Risk Assessment for Cyber Security of Manufacturing Systems: A Game Theory Approach

Abstract

This paper presents a novel approach using game theory to assess the risk likelihood in manufacturing systems quantifiably. Cybersecurity is a pressing issue in the manufacturing sector. Nevertheless, managing the risk in cybersecurity has become a critical challenge for modern manufacturing enterprises. In risk management thinking, the first step is to identify the risk, then validate it, and lastly, consider responses to the risk. If the risk is below the security risk appetite of the manufacturing system, it could be accepted. However, if it is above the risk appetite, the system should appropriately respond by either avoiding, transferring, or mitigating the risk. The validation of the risk in terms of severity and likelihood of the threat, however, is challenging because the later component is hard to quantify. In this paper, Failure Modes and Effects Analysis (FMEA) method is modified by employing game theory to quantitatively assess the likelihood of cyber-physical security risks. This method utilizes the game theory approach by modeling the rivalry between the attacker and the system as a game and then try to analyze it to find the likelihood of the attacker's action. We first define players of the game, action sets, and the utility function. Major concerns of cyber security issues in the manufacturing area are carefully considered in defining the cost function composed of defense policy, loss in production, and recovery. A linear optimization model is utilized to find a mixed-strategy Nash Equilibrium, which is the probability of choosing any action by the attacker also known as the likelihood of an attack. Numerical experiments are presented to further illustrate the method. Forecasting the attacker's behavior enables us to assess the cybersecurity risk in a manufacturing system and thereby be more prepared with plans of proper responses.

A Web Platform for Integrated Vulnerability Assessment and Cyber Risk Management

“…The management of this risk should give a general view of the organization through the cataloguing of resources, the identification of threats and the valuing of vulnerabilities [9]. In a Cyber scenario, Risk Management should be done on very different and complex systems with the aim of identifying the risk, then validate it and, lastly, consider responses to the risk [10].…”

Implementation of cybersecurity risk analysis systems in Colombia

“…However, at the global level, the diversity of norms and criteria established for aspects associated with business schemes, risk policies, risk analysis and their management, make it difficult to assume one as the best, as they differ in their approaches, but above all, due to the lack of a methodological process approach to assume these activities and the difficulty of having software based technological alternatives to assist in this work. In this scenario, research in security risk management has been proposing several approaches: quantitative, qualitative and hybrid, as well as approaches related to implementation of management and analysis tools, often using fuzzy logic algorithms [3][4], computational intelligence [5], game theory [6], among others.…”

A Framework for Game Theoretic Model for Cyber Treats Prevention

“…Linear programming has been utilized in cyber-attack prevention, yet the capability to devise practical mathematical solutions to gaming problems remains a significant challenge within game theory (Amadi et al, 2017). Additionally, Zarreh et al (2019) tackled cybersecurity challenges in sophisticated manufacturing systems characterized by high-level computer-controlled integration. Their research proposed a method for constructing and addressing a game theory model, albeit with the simplification of employing zero-sum game theory, which may not reflect reality accurately.…”