8 The digitalization and automation of the construction sector, known as Construction 4.0, are 9 transforming positively the way we plan, design, execute, and operate construction projects. 10 However, they are also increasing the vulnerability of construction projects and making the 11 architecture, engin eering, construction, and facility management (AEC -FM) industry subject to 12 cyberattacks. Although current cybersecurity practices are relevant, they cannot be directly 13 adopted because of the unique challenges faced by the AEC -FM industry, such as complex s upply 14 chains, interoperability, and dynamic workforce from project to project. Current literature suggests 15 that, though current standards and practices are relevant, industry -specific studies need to be 16 conducted before they can be successfully integrated. To that extent, this study investigates the 17 cybersecurity threat modeling for construction projects by developing a framework that identifies 18 what might be compromised, how might it happen, why would someone intend to do it, what 19 would be the impact, and what could be done to prevent it. Specifically, the objectives are to a) 20 develop a preliminary threat model relevant to construction that can be used by construction 21 stakeholders with minimal cybersecurity expertise, b) show the feasibility of the approach by using 22 illustrative threat models for each of the life cycle phases of a construction project, and c) use the 23 commissioning phase of a building as a case study to show a possible countermeasure for the cyber 24 threats that could occur during the testing o r certification process of a given system. This study 25 addresses essential components to enable the full potential of (i.e., digitalization and automation 26 of the construction industry) and define research areas needed to pave the roadmap for the future 27 of the construction industry and successful development of Construction 4.0. The proposed 28 framework will help analyze, examine, and address the safety and security of stakeholders and 29 systems during crucial phases of a construction project (e.g., pre -construct ion, construction, and 30 operation). 31 Keywords: AEC -FM industry ; Building c ommissioning ; Construction 4.0; Construction 32 automation; Cybersecurity; Cyber -physical system; Mobile r obots ; Threat m odeling 33 I. INTRODUCTION 34 The rapid advancements in information and communication technologies, in conjunction with the 35 ubiquitous availability of the computing devices, steered the fast -paced digital revolution of the 36 21st century (Jia et al., 2019). Though delayed, this has made its impact on transforming the 37 constructio n industry, which was reluctant and hes itant to technological change. This has become 38 increasingly important as construction firms strive to remain competitive. Some of the other 39 motivating reasons include improvements in productivity, innovation, value cr eation, accessibility, 40 2 satisfaction, profits, sales, strategy, and marketing (Garcia de Soto et al., 2018; Osunsanmi et al., 41 2018; Boton and Forgues, 2017). Tools and technologies that are assisting the acceleration of 42 construction digitalization include r obotics, additive manufacturing, virtual and augmented reality, 43 Internet of Things (IoT), and big data (Rastogi, 2017), among others. 44 The push towards construction digitalization and the current transformation in the industry also 45 closely aligns with the c oncept of Industry 4.0. Thus the name, Construction 4.0 for this 46 transformation in the construction industry. The aim is to digitize the information and have connected 47 and automated systems across the different life cycle phases of construction, starting f rom the project 48 inception to the end of life, including the commissioning, operation, and maintenance phases. It is 49 expected and shown that the availability of digital information and the ability to automate different 50 activities can have reaping benefits t o the time, cost, quality, safety, and performance of the 51 infrastructure systems. As a result of implementing these technologies large amounts of 52 organizational (e.g., banking records, employee information, and intellectual property), project (e.g., 53 design , safety, and productivity), and personal (e.g., social security numbers and demographic) data 54 is stored, transmitted, and monitored. In addition, it also enables the control and automation of 55 different systems that are in physical contact with equipment ( e.g., excavator), assets (e.g., building), 56 and people (e.g., labor). 57 Due to the involvement of highly confidential, proprietary, and sensitive information and access, 58 there is an inherent security risk to digital information and the physical asset. For exa mple, 59 individuals with malicious intent can cause deliberate destruction by gaining access to onsite 60 construction equipment. It is thus important for different stakeholders involved in the construction 61 process to implement strategies and safeguard the secu rity of the digital data and physical assets. 62 However, the awareness and implementation in high -level security have been very low and 63 neglected, which makes the industry susceptible and attractive to malicious individuals (Watson, 64 2018). Successful integra tion of construction digitalization requires the consideration of 65 cybersecurity (Mantha and Garcia de Soto, 2019a; Parn and Edwards, 2019; Boyes, 2013; Fisk, 66 2012). Existing cybersecurity standards and practices from other industries cannot be directly 67 adopted into construction due to characteristic differences and challenges such as complex 68 interactions, different stakeholder interests, and lower profit margins. Therefore, a fundamental 69 understanding of cyber risks and vulnerabilities as it relates to cons truction is necessary as part of 70 the construction cybersecurity framework before formalizing risk management strategies to address 71 them. 72 II. BACKGROUND 73 Cybersecurity can be defined as tools, policies, and practices to protect the stored and transmitted 74 data (e.g., drawings, schedules, and contracts) and physical assets (e.g., sensors, equipment, and 75 personnel) (ITU, 2019). The integration of the physical assets with the computing core (e.g., 76 software) is usually referred to as cyber -physical systems or widely known as CPS (Anumba et al., 77 2010). As has occurred in other industries, operating in a digital environment makes them 78 significantly vulnerable to cy ber-attacks (Li et al., 2018; Liu et al., 2017). Construction is no 79 different, and moreover, the complex chain of interactions, dynamics, coordination, and data 80 exchange between several inter -connected construction project participants pose unique 81 3 performa nce, productivity, business, and security risks. Risk can be defined as the possibility of 82 something bad happening (DHS, 2010). A threat can be defined as an action or event which can 83 occur naturally or intentionally and has the potential to harm informati on, property, people, and the 84 environment (Hutchins et al., 2015). Whereas attack is the action taken. Since risk and attack have 85 closely related meanings, they are used interchangeably, and it might be confusing at times. Finally, 86 vulnerability is the poi nt of weakness or the state of being susceptible to an attack (Hutchings et al., 87 2015). 88 Most of the reported cybersecurity incidents related to the construction industry can be categorized 89 as a data breach (e.g., data stolen, modified, destroyed, or made public), wire fraud (e.g., redirected 90 payments), or property and/or service loss or damage (e.g., power outage). Few of the data breach 91 incidents include jeopardized security due to stolen construction plans and specification files of the 92 Australian Secret Intelligence Services (ASIS) in 2013 (Motley and Mas, 2017). A lot of construction 93 employees’ tax details and social security numbers of a US -based construction company, Turner, 94 were compromised due to data sharing through unsecured channels posing busine ss-related risks 95 (Watson, 2018). In a similar incident, employees’ tax information of a concrete construction firm 96 was compromised (Motley and Mas, 2017). A very well-known construction elevator and escalator 97 manufacturer, ThyssenKrupp, also fell victim to a data breach, and hackers got hold of the sensitive 98 and confidential trade secret information (Motley and Mas, 2017). Whiting -Turner, a US -based 99 construction management and general contracting firm, also suffered a data breach and lost health, 100 insurance, and tax -related information of all its employees (iSqFt, 2016). On the other hand, hackers 101 tried to steal the proprietary details of the one arm bricklayer robot in Australia developed by Fast 102 Brick Robots (FBR) (Pash, 2018). Economic risks were faced dur ing the collection of deposits from 103 applicants in the name of Komatsu, a well -known Japanese construction machinery manufacturer 104 (Watson, 2018). Konecranes and Marous Brothers Construction lost about 17.2 million euros and 105 1.7 million US dollars due to unw arranted payments and wire fraud , respectively (Sawyer and 106 Rubenstone, 2019; Watson, 2018). Power services were disrupted for more than an hour and affected 107 about 225,000 customers in Ukraine because the company’s networked computers are hacked (BBC, 108 2017) . 109 Several efforts were made to assess and manage risks, specifically focusing on the built 110 environment security and Building Information Modeling (BIM) data sharing. For example, NIST 111 developed a cybersecurity framework for assessing and managing critical infrastructure. Though the 112 framework emphasizes Identification and Detection as primary steps of cyber risk management, 113 which are key components of threat modeling, it does not detail cyber threats and vulnerabilities in 114 construction (NIST, 2018). That is , none of the studies adopted and employed these steps to 115 construction. On the other hand, the Publicly Available Specification (PAS) 1192 -5, developed by 116 the British Standards Institute (BSI) in the United Kingdom (UK), focuses on information security. 117 It provides a framework to ensure that information is shared in a security -minded manner. This is to 118 enable the reliability and security of digitally built assets, keeping in mind that the data stored about 119 built assets could be used by those with malicious intent (PAS 1192 -5:2015; IET, 2013). Another 120 regulation, namely General Data Protection Regulation (GDPR) which was introduced in the year 121 2018 in Europe requires improved cyber -security for the operators of essential services, which 122 includes construction projects using digitally built environments, including digital infrastructure 123 4 (i.e., smart cities) and intelligent buildings (GDPR, 2018). These documents provide and establish 124 best practices to improve the security of construction and facility management practices. Even 125 though companies adhere to the standards and practices imposed and suggested by the local 126 governments, cybersecurity incidents still take place as discussed and mentioned previously. This is 127 because of a lack of continued understanding of t he cyber threat landscape. Hackers work relentlessly 128 to find faults and loopholes in the existing systems and take advantage of the weak links. It is 129 necessary to continually evaluate security as part of the risk management process. 130 A. Threat Modeling Met hods 131 Threat modeling is an essential way to understand cybersecurity threats and to devise effective and 132 efficient action plans (Shostack, 2014). Threat modeling is the process of identifying potential 133 threats, vulnerabilities, attackers, and targeted asse ts (Bodeau et al., 2018). The objective is to 134 understand the “how, where, why, and by whom” of an attack. An everyday example of threat 135 modeling is when users install anti -virus in a laptop to protect themselves from hackers gaining 136 access to personal data through malware injection. Another example is when installing a car alarm 137 system to protect it from being stolen by a thief by breaking the windows. Several threat modeling 138 methods such as STRIDE, OCTAVE, PASTA, and VAST have been developed. An overview, along 139 with advantages and limitations, is presented next. 140 STRIDE was invented by Kohnfelder and Garg in 1999 (adopted by Microsoft in 2002) and uses 141 data flow diagrams (DFDs), which include the entities, events, and boundaries of the evaluated 142 system. The acronym STRIDE refers to the threat categories of Spoofing Identity, Tampering with 143 Data, Repudiation, Information Disclosure, Denial of Service (DoS), and Elevation of Privilege. 144 Though it is a mature threat modeling method, it requires an accurate DFD a s input and may not 145 represent all construction scenarios (Mead et al., 2018; Khan et al., 2017; Hernan, 2006). For 146 example, the safety -related threats of incorporating new technologies (e.g., drones) to monitor 147 progress on sites cannot be modeled in this m ethod. 148 Process for Attack Simulation and Threat Analysis (PASTA), is a comprehensive threat modeling 149 framework developed by UcedaVelez (2012). PASTA has seven stages and involves various 150 stakeholders. Though it is comprehensive, it is tedious and requires domain -specific components 151 such as application dependencies and design flaw analysis (UcedaVelez and Morana, 2015). Visual 152 Agile and Simple Threat (VAST) modeling developed by Agarwal (2016) uses the ThreatModeler 153 threat modeling platform. One of the main advantages of PASTA is scalability; it can be 154 implemented in large organizations. However, one of the limitations is that it requires the creation 155 of DFDs and operational threat models as the key steps. Operationally Critical Threat Asset and 156 Vulnerabilit y Evaluation (OCTAVE) suggested by the CERT (Computer Emergency Response 157 Team) in 2003 (and revised in the year 2005) is comprehensive yet flexible (Alberts et al., 2003). It 158 is a risk management approach based on strategic assessment. Only organizational risks are 159 considered, and technology risks are out of scope. In addition, the documentation is complex, which 160 limits its implementation (Deng et al., 2011). The characteristics of the above -discussed methods are 161 summarized in Table I. Shevchenko et al. (2018 ) provide an extensive review of twelve of the most 162 commonly used methods , including the ones discussed above . 163 164 5 Table I. Characteristics of few of the threat modeling approaches 165 Method Characteristics STRIDE Mature but requires accurate data flow diagrams (DFDs) PASTA Comprehensive but requires domain -specific components VAST Scalable but has limited publicly available documentations OCTAVE Flexible but considers only organizational risks 166 Although existing studies and standards are helpful and relevant, they do not correspond to all the 167 life cycle phases of a construction project due to the unique communication structure and 168 corresponding cybersecurity challenges. These studies did not explore the motivation of the different 169 stakeholders — e.g., manufacturers, installers, and facility managers — to tamper with the data or 170 to compromise the sensors to fabricate data to facilitate the certification and commissioning, which 171 is construction -specific. To summarize, the limitations of existing threat modeling methods and 172 standards are, they a) focus only on building systems and data exchange security in the built 173 environment, b) neglect bidding, planning, design, and construction phases, c) are tedious, time - 174 consuming, and might require domain -specific knowledge, d) lack an approach where the 175 construction -related threats, vulnerabilities, attackers and assets are identified and mapped. To 176 address these key research gaps, the objectives of this study are to a) develop a preliminary threat 177 modeling approa ch relevant to construction that can be used by construction stakeholders with 178 minimal security expert involvement, b) show the feasibility of the approach, c) develop illustrative 179 threat models for the life cycle phases of a construction project, and d) c onduct a case study for the 180 commissioning phase concerning the testing and/or certification. 181 III. THREAT MODELING APPROACH - APPLIED TO THE AEC -FM INDUSTRY 182 Any cybersecurity incident in construction can be summarized as follows: an attacker (i.e., people) 183 attempts to influence (i.e., threat) something (i.e., asset) through a weak link (i.e., vulnerability). Fig. 184 1 shows examples of each of these key components in the context of the construction industry. Each 185 of these is explained in the later sections of t his paper. Reflecting on this and taking inspiration from 186 the existing methods outlined earlier, a simplified threat modeling approach is proposed (Fig. 2). The 187 objective is to develop a framework that is comprehensive, flexible, and that requires minimal 188 cybersecurity -domain knowledge and expertise. An overview of the approach and a description of 189 the steps is described below. 190 6 CONSTRUCTION CYBERSECURITYTHREATS Denial -of-Service Functional Modification Data Theft Reading ForgeryPEOPLE Owner Consultant Designer General Contractor Sub-Contractor Manufacturer Distributor Supplier Facility ManagerVULNERABILITIES Supply Chain Complexity Lack of Awareness Negligence Meager Profit Margins Interoperability Socio -Economic Diversity Stakeholders Interests ASSETS Equipment Physical Facility Intellectual Facility Sensor Data Occupants 191 Figure 1. Key components of the construction cybersecurity. 192 Based on the chosen life cycle phase, the critical assets need to be identified. It is important to 193 identify all the critical assets of interest and prominence, which may or may not seem cyber critical. 194 For example, assets with or without any computing devices need to be identified (e.g., workers) . 195 Then, all the cyber -enabled components (e.g., processes, information, and communication exchange) 196 for the identified assets that need cybersecurity investigation or improvement has to be developed. 197 A crucial step in the process is the identification of potential threats based on the identified critical 198 assets. That is, what could go wrong with the assets that might have physical, financial, and 199 psychological (e.g., reputation) impact. Then, 1) brainstorm who would want to cause such harm, 2) 200 how would he /she intends to do that, and 3) what can be done to mitigate it. The first item might be 201 easy to detail; however, the other two might need some help and technical expertise in the area of 202 cybersecurity. To assist the construction stakeholders with this pro cess, some of the significant 203 threats, vulnerabilities, and countermeasures are further discussed below. Each of these steps is 204 detailed in the subsections below in the context of the architecture, engineering, construction, and 205 facility management (AEC -FM) industry. The approach can be as generic or as specific as needed 206 depending on the defined objectives. For example, the objective can be as specific as investigating 207 the cybersecurity implications of introducing a specific technology (e.g., using service robots in 208 buildings) or as general as understanding the cyber awareness of the overall onsite construction 209 procedures (e.g., the impact of IoT on the construction supply chain, construction activities, and 210 operation and maintenance tasks) . 211 EndStartChoose the Life Cycle PhaseIdentify Critical AssetsDetermine Cyber -enabled Components Last PhaseNo YesDetermine Potential Threats Identify Potential AttackersDetermine Possible VulnerabilitiesDevelop Counter Measures 212 Figure 2. Proposed threat modeling approach. 213 7 A. Choose the Life Cycle Phase 214 The project delivery system selected by the owner sets the terms in which parties interact and enter 215 into legal agreements with other parties and used a s mechanisms to shift risk. They have implications 216 in the organization and financing of projects. They affect the interaction and organization of parties 217 during construction, operations, and maintenance services. The most common and established 218 delivery me thod used is Design -Bid-Build (DBB) (Tanko et al., 2018; Ibbs et al., 2003). However, 219 the adoption of lean construction and building information modeling (BIM) in the past few years has 220 favored the use of alternative delivery systems, such as Integrated Pr oject Delivery (IPD), which 221 shifts efforts and responsibilities to the early phases of a project (Bilbo et al., 2015; AIA, 2007). 222 Although the project delivery system will have implications on the organization and involvement of 223 different project participa nts, the main phases of the life cycle of a project are similar. 224 The life cycle of any built infrastructure can be divided into five phases namely a) project initiation, 225 b) design and engineering, c) construction and procurement, d) commissioning, e) opera tion and 226 maintenance, and f) renovation and end of life (Aghimien et al., 2018; Mesároš et al., 2016; Bennett, 227 2007; Ries and Mahdavi, 1999; Oberlender,1993; Hendrickson and Au, 1989). Although these 228 phases are not exhaustive, they offer a general overview of the processes in the life cycle of 229 construction projects. For each phase, key participants, general tools, and equipment used are 230 identified in Fig. 3. Understanding the fundamental construction processes, as well as the different 231 phases, tools, and pa rticipants involved, form the basis for the delineation of the cybersecurity 232 aspects in construction, which are described in the later sections of this paper. For in -depth details 233 regarding each of these different phases and processes, the reader is encour aged to go through the 234 construction management handbooks as the scope of this work is just to provide a general overview 235 (Chudley and Greeno, 2014; Hearl, 2010; Oberlender,1993; Hendrickson and Au, 1989). This will 236 assist in further discussion and analysis regarding identifying different key components of the threat 237 model. 238 B. Identify Critical Assets 239 In a construction project, assets refer to different things such as a physical facility (that is being 240 constructed, monitored, or operated), equipment (e.g., excavators, dozers, and dump trucks), 241 intellectual property (e.g., 3D printer characteristics, des ign, and quality procedure), data 242 (contractual documents, financial records, design, and sensors), as well as human -related assets (e.g., 243 labor, employees, occupants, and visitors). The ultimate goal of most of the construction cyber - 244 attacks is to disrupt, damage, or take undue advantage of one or more of these assets. 245 8 Design & Engineering Project Initiation Renovation & End of Life Operation & MaintenanceCommissioningConstruction & Procurement Software & HardwareParticipants : O, C Software : Feasibility Analysis , Risk Assessment Participants : O, GC, SC Software : Autodesk Revit , GaBi , Energy Plus , ATHENA , BEES , SimaPro Hardware : Forklifts , Excavators , Plasma Cutters , Sensors , Participants : O, FM Software : Building Management Systems , Energy Plus Hardware : Sensors , Smart Meters , Robots , Drones Participants : O, FM Software : Building Management Systems , Energy Plus Hardware : Sensors , Smart Meters , Robots , Drones Participants : D, O, GC, C Software : CAD , Solid Works , Autodesk Revit , CATIA , STAADPro , ANSYS Participants : O, D,GC, SC, SU, M, DI Software : Autodesk Revit , Primavera , VITASCOPE , Hardware : Sensors , Bulldozers , Cranes (Mobile and Fixed ), Dump trucks , Earth movers , Excavators , Concrete Mixers , MEP (Mechanical , Electrical , and Plumbing ) equipment , Robots , Drones , 3D Printers , Sensors , Vibrators C – Consultant ; D – Designer ; DI – Distributor ; FM – Facility Manager ; GC – General Contractor ; M – Manufacturer ; O – Owner ; SC – Sub-Contractors ; SU – Supplier Note : The list of tools / equipment mentioned is not exhaustive 246 Figure 3 . Participants, software, and hardware across different phases in the life cycle of construction 247 projects ( core image adapted from Autodesk , 2016). 248 C. Determine Cyber -Enabled Components 249 The purpose of this step is to develop an activity flow diagram based on the application, objectives, 250 processes, interactions, information, and communication exchange. It can be for the whole 251 construction life cycle to a specific process or application. For example, threat modeling can be done 252 for the design phase, digital fabrication of structural panels, investigating the impact of installing 253 cameras on the construction site, and human -robot interaction durin g operation. Important elements 254 to consider are the applicable and appropriate sequence of activities, the interdependence of 255 activities, information exchange channels, participant interaction, software, hardware, and cyber - 256 enabled devices. In human -robot interaction, applicable elements include robot, people (e.g., labor 257 and engineers), sensors, data collection, exchange, and analysis. 258 D. Determine Potential Threats 259 In the ever -evolving landscape of digital technology, cyber threats have become increasing ly 260 complex. There are several types of cyber threats that could jeopardize the safety or security of 261 construction assets such as ransomware, data breaches, cyber -extortion, phishing, hacking, malware, 262 denial of service, and many more. Some of these terms a re used interchangeably and have 263 overlapping contexts, meanings, and motivations (Tang et al., 2018; Motley and Mas, 2017). For 264 example, someone can introduce malware (e.g., a computer virus) to perform data breach (e.g., steal 265 information) or for ransom ( i.e., demand money or threaten to make data public). Some of the most 266 relevant and increasingly concerning cyber t hreats for the constructio n industry are summarized 267 below. 268 Denial -of-Service: Commonly known as DoS, this refers to the class of threats that aims to render 269 systems or equipment unusable (Tang et al., 2018). In this, an attacker (people) gains control of the 270 system or equipment such as excavators, drones, and building management systems (BMS) and 271 denies access to legitimate users such as contrac tors, owners, and facility managers, respectively. 272 For example, a suspicious vendor can incorporate malicious behavior into the design and production 273 of critical construction equipment to disrupt services during the construction. 274 9 Functional Modification: r efers to the modification of functionality for the system to behave in an 275 unexpected or unintended manner (Tang et al., 2018). An example of such a threat in construction 276 could be over and excessive actuation of owner provided or guaranteed equipment onsit e to degrade 277 performance and claim schedule delays. 278 Reading Forgery: refers to manipulation or deliberate misrepresentation of sensor data to mislead 279 or obtain undue advantage (Tang et al., 2018). For example, untrusted electronic chips and sensing 280 device s could be integrated to produce misleading data and assist in the building commissioning, 281 testing, or certification process. 282 Data Theft: relates to the stealing of any sensitive and confidential information related to IP (e.g., 283 patented technology), peo ple (e.g., employees’ social security numbers), organization (e.g., financial 284 records), equipment (e.g., process parameters), and best practices (e.g., safety and quality). For 285 example, unpatched software systems could be exploited to gain competitive and confidential IP 286 regarding operational procedures (e.g., 3D printer material properties). 287 There can be several motivations for these cyber threats such as ransom, gain power, competition, 288 ideological activism, political, cyberwar, anger, and hatred. It i s not possible to map each of these 289 reasons to a specific type of attacker and threat. For example, an insider or an outsider can perform 290 data theft to obtain ransom money. Similarly, a current employee can make a functional modification 291 to damage the repu tation of a company or obtain approval/ certification 292 E. Identify Potential Attackers 293 These threats occur due to the direct or indirect consequence of peoples’ actions. They can be 294 working within the organization (e.g., employees), on the project (e.g., de signers and consultants), 295 clients (e.g., potential users of the facility), and outsiders (e.g., hackers). Due to the complexity of 296 the construction projects, several people are involved, such as owners, designers, consultants, 297 contractors, subcontractors, suppliers, manufacturers, distributors, and sellers. It is helpful to identify 298 the potential attacker based on the identified threat, motivations, and communication exchange 299 channels. For example, if the threat is compromising the competitive bid data that needs to be placed, 300 an obvious attacker is a potential contractor bidding for the project motivated to learn about 301 competitors' bids and adjust their bid to win the project. 302 F. Determine Potential Vulnerabilities 303 The challenges encountered by construction companies compare to those faced by other industries 304 that are adopting new technologies and are at an advanced level of digitalization. However, some 305 vulnerabilities are specific to the construction sector for the following reasons. 306 Supply Chain Complexit y: A large portion of the construction is usually performed by speciality 307 subcontractors who belong to small and medium -sized enterprises (SMEs). This involvement 308 increases the complexity of construction supply chain networks, which is responsible for the 309 increased cyber -vulnerability of construction processes. In addition, construction is known to have 310 meager profit margins and hence limited dedicated resources to information technology (IT) 311 services. 312 Dynamic workplace and workforce: Unlike other industri es, construction is dynamic with an ever - 313 evolving pace of work, workplace, and workforce. The workplace evolves with the progress of the 314 10 project and the personnel working on the project. For example, before the project begins, the project 315 personnel’s workp lace is an offsite office, as the project starts, part of the personnel is moved to a 316 temporary onsite office (trailer) and eventually, they are part of the project workspace. The ever - 317 changing workforce makes it difficult to educate and train employees of the best cybersecurity 318 practices. This change in the workforce is due to the fragmented nature of construction employees 319 that largely consist s of sub -contracted workforce. 320 Interoperability issues: Due to the complex nature of the projects, information nee ds to be shared 321 among different multidisciplinary teams across various platforms. Subsequently, it does not usually 322 exist a common platform that can be used to access information regarding different trades such as 323 civil, mechanical, and electrical. Thus, e ach of these models cannot be accessed through a central , 324 secure server but needs to be individually shared as separate native files using different software. 325 Some of these problems are addressed when using open BIM (Building Information Model) and 326 CDE (Co mmon Data Environment), but in practice, each party has its own software applications 327 used for design. 328 File Sharing: Due to the interdependencies and involvement of multiple sub -contracted parties, the 329 exchange of confidential and sensitive data may occur outside the company’s network (e.g., using 330 personal computers). In addition, devices used on construction sites may not be validated or 331 monitored by the company. 332 Socio -economic Diversity: Construction workforce includes people belonging to different socio - 333 economic classes, education levels, cultural backgrounds, and geographic locations, which causes 334 varying levels of cybersecurity knowledge, awareness, and understanding. In addition, identifying 335 each employee into distinct categories in order to restrict a ccess to project data is not always a trivial 336 task. 337 Different Stakeholder Interests: Even the smallest of construction projects involve people from 338 different backgrounds, skills, and interests. Ideally, the main goal of everyone is to complete the 339 project successfully. However, there can be multiple conflicting interests of different stakeholders 340 involved. For example, a contractor would like to maximize profits while at the same time, an owner 341 tries to minimize the total budget. Similarly, a structural des igner attempts to revise the specifications 342 as part of a value engineering exercise, which might not best suit the contactor interests due to 343 disruption and delay of initially planned activities. 344 Uniqueness of Projects: Although construction is fragmented with multiple teams involving 345 architects, designers, contractors, consultants, suppliers, manufacturers, workers, engineers, 346 supervisors, and owners, no two projects will have the same teams. Even for two very similar projects 347 (e.g., high -rise residential buildings), the project teams can vary. In the context of cybersecurity, this 348 is a major limitation considering that the cybersecurity policies might differ among each of these 349 participants, and developing a synergy every time with a new set of project te ams is challenging and 350 can have productivity implications. 351 G. Develop Countermeasures 352 Countermeasures are technical or organizational strategies to mitigate or eliminate the identified 353 threats. Multiple countermeasures can be possible for any given threat. The optimal solution can be 354 weighed based on feasibility and economic analysis. On the other hand, countermeasures can be 355 11 reactively mitigated if the specific vulnerability due to which the attack occurred is known. For 356 example, if design data theft occur red due to weak password control, then countermeasures such as 357 educating employees to create stronger passwords and imposing access restrictions can be done to 358 eradicate the threat. However, if the specific vulnerability is unknown, there can be several 359 alternative countermeasures that can be taken based on the existing best practices, standards, and 360 methods. Here, few of the existing standard countermeasures for most of the usual threats 361 encountered, including the ones discussed above. Countermeasures for each of the significant threats 362 mentioned in the determine potential threats subsection previously are briefly described below. 363 A large scale distributed DoS threat is known as DDoS threat, and researchers proposed DDoS 364 Blocking Application (DBA) as one po tential solution for such kind of threats. The idea is to 365 differentiate between normal and malicious traffic through LISP (Location/ ID Separation Protocol) 366 (Farinacci et al., 2013). Randomized checkpointing is suggested as one of the widely known 367 solution s for functional modification and reading forgery related threats (Tang et al., 2018). This is 368 to detect attacks based on frequent but random inspections. Since the attacker has no idea about the 369 checkpoint locations, the attacker just hopes to evade detec tion. Up -to-date software patches 370 (updating the software and antivirus), data encryption (ciphered or coded data which is unable to be 371 deciphered without the decryption key), and cyber deception (deceit of data via dummy records in 372 the database) are some o f the recommended and usual countermeasures for data theft related threats 373 (Ullah et al., 2018). Finally, this process is iteratively performed through all the steps discussed until 374 all the life cycle phases are completed. Below is the illustrative sectio n. An overview of each phase 375 is briefly described, and an example threat model is developed and further discussed. 376 IV. THREAT MODELS FOR DIFFERENT PROJECT LIFE CYCLE PHASES 377 This section presents the flexibility of the proposed approach by developing illust rative threat models 378 for each of the key phases of a construction project. This is done based on an overview of the 379 processes and activities involved. That is, activities, participants, and tools involved in each of the 380 phases are detailed, and the propose d method is applied to develop illustrative threat models. Thus, 381 along the process, it is necessary to determine a few things , such as the sequential order of the 382 activities involved, participants responsible, tools used, and ai m/goals of different activit ies. As 383 previously indicated, for simplicity, the DBB project delivery method is used. The underlying 384 process will still be the same if the variations caused by the adoption of different project delivery 385 systems are to be captured. 386 A. Project Initiation 387 The overall aim of this phase is to determine the feasibility of the project and subsequently define 388 the specific project objectives. Fig. 4 shows a brief list of activities involved in the project initiation 389 phase. Initially, the owner’s team briefly iden tifies the need for the project and subsequently 390 documents a justification. This, in project management terms, is referred to as a business problem or 391 opportunity (Brioso, 2015). After the need is justified, the owner, in conjunction with the consultant, 392 evaluates the technical aspects of the project and prepares preliminary cost estimates to verify the 393 feasibility of the project. For example, factors such as capability, resource availability, geographical 394 constraints, political, and cultural considerations are evaluated and analyzed. At this stage, if the 395 12 team concludes that the project is not feasible, the project will be terminated. If not, different 396 alternatives are examined, and an optimal one is chosen, which best addresses the need for the project 397 (identified during the beginning of the project). 398 Based on the process overview, some of the critical assets during this phase could be project 399 definition (e.g., the world’s tallest tower) and organizational data (e.g., social security numbers). 400 Some of the cyber -enabled components in the process include technical evaluation and project 401 definition. Since the critical asset directly involves dealing with data, the direct potential threat could 402 be a data theft. Given the sensitivity involved, multiple parties such as competing contractors, 403 consultants, and other stakeholders could be interested in obtaining such information to gain undue 404 advantage. 405 EndStartNeed IdentificationNeed JustificationTechnical Evaluation Development of AlternativesOptimal Alternative SelectionProject DefinitionProject Feasibility YesNo 406 Figure 4. Activities involved in the project initiation phase. 407 For example, the concept for constructing the next tallest tower in the world could be of potential 408 interest to many stakeholders and governments all across the world. These individuals or entities 409 usually try to exploit any unsecured network transfers and cloud storage sy stems to obtain such 410 information. To address these issues, some of the potential countermeasures could be to educate 411 employees and conduct frequent audits to verify the security of the systems and network involved. 412 This threat model is shown in the form of a table in Table II. 413 414 Table II. Significant Threat Modeling Aspects involved in the initiation phase 415 Critical Assets Potential Threats Potential Attackers Potential Vulnerabilities Countermeasures Project definition Organizational data Data theft Consultant Contractor/subs Employees Owner Unsecured network transfer Unsecured cloud storage applications Educate employees Conduct frequent audits 416 B. Design & Engineering 417 After defining the project, the design and/or construction team is chosen by the owner with possible 418 recommendations of the consultant. This selection could be made by issuing a request for proposals 419 followed by a competitive bidding process or other selection methods (e.g., direct appointment). 420 Based on the identified project objectiv es, designers put together preliminary designs. Then, cost 421 estimates and baseline schedules are provided to the owner by the design team for the final approv al 422 of the design. Several value -engineering and brainstorming sessions are typically done before th e 423 owner finally approves the design to meet quality, budget, and time constraints. The final design is 424 submitted to the local authority to obtain the required approvals and construction permits in order to 425 start with the construction of the facility. Once the design is completed , and permits are obtained, a 426 13 contractor is chosen by the owner. The selection could be made through a competitive bidding 427 process (from a request for bids) or other selection methods (e.g., direct appointment). Fig. 5 shows 428 a simpli fied version of the activities involved in this phase. 429 EndStartTeam SelectionPreliminary DesignDetailed Design Cost & Schedule EstimationOwner ApprovalPermits & Authority Approval 430 Figure 5. Activities involved in the des ign and engineering phase. 431 An example of the critical asset during this phase is the proprietary information regarding the 432 operational procedures (e.g., in -situ fabrication or mass printing of customized elements) suggested 433 and/or submitted by the contractor during the initial team selection or cost and schedule estimation. 434 The threat is that this could be stolen or made public (i.e., threat) due to potential unpatched or 435 outdated software systems (i.e., vulnerability). For example, consultants or designers could directly 436 gain access to such information since they are working on the project and could have intentions to 437 use this information on other similar projects. To address this, all the software systems need to be 438 periodically checked to ensure they are up-to-date. In addition, su fficient access control protocols 439 could also be imposed, such as hierarchical (e.g., certain individuals have only access to a particular 440 level detail) and temporally restricted access (e.g., access permission is only for a particular period). 441 The key elem ents are summarized in Table II I. 442 443 Table III. Significant Threat Modeling aspects involved in the design and engineering phase 444 Critical Assets Potential Threats Potential Attackers Potential Vulnerabilities Countermeasures Proprietary information (PI) PI stolen Consultant Designer Unpatched software Up-to-date software patches C. Construction & Procurement 445 This phase refers to the actual implementation of the project. A simplified representation of the 446 activities involved in this phase is shown in Fig. 6. In this phase, the main party is the general 447 contractor (and subcontractors). Initially, resources such as manpower, material, and equipment are 448 procured and/or transported to the construction site. This process is commonly termed as 449 mobilization in the construction industry. With the help of these resources, construction activities 450 are performed. Main const ruction tasks can be broadly classified as the construction of structural 451 core (e.g., slabs, columns, beams), MEP (mechanical, electrical, and plumbing systems such as 452 heating, cooling, ventilation, lighting, water, and drainage pipes), and finishing (e.g. , exterior: 453 roofing, façade, curtain wall, windows; interior: insulation, plastering, and painting). The process of 454 constructing a structural core includes excavation (i.e., breaking the ground), foundation (lowest part 455 of the facility which transfers the load from the structure to the soil safely), and structural core, also 456 known as the structural shell. Then, mechanical, electrical, and plumbing (MEP) works such as 457 laying sewer pipes, installing ducts for ventilation, and electrical wires for lighting are performed. 458 14 Finally, the structural core on the outside and the inside are enclosed with the help of activities such 459 as plastering, cladding, painting, and flooring commonly referred to as finishing works. 460 EndStartMobilization Excavation Foundation Structural Core MEPInsulation & Finishing 461 Figure 6. Activities involved in the construction and procurement phase. 462 Table IV shows one example of a threat model for this phase. Productivity is arguably one of the 463 very important aspects of this phase. One of the critical assets during this, which has signific ant 464 implications on productivity, is the equipment such as excavator, dump truck, and tower crane. 465 Sometimes it is possible that the owner supplies the equipment to the contractor to perform certain 466 construction operations. Contracts (i.e., attacker) might intend to overuse the equipment (i.e., 467 vulnerability) to directly or indirectly lower the performance (i.e., Threat) in an aim to claim or 468 justify project delays. Alternatively, malicious outsiders (i.e., attackers) can introduce fabricated 469 chips (vulnera bility) during the procurement process (i.e., cyber -enabled process) to cause physical 470 damage (i.e., Threat) to workers (i.e., asset) at the time of construction. These can be potentially 471 addressed by having equipment logs and conducting company audits. 472 473 Table IV. Significant Threat Modeling Aspects Involved in the construction and procurement phase 474 Critical Assets Potential Threats Potential Attackers Potential Vulnerabilities Countermeasures Equipment Performance degradation Physical damage Contractor/subs Malicious outsider Excessive usage Fabricated chips Regular equipment log check and audits D. Commissioning 475 Before transfer to the owner and occupancy or use of the finished building, the installed building 476 systems and equipment need to be commissioned. Summary of activities involved in such a process 477 is shown in Fig. 7. Commissioning is the process of bringing something newly produced into 478 working condition. It involves the verification of all the building systems (e.g., security controls, 479 mechanical, electrical, and plumbing systems) to meet the desired design, quality, and safety 480 standards and ensure proper performance in accordance with manufacturers’ requirements to warrant 481 their products. It is the responsibility of the respective cont ractors to ensure that the optimal desired 482 functionality is achieved. To verify this, the owner usually hires an independent commissioning 483 agent to oversee this process. The commissioning agent works closely with the contractor to address 484 any identified is sues during the verification process. Finally, a granting authority (e.g., government 485 or private certified agencies) analyzes the performance of the different building systems before a 486 certificate of occupancy is issued. This is done to certify the conform ance and compliance of building 487 systems in accordance with the building codes, laws, and local authority regulations, which 488 essentially means that the building condition is suitable for occupancy or respective functional use 489 according to a given rating. 490 15 EndStartOwner hires commissioning agency (CA)CA inspection and review Contractor modifications / improvementsContractor provides necessary inputNoYesAcceptable Performance 491 Figure 7. Activities involved in the commissioning phase. 492 As can be noted from the description of the process, the acceptable performance of the asset is one 493 of the critical elements and is the focus of the example threat model, as shown in Table V. Most of 494 the modern buildings rely on the data from building management or automation systems (BMS/ 495 BAS) (i.e., critical asset) to facilitate the certification process. Owners and/or contractors (i.e., 496 attackers) during the review proce ss (i.e., cyber -enabled process) can tamper or modify the sensor 497 data (i.e., vulnerability) to expedite this process and obtain occupancy certificate. 498 499 Table V . Significant threat modeling aspects involved in the commissioning phase 500 Critical Assets Potential Threats Potential Attackers Potential Vulnerabilities Countermeasures Building Management Systems (BMS) Data tampering Actuation tampering Owner Contractor Consultant Employee Outsider Dashboard compromised Sensor compromised Randomized checkpointing E. Operation & Maintenance 501 Although every facility undergoes commissioning process initially, continuous maintenance is 502 necessary because the performance of the systems degrade over time, there might be a change in 503 functional use, and there can be unanticipated faults due to excessive or inadequate use (Heo et al., 504 2012). To address this, these systems need to be continuously monitored and maintained. The facility 505 manager who usually belongs to the owner’s team is responsible for this. The pr eliminary monitoring 506 is typically done with the help of manual inspections. The aim of manual inspections is to identify 507 the overall appeared physical condition of the facility and the different building systems and 508 equipment. If the preliminary physical c ondition assessment fails, further analysis is performed with 509 the help of monitored sensor data. Then, a maintenance program is made based on the analysis of 510 the results. If maintenance is required, the objectives need to be determined, and cost -benefit an alysis 511 has to be performed before proceeding with the execution of the maintenance activities. This process 512 is iteratively performed until the end of the functional use of the facility (or system/equipment). A 513 simplified representation of the activities in volved in this phase is shown in Fig. 8. 514 515 16 EndStartContinuous MonitoringPhysical AssessmentObjectives YesNeed Maintenan ce Cost Benefit AnalysisExecutionFunctional Use EndYesNo No 516 Figure 8. Activities involved in the operation and maintenance phase. 517 Table VI shows an example threat model that could potentially impact the physical asset or the occupants 518 using the asset (i.e., critical asset). This could be done by malicious outsiders or external suppliers (i.e., 519 attackers) through activities such as actuation tampering and chip insertion during the fabrication process 520 (i.e., vulnerability) with an intent to spy an d cause deliberate destruction (threat). 521 522 Table VI. Significant Threat Modeling Aspects Involved in the operation and maintenance phase 523 Critical Assets Potential Threats Potential Attackers Potential Vulnerabilities Countermeasures Physical a sset Occupants Spying Deliberate destruction Malicious outsiders External suppliers Chip insertion Use low -tech sweeping devices F. Renovation & End of Life 524 If either the functional use reaches an end or the condition of the facility deteriorates to an extent 525 where maintenance cannot suffice, repair, renovation, and demolition of the facility, or replacement 526 of equipment need to be done. For this discussion, renovation refers to major maintenance where 527 structural core needs to be removed or altered significantl y. Initially, the renovation objectives need 528 to be determined, and multiple alternatives are generated based on life cycle cost (LCC) and 529 environmental impact assessments. Depending on the objective (e.g., minimize cost), an optimal 530 option is chosen. In th e process, a lot of waste is generated and needs to be optimized. The process 531 flow is shown in Fig. 9. 532 EndStartRenovation ObjectivesLCCA ExecutionWaste ManagementNo Demolition Yes Optimal Decision 533 Figure 9. Activities involved in the renovation and end of life phase. 534 A common activity of waste management is the disposal of sensors or equipment without completely 535 erasing the data (i.e., vulnerability). Malicious outsiders (i.e., attackers) obtain such equipment and 536 reverse engineer the data/information (i.e., threat) regarding the facility, credentials, and other 537 sensitiv e information (i.e., asset) that was either stored, accessed, or transmitted. The corresponding 538 threat model is shown in Table VII. 539 540 17 Table VII. Significant Threat Modeling Aspects Involved in the renovation and end of life phase 541 Critical Assets Potential Threats Potential Attackers Potential Vulnerabilities Countermeasures Physical a sset Data retrieval Outsiders Others Disposed sensors and equipment Remove/destroy hardware before disposal V. CASE STUDY 542 The objective of this case study is to analyze the threat model developed for the commissioning 543 phase based on the proposed methodology and discuss a potential countermeasure. In addition to the 544 discussion of the commissioning process (Fig. 7), inspection and review is a critical cyber -enabled 545 process because of the use of sensors, data acquisition, verification, and approval. The 546 commissioning agent verifies the conformance of all the building systems (e.g., building 547 management systems, security controls, mechanical, and plumbing systems) to meet the desired 548 design, quality, safety, and local code standards. This is done by monitoring the performance data of 549 building systems, ambient indoor data, and outdoor parameters. The respective contractors and 550 owners are responsible for ensuring that the desired functionality is achieved. This data is typically 551 collected in the buildings (i.e., facility) using stationary sensor network systems containing wired 552 and wireless sensors. Although many studies proposed frameworks and methodologies to develop 553 such sensor and data collection networks, cybersecurity implications, and related challenges, have 554 not been considered. 555 Fig. 10 shows an overview of the tas ks involved in the inspection review process conducted by the 556 commissioning agent. Initially, sensors gather information from the physical facility. Sensors 557 measure different parameters, such as temperature, humidity, occupancy, and light intensity. This 558 data is represented as dashboards developed by the manufacturers of the sensors. In parallel, 559 controllers gather this data from sensors and determine the responses that are sent to the actuators to 560 implement the controller actions. 561 A. Randomized Checkpointi ng Using Robots to Secure the Data Validation Process 562 Commissioning agent s rely on the data provided by the owner or the contractor as they usually lack 563 the time and resources to cross -verify the sensor data provided to them. However, due to motivating 564 reasons for the facility owners and sensor network contractors, the data could be tampered at the 565 sensor (by compromising the sensor) or at the display (by compromising the dashboard) or when the 566 sensor data is in transit. A malicious owner or a rogue contrac tor could do this to obtain the 567 certification faster and without fixing the violations. Alternatively, an employee in either entity could 568 do this to damage their reputations. A malicious outsider could do this to gain control of the facility 569 operations and demand ransom to restore normal functionality. The tampering could happen in 570 different ways. For instance, the sensor hardware is compromised to output data that does not 571 represent the actual sensed value, or the dashboard is compromised where the sensor outputs are 572 incorrectly shown. 573 18 EndStartReal Facility Sensors ControllersActuators / OutputDashboard 574 Figure 10. Sample process for the inspection and review by the commissioning agent. 575 To address this issue and detect faulty or rogue sensors or deter a rogue insider, we propose a 576 randomized sensor check -pointing as a countermeasure. For this, we developed an autonomous 577 multi -sensor fusing mobile robotic data collector. This will address the cybersecurity challenges 578 during the onsite data collection and verification process. Sensors on the rob ot are trustworthy 579 compared to the sensors installed in the facility. We propose to cross -check and verify the different 580 parameters such as temperature, humidity, indoor air quality, light intensity, and occupancy gathered 581 by the building management or aut omation system (BMS or BAS) by this trustworthy third -party 582 robotic data collector. For details regarding the technical aspects of such a robotic data collector, 583 refer to Mantha and Garcia de Soto, (2019b) and Mantha et al., (2018). An overview of the onsi te 584 functional testing process, including the mobile robotic system, is shown in Fig. 11. Fig. 12 shows 585 the multi -sensor mobile robotic platform. 586 B. Verification and Validation 587 To verify and validate the robotic randomized data collection and check -pointing , we consider an 588 example floor plan with fixed sensors (i.e., the location of the BMS sensors is fixed). The objective 589 is to identify potential rogue sensors within the fixed stationary sensor network system. To achieve 590 this, the robot needs to visit all l ocations, gather time -stamped data, and cross -verify it with the BMS 591 data. For the purpose of this study, an intricate indoor building environment consisting of a stationary 592 sensor network is considered. The graphical network representation of an indoor fl oor plan with 25 593 nodes and 34 edges is shown in Fig. 13. As can be seen, the considered floor plan is not symmetric 594 and considerably large. 595 EndStartReal Facility Markers Mobile Robot Sensor Output Sensors 596 Figure 11. On-site review tests with the help of an autonomous mobile indoor robot. 597 19 598 Figure 12. Mobile robotic platform with sensors. 599 600 601 Figure 13. Graph network of an example floor plan with 25 nodes and 34 edges. 602 1) SCENARIO 1: COVER AL L EDGES (CHECK -POINT ING ALL THE SENSORS) 603 Ideally, this is a problem of finding a path for the robot to cover all these sensor locations. This is 604 usually achieved by first converting the existing built environment into a graphical network where 605 the nodes represent the locations in the building, and the edges represent the physical links (e.g., 606 corridors and stairs) connecting the nodes. Further details regarding converting building floor plans 607 into a graphical network can be found in Mantha et al., 2019 and Mantha et al., 2018. Then, the 608 graphical network is solved to determine an optimal path covering all th e edges in the network so 609 that the rogue sensor is not missed. Multiple paths are possible, and the most optimal path can be 610 determined using existing algorithms (Ahr and Reinelt, 2006; Nobert and Picard, 1996). This is a 611 classic al Chinese Postman Problem (CPP) in graph network theory. 612 Given any start node, a path to visit all the edges in the network and return to the same node can 613 be determined. In this example, if the start node is 1, the most optimized (i.e., shortest in this case) 614 path to visit all th e edges and return to node 1 is 1  3  4  8  7  11  12  8  12  11 615  14  15  13  9  10  6  7  3  2  6  5  9  5  6  2  1. Hence, if the 616 rogue sensor is located at the visited nodes or edges, it can be checked by verifying the data from the 617 rogue sensor with the sensor on the robot. So, in this situation, even if the attacker knows the map of 618 the robot, the rogue sensor can be detected. 619 620 20 2) SCENARIO 2: PARTI AL EDGE COVERAGE (RA NDOMIZED CHECK -POINT ING) 621 Given a full CPP tour, the attacker can undermine it. That is, it is possible for the attacker to possibly 622 have prior knowledge of the tour and tamper the sensors accordingly to report the correct results. To 623 thwart such a coordinated response, a randomize d tour can be adopted by the mobile check -pointing 624 robot. Starting at a particular node, the next edge to be covered or the node to be visited is randomly 625 determined. In this scenario, the robot need not (or is unable to) cover all the edges in the network 626 because of time and distance constraints. For example, the robot can travel a certain distance due to 627 battery restrictions (i.e., battery -informed distance constraint). Cybersecurity studies have shown 628 that this randomness in the verification process crea tes uncertainty for the rogue attacker and 629 improves the cybersecurity of a process (Casey et al., 2014). Thus, the objective is to determine 630 random paths with the help of existing algorithms and heuristics such that most of the edges are 631 covered with a max imum distance constraint. 632 One approach is as follows. Initially, periphery nodes at the farther end of the graph network 633 generated are identified. All simple paths (ASP) between different permutations and combinations 634 of these periphery nodes are estimate d. Simple paths are the paths that start at a particular node 635 (source) and end at a destination node without repeating any nodes in between (Black, 2017). Each 636 path can be considered as a random path starting from the source node to the destination node. 637 3) RESULTS AND DISCUS SION 638 Table VI II shows the results of scenario – 1 and 2 on the network shown in Fig. 13, considering the 639 position of the rogue sensor located at the edge 14 → 15. For Scenario 1, the optimal route to visit 640 all the edges in the network t akes 169 units. Since the robot covers all the edges in the network, the 641 rogue sensor will always be detected when comparing the sensors in the network and on the robot. 642 Though this is ideal and preferred, this might not always be possible because of batte ry constraints. 643 For example, what if the robot can only travel 100 units in a single charge? To address this issue, 644 only part of the edges can be traversed, and the rest of the results and analysis show a systematic 645 approach to identify a near -optimal solu tion. The periphery nodes for this network are 1, 2, 4, 23, 646 and 24. The average path distance and the unique number of edges are an average for all the simple 647 paths generated for that combination of the periphery nodes. For example, for the periphery node 648 pair of 1 and 23, the total number of paths generated was 348. Path distance, number of unique edges, 649 and a binary variable for the presence of the edge (14  15) is stored. The average of all the distances 650 came out to 52.1, the number of unique edges to 13.9, and in 156 out of 348 instances , the edge 14 651  15 was present in the paths generated. Thus, the probability of detecting (P(d)) rogue sensor is 652 the number of instances the edge with the rogue sensor present is divided by the total number of 653 simple pa ths generated (156/348 =0.45). This is mathematically represented in the form of a fraction 654 and shown in Equation 1 . As can be seen, with about 45% (i.e., 0.45) probability, the rogue sensor 655 can be detected with this approach except for combinations includ ing node 4 (i.e., 4, 23 , and 4, 24). 656 In general, the less probability might be due to the low number of unique edges. 657 658 𝑃(𝑑)=𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑠𝑒𝑛𝑠𝑜𝑟 𝑑𝑒𝑡𝑒𝑐𝑡𝑒𝑑 𝑝𝑎𝑡ℎ𝑠 𝑡𝑜𝑡𝑎𝑙 𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑝𝑎𝑡ℎ𝑠 Eq. (1) 659 21 Table VIII. Likelihood of rogue sensor’s detection with f ull and partial paths 660 Description Average path distance Average # of unique edges 𝑷(𝒅) CPP 169.0 34.0 1.00 ASP (b/w 1 - 23) 52.1 13.9 0.45 ASP (b/w 1 - 24) 52.1 13.9 0.45 ASP (b/w 2 - 23) 51.6 13.8 0.44 ASP (b/w 2 - 24) 51.6 13.8 0.44 ASP (b/w 4 - 23) 48.8 13.8 0.27 ASP (b/w 4 - 24) 48.7 13.8 0.27 To improve this, additional heuristics or constraints such as the number of unique edges to be 661 traversed are imposed. Since the average number of unique edges was 14 in the original analysis 662 above, we increased it to 17 for discussion and analysis. Table VIII shows the results after imposing 663 the number of unique edges constraints. A path is feasible if there exist at least 17 edges that are 664 unique, and the total distance of the path does not exceed 100 units. The results are summarized in 665 Table IX. Contrar y to expectations, the probability of detection was reduced. For example, a 666 combination of node pairs (2,23) yielded the worst results with the probability of detection reducing 667 from 0.45  0.09. This could occur because the algorithm optimizes the total d istance traveled by 668 the robot and does not take into consideration the number of edges traversed along the way. 669 670 Table IX. Likelihood of detecting the rogue sensor when the average number of unique edges is 17 and 671 the maximum distance constraint is 100 uni ts. 672 Description Average path distance Average # of unique edges 𝑷(𝒅) 1 – 23 73.6 17.4 0.20 1 – 24 65.6 17.5 0.27 2 – 23 61.2 17.3 0.09 2 – 24 62.9 17.4 0.14 4 – 23 58.0 17.3 0.13 4 – 24 59.3 17.3 0.17 673 To investigate this further, a minimum distance constraint was imposed. The objective of this 674 scenario is not to optimize the total distance but maximize the number of edges covered while 675 visiting as many edges as possible. By imposing this minimum distance constraint, indirectly, a 676 minimum number of e dges to be covered by the robot is imposed. Further to the results shown in 677 Table IX , a minimum distance con straint of 65 units was imposed. The results are shown in Table 678 X. The probabilities (of detection) increased for all the case s compared to that of Table IX (maximum 679 and unique edge constraint). This holds true when compared with the results from Table VII I 680 (maximum distance constraint only) with two exceptions for the node pairs (2,23) and (2,24) where 681 the probabilities were slightly reduced. However , note that the probability of detection significantly 682 increased for the node pairs (4,23) and (4,24) from 0.27 to 1.0 , implying the rogue sensor was 683 detected in all the random paths. It can thus be concluded that maximizing the number of unique 684 edges visi ted along with distance constraints produces the best results for the network considered for 685 22 randomized check -pointing of the robot. This is because the objective is to maximize the number of 686 edges covered while at the same time consider real -world constra ints (e.g., robot battery distance). 687 688 Table X. Likelihood of rogue sensor’s detection with an average number of unique edges as 17 and 689 maximum (100) and minimum (65) distance constraints. 690 Description Average path distance Average # of unique edges 𝑷(𝒅) 1 - 23 72.1 17.6 0.57 1 - 24 74.3 17.7 0.65 2- 23 68.0 17.7 0.33 2 - 24 70.3 17.8 0.38 4 - 23 80.0 17.4 1.00 4 - 24 80.3 17.5 1.00 VI. CONCLUSIONS 691 Several cyberattacks have already occurred in the AEC -FM industry with an intention to steal 692 proprietary information, gain access to unauthorized files, and tamper existing records. With the 693 proliferation of construction digitalization, cyberattacks will be on the rise. Construction 694 professionals need to be able to identify and understand the fundamentals of these cyberattacks. This 695 paper presents a preliminary threat modeling framework that can be used by construction experts 696 with limited to no expertise in cybersecurity to determine some of the key cybersecurity components 697 such as assets, attackers, threats, motivations, vulnerabilities, and countermeasures of construction 698 activity or process. This is illustrated with the help of a building commissioning process. An on - 699 demand autonomous mobile robotic data collection and validation approach is proposed to add ress 700 the cybersecurity challenges faced during the testing process. The proposed approach has the 701 capability to assist granting authorities (e.g., government or a third party) to validate the BMS data 702 and possibly identify rogue sensors (e.g., tampered, ma nipulated, or improperly calibrated) during 703 the testing process. Future work aims to test the proposed threat modeling framework for other 704 construction phases such as construction, procurement, and operation and maintenance. 705 ACKNOWLEDGMENT 706 The authors woul d like to thank the support from the Center for Cyber Security (CCS) at New 707 York University Abu Dhabi (NYUAD). 708