionnaire No.
1		0.673	0.165	0.114	0.048
2		0.677	0.110	0.170	0.043
3		0.450	0.050	0.450	0.050
4		0.586	0.168	0.204	0.041
5		0.100	0.100	0.700	0.100
6		0.155	0.146	0.661	0.038
7		0.134	0.155	0.658	0.054
8		0.401	0.427	0.118	0.053
9		0.186	0.069	0.698	0.046
10		0.606	0.234	0.080	0.080
11		0.475	0.098	0.358	0.068
12		0.170	0.170	0.625	0.036
13		0.627	0.204	0.131	0.039
14		0.531	0.314	0.092	0.063
15		0.518	0.097	0.083	0.302
16		0.208	0.208	0.487	0.096
17		0.437	0.082	0.437	0.044
18		0.134	0.134	0.692	0.040
19		0.420	0.420	0.126	0.034
20		0.047	0.297	0.568	0.088
21		0.146	0.155	0.661	0.038
22		0.666	0.047	0.220	0.067
23		0.651	0.110	0.119	0.119
24		0.236	0.658	0.062	0.044
25		0.540	0.274	0.150	0.037
Average		0.403	0.203	0.321	0.072

,

Table A3. Summary of cybersecurity risk dimension for CTC system.

	Evaluation Criteria	Inability to Monitor Train Occupancy in Track Sections (Locations)	Inability of Controllers to Issue Commands to Safety Control Systems	Inability of the Dispatching System to Automatically Track Train Numbers	Inability to Automatically Record Train Arrival, Departure, or Passing Times at Stations
Questionnaire No.
1		0.409	0.453	0.094	0.045
2		0.190	0.694	0.057	0.059
3		0.735	0.082	0.124	0.060
4		0.262	0.565	0.118	0.055
5		0.438	0.438	0.063	0.063
6		0.613	0.208	0.089	0.089
7		0.219	0.660	0.061	0.061
8		0.246	0.589	0.114	0.050
9		0.692	0.140	0.099	0.070
10		0.615	0.170	0.170	0.044
11		0.206	0.646	0.085	0.064
12		0.750	0.083	0.083	0.083
13		0.621	0.165	0.165	0.048
14		0.297	0.125	0.414	0.164
15		0.052	0.266	0.341	0.341
16		0.742	0.082	0.117	0.058
17		0.429	0.429	0.093	0.049
18		0.750	0.083	0.083	0.083
19		0.168	0.611	0.168	0.052
20		0.579	0.282	0.081	0.057
21		0.144	0.574	0.203	0.078
22		0.235	0.454	0.155	0.155
23		0.239	0.253	0.299	0.209
24		0.645	0.143	0.120	0.093
25		0.646	0.080	0.156	0.117
Average		0.446	0.310	0.151	0.093

,

Table A4. Summary of cybersecurity risk dimension for ATP system.

	Evaluation Criteria	Inability to Provide Drivers with Information on Upcoming Signals, Block Status, and Train Occupancy	Inability to Determine the Speed Limit for Following Trains Based on the Position of the Preceding Train	Inability to Transmit Speed Restriction Information to Trains	Failure to Automatically Apply Brakes When the Train Exceeds the Speed Limit
Questionnaire No.
1		0.127	0.451	0.041	0.382
2		0.546	0.304	0.050	0.099
3		0.235	0.172	0.235	0.357
4		0.112	0.189	0.059	0.641
5		0.098	0.071	0.148	0.683
6		0.735	0.054	0.054	0.158
7		0.315	0.081	0.133	0.471
8		0.609	0.208	0.107	0.076
9		0.178	0.158	0.042	0.623
10		0.450	0.050	0.050	0.450
11		0.734	0.087	0.087	0.093
12		0.499	0.099	0.080	0.322
13		0.695	0.100	0.095	0.110
14		0.513	0.176	0.155	0.156
15		0.237	0.167	0.217	0.380
16		0.064	0.156	0.219	0.562
17		0.429	0.071	0.071	0.429
18		0.083	0.083	0.083	0.750
19		0.668	0.143	0.101	0.088
20		0.043	0.144	0.140	0.673
21		0.731	0.152	0.059	0.058
22		0.464	0.072	0.072	0.392
23		0.250	0.250	0.250	0.250
24		0.395	0.435	0.115	0.055
25		0.403	0.087	0.044	0.466
Average		0.376	0.170	0.119	0.335

and

Table A5. Summary of cybersecurity risk dimension for power system.

	Evaluation Criteria	Train Operation Disruptions and Delays	Increased Passenger Safety Risks	Malfunctions in Signal and Communication Systems	Increased Risk of Catastrophic Accidents
Questionnaire No.
1		0.206	0.042	0.297	0.455
2		0.055	0.055	0.243	0.648
3		0.033	0.264	0.188	0.515
4		0.126	0.069	0.244	0.561
5		0.056	0.056	0.598	0.289
6		0.034	0.223	0.223	0.521
7		0.077	0.383	0.120	0.419
8		0.048	0.650	0.046	0.256
9		0.048	0.048	0.654	0.249
10		0.039	0.327	0.308	0.327
11		0.036	0.321	0.321	0.321
12		0.057	0.455	0.061	0.427
13		0.051	0.461	0.055	0.433
14		0.038	0.460	0.210	0.292
15		0.100	0.300	0.300	0.300
16		0.417	0.083	0.417	0.083
17		0.039	0.124	0.419	0.419
18		0.033	0.406	0.154	0.406
19		0.093	0.036	0.435	0.435
20		0.041	0.133	0.253	0.573
21		0.056	0.458	0.056	0.430
22		0.093	0.036	0.435	0.435
23		0.356	0.098	0.251	0.295
24		0.035	0.234	0.558	0.174
25		0.033	0.196	0.575	0.196
Average		0.077	0.204	0.288	0.431

. These results formed the basis for subsequent calculations and the ranking of relative weights between risk dimensions and their corresponding evaluation criteria.

3.1. Analysis Results of Cybersecurity Risk Dimensions

Among the four major cybersecurity risk dimensions, the CTC system accounted for the highest proportion at 39.9%, indicating its critical importance within the overall framework. The ATP System ranked second, comprising 29.3%, followed by the Power System at 18.6%, and the Dispatch Radio Communication System at 12.1%, representing the lowest weighted dimension. Although the combined weight of the Power System and Dispatch Radio Communication System exceeded that of the ATP system alone, it still fell short of the weight attributed to the CTC system. This highlights the indispensable role of the ATP System in achieving the overarching goal of railway cybersecurity and underscores its significance within the overall hierarchical structure.

3.2. Analysis Results of Evaluation Criteria

3.2.1. Weights of Evaluation Criteria Within the Dispatch Radio Communication System Cybersecurity Risk Dimension

The evaluation criteria set under the Dispatch Radio Communication System cybersecurity risk dimension are presented in

Table 10. Comparison of evaluation criteria weights within the dispatch radio communication system cybersecurity risk dimension *.

Risk Dimension	Evaluation Criteria	Weight	Rank
Dispatch Radio Communication System Cybersecurity (0.121)	Inability of dispatchers to issue dispatch instructions (0.403)	0.049	1
	Inability of train crew to communicate with one another (0.203)	0.025	3
	Failure of the emergency reporting system (0.321)	0.039	2
	Inability to record calls, resulting in the loss of critical information (0.072)	0.009	4

* C.I. = 0.00628; C.R. = 0.00697; λmax = 4.01884.

. Among these, “inability of dispatchers to issue dispatch instructions” held the highest weight at 40.3%, followed by “failure of the emergency reporting system” at 32.1%. The “inability of train crew to communicate with one another” and “inability to record calls, resulting in the loss of critical information” ranked third and fourth, with weights of 20.3% and 7.2%, respectively. Within this risk dimension, experts identified the inability of dispatchers to issue instructions as the most critical cybersecurity risk factor. If dispatchers are unable to command trains due to system attacks or malfunctions, it could lead to operational disruptions, scheduling chaos, or even potential accidents. These risks, when compounded by other associated threats, could result in significant losses; thus, it is crucial to prioritize resource allocation to mitigate this vulnerability [31]. Although the inability to record calls received the lowest weight, it should not be overlooked. A reliable recording mechanism is essential for maintaining dispatch records, clarifying post-incident accountability, and preventing difficulties and disputes due to missing call records during follow-up investigations [35].

3.2.2. Weights of Evaluation Criteria Within the CTC System Cybersecurity Risk Dimension

As shown in

Table 11. Comparison of evaluation criteria weights within the CTC system cybersecurity risk dimension *.

Risk Dimension	Evaluation Criteria	Weight	Rank
CTC System Cybersecurity (0.399)	Inability to monitor train occupancy in track sections (0.446)	0.178	1
	Inability of controllers to issue commands to safety control systems (0.310)	0.124	2
	Inability of the dispatching system to automatically track train numbers (0.151)	0.060	3
	Inability to automatically record train arrival, departure, or passing times at stations (0.093)	0.037	4

* C.I. = 0.00648; C.R. = 0.0072; λmax = 4.01944.

, the cybersecurity risk dimension of the CTC system included four evaluation criteria. The highest weight (44.6%) was assigned to “inability to monitor train occupancy in track sections”, followed by “inability of controllers to issue commands to safety control systems” (31%), “inability of the dispatching system to automatically track train numbers” (15.1%), and “inability to automatically record train arrival, departure, or passing times at stations” (9.3%). This dimension demonstrated that if the CTC system is compromised due to cyberattacks or technical failures, real-time monitoring of train locations may be lost, potentially leading to misjudgments of train intervals. This could result in delays, service disruptions, or, in severe cases, train collisions or routing conflicts [36]. Therefore, accurate and reliable monitoring of track section occupancy was the foremost cybersecurity concern in this system. In contrast, the automation of train number tracking and station time recording functions were considered secondary risks. Although these features are essential for operational efficiency and management, they present relatively low cybersecurity exposure compared to the former two.

3.2.3. Weights of Evaluation Criteria Within the ATP System Cybersecurity Risk Dimension

A total of four evaluation criteria were established in the ATP system cybersecurity risk dimension, as presented in

Table 12. Comparison of evaluation criteria weights within the ATP system cybersecurity risk dimension *.

Risk Dimension	Evaluation Criteria	Weight	Rank
ATP System Cybersecurity (0.293)	Inability to provide drivers with information on upcoming signals, block status, and train occupancy (0.376)	0.110	1
	Inability to determine the speed limit for following trains based on the position of the preceding train (0.170)	0.050	3
	Inability to transmit speed restriction information to trains (0.119)	0.035	4
	Failure to automatically apply brakes when the train exceeds the speed limit (0.335)	0.098	2

* C.I. = 0.00007; C.R. = 0.00007; λmax = 4.00021.

. Ranked by their relative weights, these were “inability to provide drivers with information on upcoming signals, block status, and train occupancy” (37.6%), “failure to automatically apply brakes when the train exceeds the speed limit” (33.5%), “inability to determine the speed limit for following trains based on the position of the preceding train” (17%), and “inability to transmit speed restriction information to trains” (11.9%). In this risk dimension, the core cybersecurity objectives of the ATP system are reflected in the real-time delivery of signal, block, and occupancy information, as well as in the system’s automatic braking intervention when trains operate unsafely. Therefore, resource allocation and technical measures should focus on the essence of cybersecurity risks, prioritizing the strengthening and consolidation of these two critical capabilities.

3.2.4. Weights of Evaluation Criteria Within the Power System Cybersecurity Risk Dimension

As shown in

Table 13. Comparison of evaluation criteria weights within the power system cybersecurity risk dimension *.

Risk Dimension	Evaluation Criteria	Weight	Rank
Power System Cybersecurity (0.186)	Train operation disruptions and delays (0.077)	0.014	4
	Increased passenger safety risks (0.204)	0.038	3
	Malfunctions in signal and communication system (0.288)	0.054	2
	Increased risk of catastrophic accidents (0.431)	0.080	1

* C.I. = 0.00054; C.R. = 0.0006; λmax = 4.00162.

, in the power system cybersecurity risk dimension, the highest weighted evaluation criteria (43.1%) was assigned to “increased risk of catastrophic accidents,” followed by “malfunctions in signal and communication systems” (28.8%), “increased passenger safety risks” (20.4%), and “train operation disruptions and delays” (7.2%). The dominant weight assigned to catastrophic accidents indicates that if a cyberattack, malicious sabotage, or unintentional failure were to compromise the power system, it could lead to severe consequences—such as large-scale power outages, explosions, or fires—posing a major threat to railway operations and personnel safety. Such events may also trigger cascading disasters, complicating emergency response and recovery efforts [46]. Power anomalies frequently cause malfunctions in signal and communication systems, thereby increasing operational safety risks [47]. Moreover, sudden interruptions in the power system can lead to failures or disruptions in facilities and equipment, which directly affects passenger safety during movement within stations, on trains, and between station areas. The resulting panic within a short time frame may further exacerbate evacuation challenges.

3.3. Prioritization of Cybersecurity Risk Factors for Railway CI

Table 14. Comparison of evaluation criteria weights across cybersecurity risk dimensions of railway CI.

Rank	Description	Weight	Cumulative Value
1	Inability to monitor train occupancy in track sections (locations)	0.178	0.178
2	Inability of controllers to issue commands to safety control systems	0.124	0.302
3	Inability to provide drivers with information on upcoming signals, block status, and train occupancy	0.11	0.412
4	Failure to automatically apply brakes when the train exceeds the speed limit	0.098	0.51
5	Increased risk of catastrophic accidents due to power system cybersecurity issues	0.08	0.59
6	Inability of the dispatching system to automatically track train numbers	0.06	0.65
7	Malfunctions in signal and communication systems	0.054	0.704
8	Inability to determine the speed limit for following trains based on the position of the preceding train	0.05	0.754
9	Inability of dispatchers to issue dispatch instructions	0.049	0.803
10	Failure of the emergency reporting system	0.039	0.842
11	Increased passenger safety risks due to power system cybersecurity issues	0.038	0.88
12	Inability to automatically record train arrival, departure, or passing times at stations	0.037	0.917
13	Inability to transmit speed restriction information to trains	0.035	0.952
14	Inability of train crew to communicate with one another	0.025	0.977
15	Train operation disruptions and delays	0.014	0.991
16	Inability to record calls, resulting in the loss of critical information	0.009	1

presents the results of cumulative weighting and prioritization for the 16 evaluation criteria in the present study. The findings revealed that “inability to monitor train occupancy in track sections, “inability of controllers to issue commands to safety control systems”, “inability to provide drivers with information on upcoming signals, block status, and train occupancy”, “failure to automatically apply brakes when the train exceeds the speed limit”, “increased risk of catastrophic accidents”, and “inability of dispatching systems to automatically track train numbers” were among the most critical cybersecurity risk factors, collectively accounting for the top 70% of cumulative weights. These six factors represent key areas in cybersecurity management for railway CI, and resources should be prioritized accordingly for improvement or enhancement. According to Table 4, Table 5, Table 6, Table 7, Table 8, Table 9 and Table 10, three of the cybersecurity risk factors that fell within the top 70% of cumulative weightings belonged to the CTC system dimension, with the top two ranking factors both originating from this dimension. This highlighted the substantial importance of cybersecurity in CTC systems. On the other hand, the Dispatch Radio Communication System was the only risk dimension that contained no risk factor within the top 70% of cumulative weights. Consequently, it may be given lower priority in cybersecurity resource allocation; however, practical operational needs should still be considered, with limited cybersecurity resources dynamically reallocated in a hybrid manner to ensure appropriate and responsive risk management.

4. Discussion

Emerging technologies such as AI, blockchains, and the IoT have been increasingly integrated into CI, and with them comes the promise of enhanced operational efficiency and public welfare. However, viewed from a risk-oriented perspective, the integration of AI, blockchains, and IoT into CI also introduces significant cybersecurity vulnerabilities, the potential consequences of which—particularly in terms of human safety and economic loss—merit serious consideration and in-depth analysis. Although prior railway safety research has often focused on technical or single-dimensional aspects, few studies have focused on multi-attribute decision-making; therefore, this study adopted AHP to assess risk factors associated with railway infrastructure and compiled a list of the top 70% of prioritized criteria to facilitate cybersecurity risk management in railway systems.

Focusing on the cybersecurity risks of the Taiwan Railway, the present study constructed a hierarchical framework comprising four primary risk dimensions and 16 evaluation criteria. The AHP method was employed to derive expert-based weightings and identify the relative prioritization of cybersecurity risks in the protection of railway CI. On the basis of the results, the cybersecurity risk dimension of the CTC system held the highest weight (39.9%), underscoring the urgent need for protection in real-time monitoring of train occupancy and issuance of control commands. The ATP system ranked second (29.3%), which highlighted the importance of reliable control and braking mechanisms in ensuring operational safety.

The analysis further revealed that among the top six high-risk factors, three belonged to the CTC system and two belonged to the ATP system, identifying these two systems as core domains for cybersecurity protection in Taiwan Railway’s CI. Specifically, “inability to monitor train occupancy in track sections”, “failure of controllers to issue commands to safety systems”, and “inability to provide signal and block information to drivers” are critical threats. If exploited via cyberattacks, these weaknesses could severely disrupt train operations and passenger safety, potentially leading to catastrophic incidents such as collisions. Although the dispatch radio communication system cybersecurity dimension ranked lowest overall (12.1%), its internal criteria—such as “inability of dispatchers to issue instructions” and “failure of emergency reporting”—still represented notable risks. These factors should be included in the baseline protection standards and be subject to regular auditing to mitigate or eliminate risks.

By systematically identifying critical cybersecurity risk factors in railway transportation infrastructure and providing quantifiable prioritization, the present study offers actionable insights for future resource allocation and policy development. The findings emphasize the need to focus cybersecurity efforts on core control and operational subsystems. It is therefore recommended that the government and Taiwan Railway implement differentiated and proactive protection strategies for key subsystems to strengthen cybersecurity resilience and enhance risk governance in the railway sector.

This study primarily focuses on the risk factors concentrated within a railway company’s internal information security systems. Research on railway information security threats in Japan encompasses issues related to the system’s sheer scale and complexity, as well as the safety of on-site infrastructure like platform doors and track intrusion detection systems. Any single point of failure in a railway’s information system can lead to catastrophic casualties. European research on railway infrastructure indicates that as automation increases, cybersecurity risks emerge as a new threat. Historically, engineering designs have paid less attention to information security issues and have also failed to address railway staff’s lack of security awareness and inadequate training [48]. Fundamentally, the research findings on railway information security from both Japan and Europe show a strong similarity to those of this study. For future railway information security management, it is crucial to focus on security management and information sharing across multi-organizational and systemic frameworks, and to strengthen inter-departmental communication and coordination to mitigate major casualties caused by information security failures.

Yu et al. studied how to strategically place “protection nodes” to prevent the cascading of a single point of failure in critical networked infrastructures [49]. Their research introduced the concept of “vaccine centrality” based on a partially ordered set, which provides partial inspiration for how a single risk factor in a train’s journey could lead to a large-scale disaster. This research inspires our study by suggesting that any single risk from the four major information security criteria and their secondary standards could escalate into a major traffic accident and disaster. Therefore, all primary and secondary information security risks should be comprehensively monitored, and protection nodes should be established.

5. Practical Recommendations

For the cybersecurity risks associated with the CTC system, it is recommended to adopt a zero-trust architecture with stricter network segmentation and software control, as well as enhance cybersecurity awareness and training for railway IT personnel. As for the ATP system, power system, and dispatch radio communication system, the establishment of a cybersecurity monitoring platform and regular third-party audits are necessary to improve cybersecurity resilience and system reliability.

To mitigate risks in the dispatch radio communication system, deploying redundant communication devices is advised to ensure alternative communication channels in the event of primary system failure. Additionally, encryption of dispatcher voice communications should be implemented to prevent interception or disruption. Communication recordings should be captured in real time and stored in off-site backups.

Regarding the critical risk factor “inability to monitor train occupancy in track sections” under the CTC system, the resilience and cybersecurity of track circuit sensors should be enhanced. AI-based video recognition technologies could also assist in detection and response. Transmission paths for control commands should be encrypted, and system stability must be reinforced. For the power system, establishing robust defensive and rapid recovery mechanisms is essential, along with real-time anomaly and cybersecurity monitoring.

Policies should advocate for network segmentation, strictly partitioning access between core systems, office networks, and external networks. A strict software whitelisting policy should be implemented, allowing only authorized applications to be executed. Independent third-party cybersecurity firms should be regularly commissioned to conduct penetration tests and security audits. The resilience of track circuit sensors should be enhanced to withstand both physical and cyberattacks. The power system should be fortified with a multi-layered defense, deploying firewalls, intrusion detection systems, and intrusion prevention systems at various levels.

6. Research Limitations and Future Research Directions

While the Analytic Hierarchy Process (AHP) can assist decision-makers in clarifying the weights of criteria and alternatives in diverse situations, it is not without its drawbacks. AHP suffers from subjective bias in expert judgments, limitations in its hierarchical structure, and an inability to effectively address ambiguity. Consequently, some studies have adopted the Delphi method to first define problems and evaluation criteria, thereby reducing subjective bias and group pressure among experts. Other researchers have used Fuzzy AHP to address the vagueness inherent in subjective expert judgments. In recent years, scholars have begun to integrate these methods by inputting the criteria weights derived from Fuzzy AHP into machine learning models to build predictive or classification models.

This study, however, relies solely on AHP for its weight analysis. We therefore suggest that future researchers consider a mixed-methods approach, combining Delphi, Fuzzy AHP, and machine learning. This integration would likely lead to more diverse findings and robust outcomes.