Quantifying potential cyber-attack risks in CNC systems under zero-subjectivity closed-loop Dempster–Shafer theory FMECA and rule-based Bayesian network modelling

Cybersecurity of computer numerical control (CNC) machine tools has become a critical concern in manufacturing, driven by increasing reliance on smart manufacturing and industrial networks. However, dedicated cybersecurity risk assessment methods for CNC systems remain scarce, and domain-specific threat probability databases are lacking. To address this gap, a risk quantification framework is developed by integrating Failure Mode, Effects, and Criticality Analysis (FMECA) with a Rule-Based Bayesian Network (RBN), based on the Zero-Subjectivity Closed-Loop Dempster–Shafer (ZDS) theory. Within this framework, experts evaluate FMECA parameters for 26 cyber threats; the ZDS theory is then applied to fuse these expert opinions, and the results drive an RBN to achieve hierarchical probabilistic modeling of attack risks. The results show that ZDS significantly enhances the robustness of evidence aggregation. The communication module and the sensor/encoder system are identified as the most vulnerable components, with Denial-of-Service (DoS) attacks on network communications presenting the highest risk. Further analysis reveals that the success of these high-risk threats hinges on the compromise of two strategic points: communication links and control cores. Accordingly, an asymmetric security strategy is proposed to prioritize the protection of these core elements. This study provides a novel methodological foundation for identifying and quantifying cybersecurity risks in CNC systems and supports the formulation of effective security strategies for smart manufacturing.