Enhancing cyber risk management in the construction industry

The construction industry is in the midst of a digital transformation marked by Construction 4.0. While various digital technologies such as cloud computing, robotics, drones, and unmanned aerial vehicles have significantly boosted the efficiency of construction projects, the industry is lagging behind others in terms of cybersecurity. This is evidenced by a large number of cyber incidents that have been increasing over the years. However, studies on enhancing cybersecurity in this industry have been both scarce and fragmented, lacking a unified cybersecurity guideline and framework at the project level. To bridge this gap, this dissertation aims to systematically explore the integration of cybersecurity into construction projects. The outcomes from this dissertation will be beneficial in enhancing cyber risk management in the construction industry.This dissertation contains four research projects, each having a unique contribution to enhancing cyber risk management in construction projects. (1) It identifies potential cybersecurity research topics by employing the Latent Dirichlet Allocation topic modeling technique to analyze a large, meticulously collected and screened text corpus. This guides future research and industry practices, facilitating unified research progress in this area. One of the most important topics identified is cyber risk management, setting the stage for the remainder of the dissertation. (2) It identifies various cyber risks across construction phases by developing a construction cybersecurity-dedicated language model, which is enhanced by Supervised Fine-tuning and Reinforcement Learning from Human Feedback training techniques. The resulting prioritized cyber risk checklist serves as a new benchmark for the industry. Additionally, the developed language model shows great potential in serving as an intelligent cybersecurity consultant for industry-wide applications. (3) It identifies risk factors associated with construction projects that lead to common cyber risks, realized through a systematic methodological process of literature review, questionnaire surveys, and expert consultations. The identified risk factors, each divided into specific scales, lay the groundwork for quantitative risk assessments. (4) It develops a machine learning-centric approach for a more quantitative cyber risk assessment at the project level, providing a tool for project managers for reliable cyber risk decision-making and efficient risk mitigation efforts.This dissertation represents one of the pioneering systematic studies on cybersecurity within the construction industry, aiming primarily to enhance cyber risk management for construction projects. It contributes to the existing body of knowledge by proposing and adapting methodologies and frameworks for cyber risk management, fostering interdisciplinary research among the fields of artificial intelligence, cybersecurity, and construction management. Additionally, it offers practical tools for construction practitioners to enhance cybersecurity, such as the identified research topics, the cyber risk checklist, and the developed machine learning model for quantitative risk assessment. The long-term goal is to create a cybersecurity digital platform tailored for construction projects, integrated into construction companies' software as mobile or web applications. This platform will be capable of performing various advanced functions and providing targeted cybersecurity answers, suggestions, and solutions, catering to both specific construction projects and general cybersecurity inquiries