Virtual Testbed for Cyber-Physical System Security Research and Education: Design, Evaluation, and Impact

This article presents the design and implementation of a Virtual Cyber-Physical Testbed (VCPT) for transportation systems, featuring an automated level-crossing process. The proposed design improves network fidelity while keeping the platform lightweight. Key components include the Programmable Logic Controller (PLC), sensors, actuators, the Supervisory Control and Data Acquisition (SCADA) system, and OPNsense. Guided by NIST SP 800-115, penetration testing revealed several vulnerabilities and weaknesses that can be exploited and mitigated. Six attack scenarios—enumeration, brute force, remote code execution, ARP poisoning, DoS, and command injection—were executed, demonstrating realistic impacts on process safety and availability. Mitigation strategies using custom firewall and Intrusion Detection and Prevention System (IDPS) rules contributed to improving the security posture of VCPT. Educational evaluation with 41 cybersecurity students showed a 24% increase in average scores and a significant rise in top performers, further supported by positive feedback on engagement and realism. These results validate the VCPT as an effective platform for cybersecurity research, training, and experiential learning.