In this paper, we focus on cyber attacks in the context of macroscopic transportation network models. For our studies, we consider a strip of freeway traffic network that is actuated on the upstream boundary by ramp-metering, which are controlled remotely from a centralized command center. In our framework, we first formulate analytical conditions for generating stealthy cyber-attacks using Aw-Rascle-Zhang (ARZ) macroscopic traffic model. Such conditions elucidate the capability of attackers and theoretical limitations of attack detection algorithms. Subsequently, we propose a design framework for cyber attack detection algorithms that considers several desirable detection characteristics such as stability, robustness and attack sensitivity. Finally, we illustrate the effectiveness of our framework via simulation studies.