This paper presents a novel approach using game theory to assess the risk likelihood in manufacturing systems quantifiably . Cybersecurity is a pressing issue in the manufacturing sector. Nevertheless, managing the risk in cybersecurity has become a critical challenge for modern manufacturing enterprises. In risk management thinking, the first step is to identify the risk, then validate it, and lastly, consider responses to the risk. If the risk is below the security risk appetite of the manufacturing system, it c ould be accepted. However, if it is above the risk appetite, the system should appropriate ly respond by either avoiding, transferri ng, or mitigating the risk. The validation of the risk in terms of severity and likelihood of the threat, however, is challenging be cause the later component is hard to quantify. In this paper , Failure Modes and Effects Analysis (FMEA) method is modified b y employing game theory to quantitatively assess the likelihood of cyber -physical security risks. This method utilizes the game theory approach by modeling the rivalry between the attacker and the system as a game and then try to analyze it to find the lik elihood of the attacker’s action. We first define players of the game, action sets, and the utility function. Major concerns of cyber security issues in the manufacturing area are carefully considered in defining the cost function composed of defense poli cy, loss in production, and recovery. A linear optimization model is utilized to find a mixed -strategy Nash Equilibr ium, which is the probability of choosing any action by the attacker also known as the likelihood of an attack. Numerical ex periments are presented to further illustrate the method. Forecasting the attacker’s behavior enables us to assess the cybersecurity risk in a manufacturing system and thereby be more prepared with plans of proper responses. © 2018 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY -NC-ND license (https://creativecommons.org/licenses/by -nc-nd/4.0/ ) Peer-review under responsibility of the scientific committee of the 28th Flexible Automation and Intelligent Manufacturing (FAIM2018) Conference. Keywords: Game Theory ; Cybersecurity in Manufacturing ; Risk Assessment ; 2 Author name / Procedia Manufacturing 00 (2019) 000–000 1. Introduction New technological advances in manufacturing system s, such as industry 4.0 [1], cloud manufacturing [2], and real- time service composition [3,4] has opened a new horizon for the manufacturing wo rld. However, the integration of the cyber systems with the traditional physical manufacturing expose s these system s to a new type of risks that was unknown beforehand [5,6] . Even though most of these threats are not unique for manufacturing systems, the immaturity of manufacturing systems towards cybersecurity in comparison with other sectors such as banking and utility is made the effort sensitive . Several incidents in the past decade showed the devastating impact that cybersecurity threat could cause to manufacturing systems [7]. National Institute of Standards and Technology (NIST) [8] developed a cybersecurity framework to reduce cybersecurity risk for manufacturers. This framework consists of identify , protect, detect, respond, and recover. The first step on this proced ure is to identify and assess the risks in manufacturing systems that can be done by standard procedure s such as ISO 27000 [9] which is the application of Failure Modes and Effects Analysis (FMEA) techn iques to the analysis of information security risks . Inspiring form general FMEA method and ISO27k in this paper identified risks are assessed by calculating cybersecurity criticality number s (CSCN ), which is the product of severity and likelihood of occurrence. If the calculated number for each risk is below the risk appetite (i.e., the acceptable risk limit ) of the system , it could be accepted. However, if the number is above the risk appetite, it should be appropriately responded by either avoiding, tra nsferring or mitigating the risk . Nevertheless , the challenge here is to determine the second component to calculate the CSCN when there is no prior experience for specific risk in a system. Moreover, a nother problem associat ed with this method is ignoring the fact that the relation between the attacker and the system is not a static interaction and the attacker will respond to the new strategy of the system, which was chosen based on FMEA assessment , accord ingly. Unlike the general failures in mechanical systems, the cause of cybersecurity failures could vary for different situation since they incorporate with human contributors. So it is necessary to consider the dynamic interaction of the attacker and the system when calculat ing the likelihood of occurrence. This paper propose s a novel approach to provide manufacturing system insight into their potential cybersecurity risks through utilizing game theory approach. The interaction of the attacker and the system will be assumed as a game in which each player intend to increase their gain fr om the game and hence each player react to the opponent’s strategy accordingly. In this method , the strategy of the attacker in the long run , Nash eq uilibrium, will be considered as the likelihood of a risk , which enables us to manage risks quantitatively . The rest of the paper is organized as follow. In section 2, related work in the field of vulnerability and risk assessment in manufacturing systems is reviewed. Section 3 discusses the proposed method by elaborating the theory to quantify the risk, formation of the game and the method to analyze it. Section 4 presents a numerical example to further illustrate the propose d method. In section 5, the res ults of the case study are discussed , and finally , section 6 conclude s the paper and provide s suggestion s for future works. 2. Literature review Unlike the other sector s such as utility [10], transportation [11], and healthcare [12,13] , manufacturing systems are not mat ure enough towards the cybersecurity threats. There exists only limited research in the field of cybersecurity risk assessment in manufacturing systems. Desmit et al. [14] proposed a systematic approach to identify cyber -physical vulnerabilities in intelligent manufacturing systems using intersection mapping to identify vulnerabilities and then analyzing the impact of cyber -physical vulnerability with decision trees . Hutchins et al. [15] establish a framework that provides a mechanism for identifying generic and manufacturing -specific vulnerabilities considering data flows within a manufacturing system and its supply chain. To quantifiably measure the consequences of cyber -attack on a manu facturing enterprise, Prabhu et al. [16] develop two essential metrics, Damage Index (DI) and Vulnerabi lity Index (VI). Moreover, Zarreh et al. [17,18] assume the interaction of attacker and manufacturing enterprise as a game and proposed a framework to assess the repercussions of a cyber -physical thereat and choose a proper method to defend. Utilizing the same mindset, Bracho et al. [19,20] introduces a simulation -based model to assess the consequences of manufacturing systems’ performance under the presence of cybersecurity risks. Author name / Procedia Manufacturing 00 (2018) 000–000 3 Because of the increasing popularity of additive manufacturing, several research es concentrate on vulnerabilities of this domain and try to suggest some countermeasures to mitigate the attacks. Zeltmann et al. [21] highlight the risk of alteration of direction in 3D printing on the mechanical behavior of a specimen as a result of a cyber -attack. Padmanabhan and Zhang [22] propose a different framework to assess cybersecurity vulnerabilities in additive manufacturing using the metrics, namely, loss of inf ormation, inconsistency, relative frequency, lack of maturity and time until detection for each stage of the process . Other researches try to recommend defense policies to enhance the security of manufacturing systems. Wu et al. [23] establish a cyber manufacturing system testbed to enable simulation and data collection for investig ating cyber manufacturing security. Li et al. [24] propose a cloud -based system to share knowledge for injection mold redesign (IMR) . They utilize blockchain technology to securely implement standards and protocols. Vincent et al. [25] recommend a product/process design approach to detect attacks in real -time to compensate for the shortcomings of quality control systems in cyber -physical manufacturing systems. 3. Model 3.1. Quantifying risks To quantifiably assess risks in a system , a method similar to the failure mode and effective analysis (FMEA) in the manufacturing system is employed . In this method cybersec urity criticality number (CSCN ) is considered to decide if a risk is critical and should be responded to adequate ly. As equation (1) shows, cybersecurity criticality number (CSCN ) depends on two elements, severity of the risk if it happens and the likeliho od of occurrence of this risk. In this method, the risk is a severe threat when CSCN is high meaning both the severity and the likelihood of occurren ce of risk is relatively high , and the system needs to respond as its first priority. On the second priority when CSCN is low while the severity is high the risk should get attention since the consequence of the risk is high. On the next priority, the system could respond to those risk with low CSCN with low severity and high likelihood. At last, risks with low CSCN while both severity and likelihood are low needs no attention. ( ) ( ) CSCN Severity S Likelihood L (1) The severity of risk is assigned a numerical value between 1 and 10 based on criteria in Table 1, where 10 is the most severe threat , and 1 is for a threat with no consequences and effects. The table is proposed based on ISO27k , and it could be customized based on the needs and concern of a manufacturing enterprise. Table 1. Severity Table Severity Effect Description Severity Effect Description 10 Catastrophic Irreversible damage to manufacturing enterprise or its reputation 5 Low Disruption of production, Major violations of process 9 Extreme The manufacturing system negatively affected , likely to reverse back to the original value in over 5 days 4 Very Low Disruption of production, Major violations of procedures 8 Very High The manufacturing system negatively affected , likely to reverse back to the original value between 3-5 days 3 Minor Disruption of production, Minor violations of policies 7 High The manufacturing system negatively affected , likely to reverse back to the original value between 1-3 days 2 Very Minor Minor violation of procedures, production continuity not affected 6 Moderate The manufacturing system negatively affected , likely to reverse back to the original value within 1 day 1 None No effect whatsoever Similarly, the likelihood of occurrence can be assigned from a range of 1 to 10 listed in Table 2 in which the 10 is for a threat with probability of occurrence higher than 90% and 1 is for one with probability of occurrence less than 4 Author name / Procedia Manufacturing 00 (2019) 000–000 10%. For FMEA, t his probability typically comes from past experience s of the system or related systems. However, for cybersecurity, often there is a lack of relevant prior experiences. In some cases, it may not be appropriate to generalize similar incident to calculate the probabilities because of dissimilarity in the background of the incidents in different systems . Furthermore , data collection is a challenging effort in its nature , especially in th e case of cybersecurity since many companies try to hide their vulnerabilities and incide nts on their system to prevent harm to their reputation. To overcome this challenge , this paper recommends utilizing game theory approach to forecast the likelihood of attacks and use the attacker ’s strategy (in the form of probability) to quantitatively assign t he likelihood of occurrence in risk management thinking. Table 2. Likelihood of occurrence Occurrence Description Occurrence Description 10 Likely to occur in 90 -100% of experiences 5 Likely to occur in 40 -50% of experie nces 9 Likely to occur in 80 -90% of experiences 4 Likely to occur in 30 -40% of experiences 8 Likely to occur in 70 -80% of experiences 3 Likely to occur in 20 -30% of experiences 7 Likely to occur in 60 -70% of experiences 2 Likely to occur in 10 -20% of experiences 6 Likely to occur in 50 -60% of experiences 1 Likely to occur in 0 -10% of experiences 3.2. Game Formation To predict the attackers’ behavior through the game theory approach, first ly the main tenets of the game should be identified and then by analyzing it the probability of attacker’ s actions named strategy of attackers could be found . The three primary tenants of a game are players, actions and a reward function. The formation of th e game in this paper is based on published work [17,18 ], where more information about this game theory approach in cyber security of manufacturing systems can be found . The first element of the game is to identify the player s of the game , in this paper the game is considered to be a two player game, i.e., attacker and defender. The attacker could be single hacker, group of hackers, terrorist group or unfriend ly government. On the other side, there will be a defender which in this paper is a manufacturing system that attempts to minimize the damage to its s ystem through playing the game optimally. The second element of the game is an action set for each player. On the attacker side, any vulnerability or weaknesses in the system can be exploited by the attacker. For the defender, any possible defense mechanis m to prevent, minimize or mitigate an attack action will be considered as an action for the defender. Lastly, the third element of the game is the utility function for a manufacturing system . The function includes: (1) cost of maintaining a security policy which is the cost to keep the defense system up and running , (2) direct and indirect costs of production losses , and (3) cost of recovery incurred by the amount of time, effort and money paid to bring back the system to its safe initial running state. The utility (reward) function of the two -player game is formulated by an n×m matrix where n is the number of actions by attackers and m is the number of action s by the defender , as shown below [18]: 11 1 , 1 1 , ,, , , ,m a d s s e T p e r e a da a a k l d a d a d a d a d k lk k k l k l k l k l k l nm nm                 (2) 3.3. Analysis of the Game There are number s of ways to analyze such a model as a game such as linear programming, Markov decision processes (MDP) , quantal respond equilibrium (QRE), minimax -Q, and Q-learning . Regardless of the analyzing method , the main goal is to find the strategy of the attacker which is the key to quantify the likelihood of occurrence and calculate CSCN. Based on the definition, Strategy of a player is a set of probabilities of u tilizing any action in action set for any players , and it can be shown as below for both players , where π(a i) is the probability that the attacker will use attack action ai. Similarly , φ(dj) is the probability that defense action dj will be adopted by the defender. Author name / Procedia Manufacturing 00 (2018) 000–000 5       12 121 1,1 ,1 , , , , , , n in jmi i n j ia a a a a d d d d d              (3) The strategy of a player in the long run could be found by formulating the optimization problem as a linear program to find the optimal global utility. The global utility is the amount of damage to the sy stem or the win for the attacker in the long run. This number is directly related to the strategy of both players , and by altering the strategy , the value will change accordingly . Consequently, it is assumed in this research that any player will try to max imize the gain by altering his strategy regardless of the strategy of the other player. Based on this intuiti on the problem if formulated to find a profile of strategies such that each player's strategy is the best response (results in the highest available payoff) against the equilibrium strategies of the other players. This equilibrium is called the Nash equilibrium. **( , ) argmin max ( ( ), ( ), )ij i j ij U U a d     (4) Additionally, the game is defined as a two-player zero-sum game with complete information and rational players. Further details of the solution approach can be found in [17,18] . 4. Numerical Example of Risk Assessment In th is section, a numerical case study is presented to further illustrate the propose d method. The manufacturing system considered in this example iden tifies seven risks, namely, theft of intellectual properties, hacking employee log-in credentials, infecting SCADA, hacking wireless devices, taking over production machines, infecting network, insider attack , in its cyber -physical system . Any attempts to harm and attack these vulnerabilities would be considered as action s from the attacker. On the other side, the manufacturing system as the defender has five different action s to react to the attacker’s actions. Th ese actions could be from the four main type s of defensive response which is to avoid, transfer, mitigate or accept the risk. Doing nothing is consider ed as the last available action for defender, D5, which is an accept able type of response for the defender. The summ ary of the model is presented in Table 3. Table 3. Summary of system information used in the illustrative example. Type of game Two players zero -sum game with incomplete information and rational players Players Two players: Attacker and the system as the defender Attacks A = {a1, a2, a3, a4, a5, a6 a7 } = {theft of intellectual properties, hacking employee log -in credentials, infecting SCADA , hacking wireless devices , taking over production machines , infecting network , insider attack } where ak denotes an attack action Defenses D = {d1, d2, d3, d4, d5}={avoid risk, transfer risk, mitigate risk, accept risk, do nothing} where dl denotes a defender action Maintaining cost of defense mechanism s = {80, 150, 200, 500, 0 } where sl denotes maintenance cost for dl Production loss rate p = {0.1, 0.15, 0.8, 0.5, 1, 0.1, 1} where pk denotes the production loss rate according to ak Total production T = 1000 Cost of recovery r = {140, 50, 100, 300 } where rk denotes the cost of recovery from attack ak to bring back the system to its initial state matrix of effectiveness 𝐸={𝑒𝑎𝑖,𝑎−𝑖}= [ 0.80.10.10.30 0.950.10.10.30 0.1 0.1 0.2 0.4 0.050.7 0.85 0.7 0.85 0.80.50.90 0.950.70 0.80.90 0.95 0.20.1 0.20 0] The interaction between the system and the attacker is modeled as a two -player zero -sum game. This game is a simultaneous stochastic game mean ing both player s choose their action in the same time or if one player plays sooner , the other player will not able to know its move until it choose s an action too. Also, this is a game with the complete 6 Author name / Procedia Manufacturing 00 (2019) 000–000 information and rational players which mean that both players know the consequence of their actions and both are trying to gain a maximu m benefit from the game. Based on the definition of the game since it is a zero -sum game the maximum gain for the defender is to minimize damage to the system. Having the action sets for both players defined and knowing the maintaining cost of defense, pro duction loss rate, total production, cost of recovery, and effectiveness matrix , the utility function (reward function) can then be calculated by Equation (2). As mentioned before, since the game is a two-player game , the utility function could be shown as a 7×5 matrix wh ere rows represent the attack actions and columns represent defender. In this function , each element demonstrate s the gain of the attacker from the joint action of both players. Since the game is defined as a zero-sum game , negative values indicate a defender loss and an attacker gain. 64 351 396 518 240 14 315 360 490 200 1080 381 660 162 1120 657 120 42.5 345 650 960 381 264 162 1120 228 67.5 25 720 300 1501 330 1360 1600 1500          (5) Now based on the utility function , the Nash equilibrium could be calculated. There are number s of ways to find the Nash equilibrium for such a game , but s ince the game is zero -sum with two players and target is to find equilibrium , the best to use linear progra mming [18]. In this example, s trateg ies found for each player are as follow s:        12 12 , , , 0, 0, 0.46, 0, 0.39, 0, 0.15 , , , 0, 0.87, 0, 0.13, 0in jmA A A A D D D D             (6) As seen , the attacker abandon s using actions A1, A2, A4, and A6 in the long run and adopts the strategy of using A3, A5, and A7 with the probability of 46%, 39%, and 15% respectively. Similarly, the defender ends up abandoning D1, D3, and D5 and only uses D2 and D4 with the probability of 87% and 13% , respectively. Ultimately, the global utility , which means the amount that the attacker will gain and the defender will lose in the long run , is 373.50 and there will be no better strategy for them to maximize further their utility and any deviation from these strateg ies will cost the player lower gain in the long run. In assessing the likelihood of occurrence , risk s (types of attack) with zero probabili ty are assigned with a likelihood score of 1 , according to Table 2. Similarly , the likelihood of risks with non -zero probability could be found from the same table. Now , by knowing the se verity and having the likelihood calculated of each risk , the cyberse curity criticality number (CSCN ) could be found by the multipl ication for each risk ( Equation 1). Table 4. Cybersecurity criticality number results for system's vulnerabilities Attack Action Severity (S) Likelihood (L) CSCN Theft of intellectual properties A1 7 1 7 Hacking employee log -in credentials A2 4 1 4 Infecting SCADA A3 8 5 40 Hacking wireless devices A4 5 1 5 Taking over production machines A5 6 4 24 Infecting network A6 5 1 5 Insider misuse A7 7 2 14 5. Risk Management based on CSCN Every company should have a threshold for their risk appetite which means any risk with CSCN above the risk appetite of the company should be respond ed. To have a better understanding, in this example the four zones are Author name / Procedia Manufacturing 00 (2018) 000–000 7 explained, minor risk zone, low-risk zone, high-risk zone, and extreme risk zone. However , the main criteria to decide is the risk appetite of the company. It is assumed that the risk appetite of the company is below 30. Moreover, any risk with the cybers ecurity criticality number below 10 will be accepted which illustrate the minor risk zone , and there would be no need to react . Similarly , any risk with cybersecurity criticality number above 50 illustrate s the extreme risk zone and should be addressed immediately as both the severity and likelihood are high. Any risk between 10 and 30 will be considered as low risk and between 30 and 50 is considered as the high-risk zone. These limits are shown with three cures in Figure 1 that illustrate calculated CSC N for all the risks in terms of severity vs. likelihood. As Figure 1 and Table 4 illustrate the only risk with CSCN above the company’s risk appetite is A3, infection of SCADA and control systems, with the CSCN of 40 which is in the high-risk zone . It is mostly due to the high severity of the risk besides having the highest probability of occurrence among the set of risks since it is aligned with the strategy of the attacker in the long run. Besides the vulnerability of the control systems in the company , another two risks , A5 (taking over production machines ) and A7 (insider misuse ) have relatively high CSCN but are located in low-risk zone . It means that since their CSCN is below the risk appetite of the company, 30, they should be monitored but could be accepted . Rest of the risks, A1, A2, and A4, have a cybersecurity criticality number below 10 , which means they are in the low-risk zone and no action needed for them . According to the a nalysis mentioned above , the company should react to the A4 by introducing new defensive action , and upon completion, the procedure of risk assessment should be done again . This procedure should be repeated until all the risks come below th e risk appetite of the company. The re is a point that should be considered here that changing defense policy to lower the risk of A4 will change the whole formation of the game and attacker will respon d accordingly. It means that for the next round of the analys es, those risks with high severity could get a high likelihood and as a result , the priority of addressing risk would be different. 6. Conclusion The ISO defines risks as the effect of uncertainty on an object , or anything that could go wrong in the company. Recently, as a result of the integration of cyber systems and physical production systems, manufacturing enterprises are exposed to a new type of risks from cybersecurity. Failure modes and effects analysis (FMEA) provides a method to assess risks in manufacturing systems however it has shortcom ing regarding cybersecurity including its weakness when there is an insufficient prior experience to find the likelihood of occurrence and also not considering the dynamic interaction of attacker and the system toward the cybersecurity. In this paper , a me thod was propose d that employed game theory approach to facilitate cybersecurity risk assessment by considering the interaction of an attacker and a manufacturing enterprise as a game to predict the attackers’ behavior probability in the long run also know n as Nash equilibrium mixed -strategy of the attacker . Then, Minor risk Low risk Extreme risk Figure 1. Cybersecurity criticality number (CSCN) in terms of severity vs. likelihood High risk 8 Author name / Procedia Manufacturing 00 (2019) 000–000 cybersecurity criticality number (CSCN) was proposed as the product of severity and likelihood of occurrence as the criteria to assess cybersecurity risks comparing to risk appetite of the system. Also, severity table is modified to match the needs of a manufacturing system regarding the cybersecurity issues. Also , a numerical case study was presented to further demonstrate the proposed method. For future research, the first suggestion is to refin e the utility function of the game to consider further important detail and characteristics in the manufacturing setting . For example, the impact of social costs such as harm to the reputation of a company due to an attack could be considered. Also, the game could be modeled as a non -zero-sum game that needs to have two utility function s, one for the defender and one for the attacker . The current function only consider s the characteristics of t he defender which could be different from the attacker’s perspective. Besides, the amount of the loss for the defender does not always equal to the gain for the attacker.