Identifying, analyzing, and evaluating cybersecurity risks are essential to assess the vulnerabilities of modern manufacturing infrastructures and to devise effective decision-making strategies to secure critical manufacturing against potential cyberattacks. In response, this work proposes a graph-theoretic approach for risk modeling and assessment to address the lack of quantitative cybersecurity risk assessment frameworks for smart manufacturing systems. In doing so, first, threat attributes are represented using an attack graphical model derived from manufacturing cyberattack taxonomies. Attack taxonomies offer consistent structures to categorize threat attributes, and the graphical approach helps model their interdependence. Second, the graphs are analyzed to explore how threat events can propagate through the manufacturing value chain and identify the manufacturing assets that threat actors can access and compromise during a threat event. Third, the proposed method identifies the attack path that maximizes the likelihood of success and minimizes the attack detection probability, and then computes the associated cybersecurity risk. Finally, the proposed risk modeling and assessment framework is demonstrated via an interconnected smart manufacturing system illustrative example. Using the proposed approach, practitioners can identify critical connections and manufacturing assets requiring prioritized security controls and develop and deploy appropriate defense measures accordingly.

翻译：识别、分析并评估网络安全风险对于评估现代制造基础设施的脆弱性，以及制定有效的决策策略以保护关键制造业免受潜在网络攻击至关重要。为此，本文提出了一种基于图论的风险建模与评估方法，以解决智能制造系统缺乏定量网络安全风险评估框架的问题。具体而言，首先，利用源自制造网络攻击分类学的攻击图模型来表示威胁属性。攻击分类学提供了对威胁属性进行分类的一致结构，而图方法有助于对其相互依赖性进行建模。其次，通过分析这些图来探索威胁事件如何在制造价值链中传播，并识别威胁行为者在威胁事件期间能够访问和破坏的制造资产。第三，所提方法识别出能够最大化成功可能性并最小化攻击检测概率的攻击路径，然后计算相关的网络安全风险。最后，通过一个互联智能制造系统的示例对所提出的风险建模与评估框架进行验证。采用所提方法，从业者能够识别需要优先进行安全控制的关键连接和制造资产，并据此开发与部署适当的防御措施。